Last year, I deployed a new set of Exchange Server 2007 servers (Client Access and Hub Transport on one server, Mailbox Server on another) into an Exchange Server 2003 environment for a customer as part of the build phase of the messaging migration component of a large infrastructure upgrade project. I went about testing mailbox access, mail routing etc and found that I had some weird behaviour occurring.
I couldn’t log on using OWA to mailboxes I created on the new Mailbox Server or mailboxes I migrated from the Exchange 2003 server because I was getting a "you do not have permission to access this mailbox" error (below).
![[owa+error.png]](http://2.bp.blogspot.com/_2HSNh5NAP4Q/SkG9K_ArM2I/AAAAAAAAAJ8/qDuQRgMu9WU/s1600/owa%2Berror.png)
I checked the mailbox permissions on the mailboxes and everything looked fine (NT AUTHORITY\SELF was specified).
I could however log onto mailboxes on the Exchange 2003 using the Exchange 2007 OWA, meaning OWA itself looked ok. No mail was traversing between the two environments nor was it getting to external recipients from Exchange 2007 mailboxes.
In addition to that, I was getting these warnings on the Mailbox Server:
Log Name: Application
Source: MSExchangeMailSubmission
Date: 24/06/2009 2:29:44 PM
Event ID: 1009
Task Category: MSExchangeMailSubmission
Level: Warning
Keywords: Classic
User: N/A
Computer: MBX.domain.local
Description:
The Microsoft Exchange Mail Submission Service is currently unable to contact any Hub Transport servers in the local Active Directory site. The servers may be too busy to accept new connections at this time.
And these on the Client Access/Hub Transport Server:
Log Name: Application
Source: MSExchangeTransport
Date: 24/06/2009 5:51:41 AM
Event ID: 1035
Task Category: SmtpReceive
Level: Warning
Keywords: Classic
User: N/A
Computer: CASHT.domain.local
Description:
Inbound authentication failed with error LogonDenied for Receive connector Default CASHT. The authentication mechanism is Gssapi. The source IP address of the client who tried to authenticate to Microsoft Exchange is [ipaddressofex2003machine].
And:
Log Name: Application
Source: MSExchangeSA
Date: 18/06/2009 8:37:22 AM
Event ID: 9186
Task Category: General
Level: Warning
Keywords: Classic
User: N/A
Computer: CASHT.domain.local
Description:
Microsoft Exchange System Attendant has detected that the local computer is not a member of group ‘/dc=local/dc=domain/ou=Microsoft Exchange Security Groups/cn=Exchange Servers’. System Attendant is going to add the local computer into the group.
The current members of the group are ‘CN=Exchange Install Domain Servers,CN=Microsoft Exchange System Objects,DC=domain,DC=local; CN=CASHT,OU=Servers,OU=IT,OU=Company,DC=domain,DC=local; CN=MBX,OU=Servers,OU=IT,OU=Company,DC=domain,DC=local; ‘.
Because this was a new install of Exchange Server 2007, I thought something was up with the install so redeployed the virtual machines from template and installed from scratch and reconfigured everything but alas, no dice. I’d never seen these kind of issues on other deployments so found it really weird.
I google’d everything I could to find a solution but nothing came up. I ran the Exchange BPA and Troubleshooting agents, ran Test-MAPIConnectivity and Test-OWAConnectivity but to no avail.
Quite perplexed, it was here that I called Microsoft Product Support Services to check out the problem with me.
We increased event logging levels on OWA, Information Store, Mail Submission on the relevant servers but still didn’t see anything compelling to determine the problem. I also tried removing the OWA virtual directory and recreating it but this didn’t help.
Finally, we checked the Local Security Policy on the Mailbox Server under
Computer Configuration -> Windows Settings -> Security Settings -> Local Policies – User Rights Assignment and looked at the Access this computer from the network policy setting. It was here that I found that the Default Domain Policy was enforcing DOMAIN\Domain Users rather than not being defined at all as it should be.
Once I removed this setting and did a gpupdate /force on the two Exchange 2007 servers, everything lit up and worked as it should. I could log into an Exchange Server 2007 mailbox using OWA, mail started flowing between the two environments and to external recipients and all the warnings in the Application logs on both servers cleared up.
This is definitely not something you’ll come across regularly in your Exchange travels as it was a unique pre-existing issue with the customer environment, but worth checking out if you’re experiencing behaviour and warnings like this after you install Exchange Server 2007 into an Exchange Server 2003 environment.