EAS and Exchange 2010 Http 500 only on SOME users

Question

We have had EAS and iPhones working really well for the past year in a Exchange 2003\2010 mixed mode environment.
NOTE: This is not related to the iOS v4 issue Apple is providing a fix for in v4.1
We have had no problems, but with the last batch of migrations (move mailbox) from e2k3 to e2k10 some users are not able to access mail once moved on their iPhones. I get "Cannot Get Mail - the connection to the server failed."
Yet we have many other users on the same Db from pervious migrations (move mailbox) from previous weeks that work just fine and continue to work fine while the others dont.
I have compared the accounts in ADSIEdit and one thought was the inclusion of the user's account + SELF in the permissions to the mailbox, but removing the user account did not help. I also moved the users to different Db's and the problem remains.
Both users started out in an AD site with non-internet facing CAS servers, but I have lots of other users over there who work fine. I also moved them to another AD site with internet-facing CAS and this didnt change anything.
If I run the testexchangeconnectivity.com I get a fail, yet I have also entered the credentials for the working users and they fail as well with and http 500 error yet they continue to work just fine on the device. Previous to adding the site with non-internet
facing CAS users did not fail this test. Any advice is appreciated. Here is the output:
ExRCA is testing Exchange ActiveSync.
The Exchange ActiveSync test failed.
Test Steps
Attempting to resolve the host name na.mail.reedelsevier.com in DNS.
Host successfully resolved
Additional Details
Testing TCP Port 443 on host na.mail.reedelsevier.com to ensure it is listening and open.
The port was opened successfully.
ExRCA is testing the SSL certificate to make sure it's valid.
The certificate passed all validation requirements.
Test Steps
The IIS configuration is being checked for client certificate authentication.
Client certificate authentication wasn't detected.
Additional Details
Testing Http Authentication Methods for URL https://na.mail.reedelsevier.com/Microsoft-Server-Activesync/
The HTTP authentication methods are correct.
Additional Details
An ActiveSync session is being attempted with the server.
Errors were encountered while testing the ActiveSync session
Test Steps
ExRCA is attempting to send the OPTIONS command to the server.
OPTIONS response was successfully received and is valid
Additional Details
ExRCA is attempting the FolderSync command on the Exchange ActiveSync session.
The test of the FolderSync command failed.
 <label for="testSelectWizard_ctl12_ctl06_ctl05_ctl01_tmmArrow">Tell
me more about this issue and how to resolve it</label>
Additional Details
Exchange ActiveSync returned an HTTP 500 response.
Exchange Freak | @ntpro | http://geekswithblogs.net/ntpro

Answer 1

Hello Chris,
The affected users may be members of too many groups causing their user tokens to be larger than the maximum allowed size. Compare group membership of a problem with a successful user.
Also, compare the Security permissions on the active directory account as well. (Specifically inheritable permissions)
Exchange ActiveSync Returned an HTTP 500 Error - Remote Connectivity Analyzer
http://technet.microsoft.com/en-us/library/dd439375(EXCHG.80).aspx
How to troubleshoot server ActiveSync HTTP error codes
http://support.microsoft.com/?kbid=330463
Hope this helps,
Kevin Ca - MSFT