Unable to change members of AD security groups who have access to shared mailboxes

I have an exchange 2013 running for over a year now and never had any problems with it. Until recently.
A request came in to make a new shared mailbox. So I did just that and gave rights to a security (not mail enabled) AD group. Just like I Always do. Everything worked fine. A few hours later I did exactly the same for another request and then the people
could not access the shared mailbox. So I added my regular user to the AD group and I also couldn't (I tested it with OWA and Outlook). I tried to remove myself of one of my own shared mailboxes and the permissions wouldn't stick. When I removed the entire
group then the permissions were gone(and I could not access the shared mailbox). When I added it back I had my permissions back but still wasn't in the group. Then I tried adding a distribution group with the same result.
It seems when I add normal users directly to the permissions everything works.
When I had to restart the server a few days later. All changes were applied but I could not change it again.
i'm a bit stumped on this one. i'm out of options.

Hi Jelle,
"I did exactly the same for another request and then the people could not access the shared mailbox.", I would like to verify if you give the same Security Group rights to multiple shared mailboxes.
If the security group members can't have access to all the shared mailboxes they have rights, you can recreate a security group and grant permissions to shared mailboxes one by one to check the result.
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support

Similar Messages

List of reports and groups who can access the reporta

Please i need some help
I need to get list of bo reports and groups who can access these reports.
I got list of groups but i need the list of reports and groups who have access to those reports.
Is there any query which i can write in query builder to get that information.
please help me with query

No need for DB access. This might work for you.
//assumes you have a session objectpublicvoidGetCommunityACLs(intcommunityId){ Console.WriteLine("Retrieving users for community "+communityId.ToString()); IPTObjectManagercommunityManager=session.GetCommunities(); IPTCommunitycommunity=(IPTCommunity) communityManager.Open(communityId, false); IPTServerContextserverContext=(IPTServerContext) community.GetInterfaces("IPTServerContext"); //since IPTServerContext is obtained from a community, //the IPTServerContext.GetACL() method will return a list of all objects that have acls defined on it. IPTAccessListaclList=serverContext.GetACL(); for(inti=0; i<aclList.GetCount(); i++) { IPTAccessListEntryacl=aclList.GetItem(i); stringmemberType; if(acl.GetClassID() ==PT_CLASSIDS.PT_USER_ID) memberType="User"; elseif(acl.GetClassID() ==PT_CLASSIDS.PT_USERGROUP_ID) memberType="Group"; else memberType=""; Console.WriteLine("{0}: {5,-6}{1,-3} Access Level={3,-2} r/o={4,-6} {2}", i, acl.GetObjectID(), acl.GetName(), acl.GetAccessLevel(), acl.GetReadOnly(), memberType ); }}
Ruslan.

When I want to change my desktop pattern, I no longer have access to my iPhoto as a choice. I am just given the Apple pictures and colors. I have OS 10.9.4 on a MacBook Pro.

When I want to change my desktop pattern, I no longer have access to my iPhoto as a choice. I am just given the Apple pictures and colors. I have OS 10.9.4 on a MacBook Pro. I could always choose any photo in my iPhoto for my desktop, but no longer. This problem is only about a month old and I can't figure out what to do.

When I want to change my desktop pattern, I no longer have access to my iPhoto as a choice. I am just given the Apple pictures and colors. I have OS 10.9.4 on a MacBook Pro. I could always choose any photo in my iPhoto for my desktop, but no longer. This problem is only about a month old and I can't figure out what to do.

Unable to connect to : eul4_us@VIS, You do not have access to any End User

Hi all
I have configured and created EUL in 11.5.10.2 VISION instance on widows 2003,
When I tried to connect to Discoever4i on 11i VIS instance I am getting the following error :
Unable to connect to : eul4_us@VIS
You do not have access to any End User Layer tables
But I can connect to eul4_us@VIS via TOAD and SQL*PLUS Client, Also Discoverer Administration Edition can connect to eul4_us@VIS.
Also with the same Discoverer Release 4 Desktop Edition we can connect to the another VIS instance which is running on solaris 9, Only problem with the VIS at Windows2003,
Please Can any one give some solutions ASAP
Thanks
Divyanand

Hi,
In general, with an Apps mode EUL I would expect that you will get the the "You do not have access to any End User Layer tables" when you connect to desktop as the EUL owner. This is because the EUL owner does not have (and does not need) privileges to the Apps tables and functions. You should connect to Desktop as an Apps user.
Rod West

Unable to change registry key permissions using group policy

In order to fix a problem with a piece of software not saving it's settings I need to change the permission on a registry key of our client machines.
I've setup a GPO and in Computer Configuration -> Windows Settings -> Security Settings -> Registry specified the registry key I want to change the permission on, added our staff security group and given the full control over that key.
The permission are not being changed and when I run rsop I'm getting the following error:
The policy engine did not attempt to configure the setting. For more information see %windir%\security\logs\winlogon.log on the target machine.
I've looked in the winlogon.log file and can see nothing meaningful that relates to this GPO. I set the logging to be verbose and this doesn't include any additional information. There appears to be nothing meaningful in the event logs on the
local machine.
The OS is Windows 7 SP1
Anybody shed any light why the policy wouldn't be applying the permissions to the registry key?

Hi,
Is this client running Windows 7 64bit? If so, this problem is expected since the Wow6432Node key is only recognizable in 64bit applications.
Security Client Side extension is a 32 bit application and therefore cannot see the key to change permissions. In this situation, you need to change permission in HKLM/Software/[appname]. For more information, please refer to
http://support.microsoft.com/kb/896459
If it is Windows 7 32bit, this is a GPO not apply issue. Please check if the following registry keys exist on the Windows 7 client:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SMART Technologies
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SMART Technologies Inc.
If so, please help collect the following information:
1.
Did this problem only occur on one Windows 7 client or occur on all Windows 7clients?
2.
What’s the Operating System on the DC?
3.
Enable debug logging for the Net Logon service. Reproduce the problem and check if there is any relevant error.
Enabling debug logging for the Net Logon service
http://support.microsoft.com/kb/109626
Regards,
Bruce

PS2010: Resource synchronization fails in project site creation and when changes users at the Security Groups.

I am not using AD syncronization for resource pool and security groups in Project Server 2010.
When I publish a new Project or try to create a Project web site manually it creates the Project site, but fails to synch the resources.
If I add or change one or more resources at the Project Managers security group at PWA it also fails to synchronize the root site and existing Project web sites.
I looked at the ULS log and appears the the following error:
Add or remove resources from a Security Group error excerpts:
"GeneralQueueJobFailed (26000) - AddSingleUserMembershipInWss.AddSingleUserMembershipInWssMessage. Details: id='26000' name='GeneralQueueJobFailed' uid='36d89522-f218-4bd2-870e-f07c9292435e' JobUID='f083e721-d7b2-4334-839b-fb10b5c0c513' "
"Failed to find the XML file at location '14\Template\Features\ReportServer\feature.xml'
Feature definition missing for Feature 'ReportServer' (Id: 'e8389ec7-70fd-4179-a1c4-6fcb4342d7a0')"
Create a new Project site error excerpt:
"CreateWssSiteContent: Creating project site failed! Project Uid=20450550-17ec-4278-83b0-b86116c63fb9, site URL=http://project.b2w/PWA/Teste 1001 2S, site name=Teste 1001 2S. System.Runtime.InteropServices.COMException (0x8107058A): <nativehr>0x8107058a</nativehr><nativestack></nativestack>The
content type name _$Resources:ReportServerResources,DataSourceContentTypeName;_ cannot contain: \ / : * ? " # % < > { } | ~ & , two consecutive periods (..), or special characters such as a tab..."
My Project site template is exactly the same than original Project Server site template (for test purpose) but created as Project site and then saved as template with another name.
In both cases there are a reference to "ReportServer", but I do not have either a Report Server installed in the farm or the Reporting Services Service Application.
Any ideas how can I correct this issue?
Best regards, Ricardo Segawa - Segawas Projetos / Microsoft Partner

Hi Segawa,
In the above thread you are saying that there are reference to "Report Server". Save the template to local file system and extract the template. Now check the onet.xml under "Webtemplates" folder. Do you see the references of report server there.
If that is the case, my suggestion would be to recreate the template without the reference for report server and then test the behavior.
Also, you can even remove the reference in the onet.xml and use some compressing tools to rebuild the wsp file and then use that as template.
Happy troubleshooting...
Vikram Daruru - MSFT

Set logon hours for security groups that will access RDS 2012

Hi All,
We have the following hardware for our RD Web solution:
1 Server – RD Gateway, RD Licensing, RD Web Access, RD Connection Broker
1 Server – RD Session Host 1
1 Server – RD Session Host 2
Our environment consists of the following:
1 Windows Server 2012 R2 domain controller at the main office, 4 additional 2003 R2 domain controllers scattered
throughout our 4 remote offices. Domain functional level of 2003. This all works under one flat domain called company.business.com
We have RDS up and running, and all of our users are able to access it through the internet either from home or directly from their remote office. Our next step is to focus on restricting
access.
In Active Directory, we have accounts for Support Staff, and accounts for Sales People. They will all have access to RDS in
the following ways:
Support Staff will use it from 8am to 5pm throughout the day so that they may connect to the Mickey Mouse 2000 software that is located in the main office
Sales People will use it 24/7 for all intended purposes
How do we set it so that Support Staff can only access it internally but not externally when they are outside of the
office while still providing 24/7 access to the Sales People?
Can this be accomplished using security groups or logon hours? All input is greatly appreciated, thank you!

Hi,
Thank you for posting in Windows Server Forum.
Based on your description seems you want to have user to get access your software by RemoteApp. You can achieve your desired solution with below steps.
• Support Staff will use it from 8am to 5pm throughout the day so that they may connect to the Mickey Mouse 2000 software that is located in the main office
• Sales People will use it 24/7 for all intended purposes
For above one, you can restrict the access to particular user\group from the “ADUC>Users properties>Account>Logon Hours” where need to specify the time limit for user to Logon or denied logon.
How do we set it so that Support Staff can only access it internally but not externally when they are outside of the office while still providing 24/7 access to the Sales People?
When you have setup your environment, you have configured RD RAP and RD CAP; right? You can try not to include the user group that you don’t want to have outside environment. Please check following article for information.
Checklist: Make RemoteApp Programs Available from the Internet
http://technet.microsoft.com/en-in/library/cc772415.aspx
Hope it helps!
Thanks.
Dharmesh Solanki
TechNet Community Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

I'm trying to change my BlackBerry ID, I no longer have access to my old email account - what can I

I'm trying to change my BlackBerry ID, as I can't remember the password, I can't reset it as I no longer have access to my old email account. What can I do?

Oh. You had not said you had tried that. To enter a NEW BlackBerryID on a device existing with an old BBID, you must perform a security wipe on the device first.Switching the BlackBerry ID on the BlackBerry PlayBook or BlackBerry 10 smartphone:In order to switch the BlackBerry ID that is associated to the BlackBerry 10 smartphone or a BlackBerry PlayBook tablet, a security wipe will need to be performed.Warning: Performing the security wipe will result in loss of stored data on the smartphone or tablet. Be sure to create a backup and also transfer files to a computer prior to performing the security wipe.Prior to performing a security wipe of the smartphone or tablet, transfer files to a computer so the files can then be transferred back to the smartphone or tablet after the security wipe is complete and the new BlackBerry ID is configured.If you are moving to a new device or tablet you can backup your data, complete a security wipe (to remove the BBID), sign in with the same BBID on the new device, and restore your data.If you are completing these steps due to loosing access to your BBID account you will not be able to restore any data as the same BBID account must be used to complete the restore process.See the following links for information on backing up data&colon;KB26068 - How to transfer files to and from the BlackBerry PlayBook tablet and BlackBerry 10 smartphone.Manually synchronize music files to the BlackBerry 10 smartphone or BlackBerry PlayBook tablet.Import your contacts and calendar appointments from Microsoft Outlook.To perform the security wipe:On the BlackBerry 10 smartphone, see KB33591.On the BlackBerry PlayBook tablet, see KB27188.Once the security wipe has been completed, a new BlackBerry ID can be created on the smartphone or tablet during the initial setup.
Details: Article ID: KB26694 How to switch the BlackBerry ID account on a BlackBerry smartphone or BlackBerry PlayBook tablet

Unable to connect End user layer /You do not have access to any end user Layer tables

I get the following error message in Disco Admin ver 4.1.33.1.6 :
1)Unable to connect End user layer
In disco plus I get the follg error:
a)You do not have access to any end user Layer tables
This is despite the fact that my userid/passsword combination@databaseid has acess to all tables in Oracle sqlplus SQL*Plus: Release 8.0.6.0.0 -
Connected to:
Oracle8i Enterprise Edition Release 8.1.7.1.0 - 64bit Production
With the Partitioning option
JServer Release 8.1.7.1.0 - 64bit Production
Please reply ASAP if anyone has any ideas
Thanks
Gurman
null

Have u created a EUL for your user through Administration Edition.
If not login as a user who has DBA rights and create EUL for your user.
<BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:</font><HR>Originally posted by Gurman Sandhu ([email protected]):
I get the following error message in Disco Admin ver 4.1.33.1.6 :
1)Unable to connect End user layer
In disco plus I get the follg error:
a)You do not have access to any end user Layer tables
This is despite the fact that my userid/passsword combination@databaseid has acess to all tables in Oracle sqlplus SQL*Plus: Release 8.0.6.0.0 -
Connected to:
Oracle8i Enterprise Edition Release 8.1.7.1.0 - 64bit Production
With the Partitioning option
JServer Release 8.1.7.1.0 - 64bit Production
Please reply ASAP if anyone has any ideas
Thanks
Gurman
<HR></BLOCKQUOTE>
null

I had to change my email acct and do not have access to the original one my icloud, iTunes,etc have. I changed it and signed out and was able to successfully change to the new email on iTunes and Apple ID. However, I can not get icloud to change over and.

I can not get icloud to let me change the email to my new acct???

To change the iCloud ID you have to go to Settings>iCloud, tap Delete Account, provide the password for the old ID when prompted to turn off Find My iDevice, then sign back in with the ID you wish to use. If you don't know the password for your old ID, or if it isn't accepted, and if your old ID is an earlier version of your current ID, go to https://appleid.apple.com, click Manage my Apple ID and sign in with your current iCloud ID. Click edit next to the primary email account, change it back to your old email address and save the change. Then edit the name of the account to change it back to your old email address. You can now use your current password to turn off Find My iDevice on your device, even though it prompts you for the password for your old account ID. Then save any photo stream photos that you wish to keep to your camera roll. When finished go to Settings>iCloud, tap Delete Account and choose Delete from My iDevice when prompted (your iCloud data will still be in iCloud). Next, go back to https://appleid.apple.com and change your primary email address and iCloud ID name back to the way it was. Now you can go to Settings>iCloud and sign in with your current iCloud ID and password.

How to hide an webpart for the all members who have access for the this site but visible for the restricted read users?

Hi,
Any help?
Thanks
srabon

Hi Srabon,
We can set the "Target Audience" property of web part to group maintaining restricted read users. By this, the web part will be shown to specific users only.
Please let us know if this helps.
Thanks,
M. Gubendra Raj

I have an apple ID, but for some reason my phone has saved my previous Apple ID. I cannot change or add the old email address because the address no longer exists and I don't have access to the mailbox. Therefore, when I try to delete my iCloud account fr

x

If you can't remember the password for the ID, and no longer have access to the email account associated with the ID to reset it, try contacting iTunes Store support: http://www.apple.com/emea/support/itunes/contact.html. They frequently deal with Apple ID password issues.

How do i change my password if i no longer have access to old email address

I have an iphone 4 that I have used for last 2 or 3 years.
I recently upgraded to 7.1.1
I need to upgrade an app, I only use the phone occaisionally and cannot remember the password for the App store but I still have the screen unlock PIN number.
I cannot request a PW reminder because the domain name for the email no longer exists, hence I no longer am able to request a reminder.
I entered the DOB but I must have entered the wrong DOB originally, how can I donwload a new version of the app (SUMUP)

I would say that calling apple would be your best bet at this point.
800 692 7753
Either you're typing in the wrong email address to reset, or you did type in the wrong birthday to start.

Unable to change group text name or add person to some group texts in iOS 8

I really like the ability to change group text names as it helps me separate work group texts from personal especially when I have coworkers that have separate business phones. I'm unable to change the name of some group texts as the option is not there when I go into details. I'm also unable to add contact to the same group texts that I'm unable to change the name on. Is this a glitch or am I missing something?

Hi CaliWingsFan,
If you are having issues with renaming and adding users to group texts, you may want to try some things to troubleshoot.
First, quit all running applications and test again -
iOS: Force an app to close
Next, I would try restarting the iPhone -
Turn your iOS device off and on (restart) and reset
If the issue is still present, you may want to restore the iPhone as a new device -
iOS: How to back up your data and set up your device as a new device
Thanks for using Apple Support Communities.
Best,
Brett L

Shared Calendars / Room Lists and automatically forcing them to users based on Security Group Membership

Good morning all,
I need some help achieving the following in our Exchange 2013 Environment. First off, we have Exchange 2013, but all our clients have Outlook 2010.
Here's what I would like to be able to do:
1) create/manage public calendars / rooms in exchange 2013
2) force these shared public calendars / rooms to users' calendars who are members of particular security groups
3) give edit permissions / "booking" permissions for the shared calendars so select users are able to make changes to the shared calendars, as well as accept/deny requests to "book" shared room calendars
Any one got any resources they can give to point me in the right direction?
I have already created two mailbox room resources, and have them set up in a room list in AD. But need to know the above as far as creating a shared calendar for events, and forcing these calendars / room lists out to users based on security group
membership.
I don't want my users to have to know how to add a shared calendar...that would be a nightmare explaining. I just want it to show up.
Any help on this is greatly appreciated, thank you!

1) I recommend using Room Mailboxes for resource calendars because it just works better.
2) This is a standard feature of a Room Mailbox.
3) You're pretty specific here, but I think this is also more or less available with a Room Mailbox combined with folder rights.
I don't know any way to just make them "show up". You'll have to teach them. Well written instructions can work wonders.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Unable to change members of AD security groups who have access to shared mailboxes

Similar Messages

Maybe you are looking for