Thanks for your comments/questions. I had
given up hope. J Nothing else changed. This is my production
hosted Unity domain. I’m the enterprise admin; no one else has that
password. Yes, the DC2 machine account had full
mailbox access. The only errors in the event log were when the service suddenly
couldn’t log in anymore, the service began logging errors: An attempt to access the Exchange Private
Store has failed: 8004011d. The MAPI subsystem returned the following
error: You do not have permission to log on. There are no failures in the security log. I didn’t take a network trace. L As soon as I
restarted the service, a couple of dozen small companies suddenly found their
telephone service wasn’t answering calls and I had to resolve it, ASAP. I
did that by throwing permissions at it. Since I wrote the original email, I’ve
poured hours into investigation of this. As soon as the FSMO roles were moved
(within 15 minutes), the mailbox service started generating warnings about not
being to access certain log files. But it was 2.5 days later until it couldn’t
access the mailbox and began generating errors. Moving the FSMO roles definitely had some security
impact; one I’ve never heard of before; and it worries me. From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe Interesting. I can't think of anything that a FSMO role
move would have changed that would have caused that behavior. However, my love
of exchange is not unknown on this list nor is it, in my opinion, unfounded. There
are many things in Exchange that aren't quite logical. :o) So anyway, did anything ELSE change and
are you sure and how do you know? I would assume that you set up the mailbox
so that DC2 machine account had full mailbox access? If not, how was it accessing
the mailbox? Any errors in the event log? What do you see in a network trace? joe ------------- http://www.joeware.net (download joeware) http://www.cafeshops.com/joewarenet (wear joeware) From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael B. Smith Windows 2000 Native Mode, flat (single) domain, single site. DC1 and DC2 are both Windows 2000 servers w/sp3 plus all
current hotfixes. Until last Sunday (3/28), DC1 holds all FSMO roles. Both
DC1 and DC2 are GCs. DC2 runs a service, under localsystem, that logs into an
Exchange mailbox, which is explicitly set to allow "Domain Admins" to
have "Full Mailbox Access". Everything works fine. Two Wednesdays ago (3/24), a Windows 2003 DC (DC3) was
introduced into the mix. It was allowed to be there for five days to ensure no
problems happened. Last Sunday (3/28), all FSMO roles were moved to DC3. This Wednesday (3/31) the service running on DC2 suddenly reports
that it can't log into the Exchange mailbox anymore. After a restart it reports
the same thing. After a reboot it reports the same thing. It took changing the service account to a domain admin
account for the service to start operating again. Two questions: 1) Just WTF? :-) 2) Should I have expected that transferring FSMO roles would
affect how permissions of localsystem on a DC were applied? 3) Why the 3 day delay? (yeah yeah, I know that was three, not two, but the first
one was really specious.) Thanks, Michael |
- [ActiveDir] Move FSMO Roles Affect Permissions? Michael B. Smith
- RE: [ActiveDir] Move FSMO Roles Affect Permissio... joe
- RE: [ActiveDir] Move FSMO Roles Affect Permissio... Michael B. Smith
- RE: [ActiveDir] Move FSMO Roles Affect Permissio... Eric Fleischman
- RE: [ActiveDir] Move FSMO Roles Affect Permissio... Michael B. Smith
- RE: [ActiveDir] Move FSMO Roles Affect Permissio... Michael B. Smith
- RE: [ActiveDir] Move FSMO Roles Affect Permissio... Eric Fleischman
- RE: [ActiveDir] Move FSMO Roles Affect Permissio... Michael B. Smith
- RE: [ActiveDir] Move FSMO Roles Affect Permi... Ulf B. Simon-Weidner
- RE: [ActiveDir] Move FSMO Roles Affect Permissio... jack . eales
- RE: [ActiveDir] Move FSMO Roles Affect Permissio... Eric Fleischman
- RE: [ActiveDir] Move FSMO Roles Affect Permissio... Michael B. Smith