Error when trying to access the RBAC User editor and Message tracking

Question

Hi,
I am getting an error when trying to access the RBAC User editor and Message tracking on the Web Mgmt interface. I verified that the admin account trying to access is in the Organization Management group and has the correct Role Assignment Policy applied.
I searched through this thread below and saw that matching the msExchRoleLink and msExchUserLink attributes fixed the issue. 
https://social.technet.microsoft.com/Forums/exchange/en-US/fc568cc6-8691-4127-b70b-bcc82f9b1f7f/first-2010-cas-server-no-administrator-rights-emc-permissions-gone?forum=exchange2010
However I have another environment where this is not the case and works just fine; the msExchUserLink attribute has a value of CN=Organization Management,OU=Microsoft Exchange Security Groups,DC=Domain,DC=Local which is different as per the issue outlined in
the above thread so I am not convinced that this will work and also don’t want to blindly edit something in adsiedit without being sure.
I then checked the event logs on the server and saw the below error logged;
Current user: 'Domain/Server Services Accounts/administrator'
Request for URL 'https://server.domain.com/ecp/default.aspx?p=AdminDeliveryReports&exsvurl=1' failed with the following error:
System.Web.HttpUnhandledException: Exception of type 'System.Web.HttpUnhandledException' was thrown. ---> Microsoft.Exchange.Management.ControlPanel.UrlNotFoundOrNoAccessException: The page may not be available or you might not have permission to open the
page. Please contact your administrator for the required credentials. For new credentials to take effect, you have to close this window and log on again.
   at Microsoft.Exchange.Management.ControlPanel._Default.CreateNavTree()
   at Microsoft.Exchange.Management.ControlPanel._Default.OnLoad(EventArgs e)
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   --- End of inner exception stack trace ---
   at System.Web.UI.Page.HandleError(Exception e)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest()
   at System.Web.UI.Page.ProcessRequest(HttpContext context)
   at ASP.default_aspx.ProcessRequest(HttpContext context)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Microsoft.Exchange.Management.ControlPanel.UrlNotFoundOrNoAccessException: The page may not be available or you might not have permission to open the page. Please contact your administrator for the required credentials. For new credentials to take effect, you
have to close this window and log on again.
   at Microsoft.Exchange.Management.ControlPanel._Default.CreateNavTree()
   at Microsoft.Exchange.Management.ControlPanel._Default.OnLoad(EventArgs e)
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
I then had a look at the IIS permissions for ecp and owa. The account did not have permissions so I added them there but still got the same error. I’ve also tried all of the above with a newly-created account but still got the same issue.
Any ideas as to what the above event log is specifically referring to?

Answer 1

Hi,
From your description, I would like to clarify the following thing:
If you want to search message tracking logs, the account you use should be a member of the role groups below:
Organization Management role group, Records Management role group, Recipient Management role group.
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support