I have exchange 2010 and a couple of domain controllers. I retested the permissions in AD and DNS (very brilliant thing to do, indeed.. just mocking), we are no longer able to manage exchange server, neither able to add any new mailboxes, error is as follows: Active directory response: 00002098: SecErr: DSID-03150E49, problem 4003 (INSUFF_ACCESS_RIGHTS)

I no longer see any security groups for excahnge anywhere in the domain controllers. What can I do to restore the correct permissions?

  • Give us some details on exactly what you did that caused this problem.
    – joeqwerty
    Commented Apr 15, 2017 at 15:06
  • But the Exchange Schema is still in place... means Exchange is working fine?
    – BastianW
    Commented Apr 15, 2017 at 18:04
  • yes, it works fine.. rather the issue is that no one can create a mailbox..
    – elekgeek
    Commented Apr 15, 2017 at 19:13
  • Joe, wt details do u need?
    – elekgeek
    Commented Apr 15, 2017 at 19:14
  • What permissions did you change and where did you change them from?
    – joeqwerty
    Commented Apr 16, 2017 at 14:39

2 Answers 2


Well, any details about "resetting the permissions in AD and DNS"? It's helpful for troubleshooting, or test it in lab to fix it.

Normally, we can re-run Exchange installation with ".\setup /Preparead" only to prepare AD object, not install Exchange server.


setup /adprep doesn't work. SP version in Exchange server 2010 installation media is different. In my case, setup /adprep will never work because I have already updated my servers to SP3.

To make a long story short, I did the following:

1. setup /PrepareLegacyExchangePermissions from Exchange Server 2010 installation media.

2. Under "Active Directory Users and Computers", expand System container, right click for properties on AdminSDHolder, go to Security tab, click Advanced, click "Enable Inheritance".

and that's it. I am happy to find out that it is possible to clean the rubbish caused by others, finally!!

P.S. Enable Inheritance was required because, under many circumstances after getting Exchange Server 2003/7 upgraded to 2010, permissions had to be applied not just "on this object only", rather on all descendants as well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .