Unable to manage/create Resources, Room/Equipment, Exchange 2013 CU5

Question

Hi
We have a mixed 2007SP3 and Exchange 2013 CU5 eviroment.
Pretty much since CU3 (first version we installed) we have had problems with resources, but since SP1 we cannot create or edit resources.
We have a root domain and three child domains, all Exchange 2013 servers are in the root domain. The Exchange 2007 servers are located in the root and two of the child domains.
When creating a Room we get this:
Note: Pulsar is the E2013 CU5 Mailbox-server, Panerai is a Domain Controller in a child domain. 
The Room is the listed but when trying to open it we get this:
In the mailbox-server log we get this log: ID 4 Source MSExchange Control Panel
Current user: 'newsec.se/Consultants and Commons/IT-Stureplan/ADMINISTRATOR'
Request for URL 'https://pulsar.newsec.se:444/ecp/UsersGroups/EditRoomMailbox.aspx?pwmcid=37&ReturnObjectType=1&id=638db8e2-355c-4e44-9e01-f577c470f297(https://owa.stronghold.se/ecp/UsersGroups/EditRoomMailbox.aspx?pwmcid=37&ReturnObjectType=1&id=638db8e2-355c-4e44-9e01-f577c470f297)'
failed with the following error:
System.Web.HttpUnhandledException (0x80004005): Exception of type 'System.Web.HttpUnhandledException' was thrown. ---> System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Reflection.TargetInvocationException:
Exception has been thrown by the target of an invocation. ---> Microsoft.Exchange.Data.Directory.Recipient.NonUniqueRecipientException: Multiple objects with Sid S-1-5-32-548 were found.
   at Microsoft.Exchange.Data.Directory.Recipient.ADRecipientObjectSession.FindMiniRecipientBySid[TResult](SecurityIdentifier sId, IEnumerable`1 properties)
   at Microsoft.Exchange.Management.ControlPanel.RecipientObjectResolver.ResolveSecurityPrincipalId(IEnumerable`1 sidPrincipalId)
   at Microsoft.Exchange.Management.DDIService.MailboxPropertiesHelper.FilterEntSendAsPermission(DataRow inputRow, DataTable dataTable, DataObjectStore store)
We tried to put the AD-account in different domains/OUs... but the same problem occurs.
I have a case with MS-support (114051511444067) but I throw it up here also.
Regards
Robban

Answer 1

Hello Robban,
I didn't see your answer... (no mail notification ?)
I opened a MS ticket (114081411702089) and I got an answer :).
If you check security in ADSIedit.msc on your mailbox database object, you may find ACL entry for the group with the SID reported in the "application error event"
example : (CN=YourBDD,CN=Databases,CN=Exchange Administrative Group (FYDBOHF23SPDLT),CN=Administrative Groups,CN=YourOrganizationName,CN=Microsoft Exchange,CN=Services,CN=Configuration,CN=YourDomain,CN=local)
* "Domain\administrators" (SID S-1-5-32-544
for me ) 
* "Domain\account
operators" (SID S-1-5-32-548
for you ) 
Sources : http://support.microsoft.com/kb/243330/en 
The "Domain\administrators"
group is not present by default on the exchange organization AD arborescence. I 've checked my customer exchange installation, it seem's the same for "Domain\account operators" group.
To check, you can :
 * create a new
mailbox database, and modify the security on these database AD object to remove "Domain\account
operators" ACL (You may have to disable inheritance and copy existing security before)
 * Create a ressource mailbox on the new database and edit it using EAC. If your are like me, you
will also be able to edit mailbox permission in EAC for a mailbox on the new database.
If it works, you can validate with MS support that "Domain\Account Operators" group should not have acl on your exchange organisation AD object, and remove the ACL
after a good Active Directory backup
I hope it may help you,
Regards,
Florian