Exchange 2010 New Address List insufficient access rights

Question

Hi,
I have tried to perform two actions within our new Exchange 2010 system and they fail with the same error.
The first was to convert an existing Address Lists using LDAP to OPATH
I used the following command:
set-addresslist "Exchange 2010 Test" -recipientfilter {(recipienttype -eq "MailUniversalSecurityGroup") -or (recipienttype -eq "MailUniversalDistributionGroup") -and (name -like "exchange2010.*")}
I get the error Access is Denied Active Directory response 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
I also get the same error when I use the Exchange 2010 EMC to try and create a new address list.  Note I have no problems managing address lists from Exchange 2003.
I have seen plenty of articles about the making sure that the user performing the action has the "Include inheritable permissions from this objects parent". 
I did check my Exchange admin user and this was not ticked.  Turns out that because I was also a domain admin so my account was in a protected group (Domain admins) the tick box was continually being removed.
I created a new Exchange user that was in the Exchange Organization Administrators security group, made sure the above box was ticked on the account but this did not fix the problem.
I have however noticed in Adsiedit that the "CN=All Address Lists" container does not have the "Include inheritable permissions from this objects parent" ticked.  I suspect that this might be the issue but I don't want to tick it
in case it breaks my address lists.
Should the inherit box be ticked on the "CN=All Address Lists" container?.  It is ticked on all the containers under the "CN=All Address Lists" container. 
At present the only Exchange permissions on the container are:
Exchange Admins: Full Control
Exchange Domain Servers: Read
Exchange Services: Full Control
I think that crucially the "Exchange Trusted Subsytem" security group is not listed
I have added my new Exchange account with Full control permissions but this has not made a difference
Your hopefully
Matt

Answer 1

Hi Matt,
From your description, I would like to clarify the following things:
1. "Include inheritable permissions from this object's parent" should be checked.
2. "Exchange Trusted Subsystem" should be added to the All Address Lists container.
So you are in the right direction.
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support