<div>

One of the toughest things in recent Microsoft history that seems to be plaguing tons of IT departments is Exchange 2010 migrations.

Though Microsoft has a ton of documentation on the subject, the trouble is trying to piece all the parts together into a somewhat reasonable explanation of how the system actually works, especially when in reference to moving users mailboxes from Exchange 2003 to Exchange 2010.

After now doing a few of these migrations, I ran into a new problem when dealing with ActiveSync.

There is a hotfix provided by Microsoft for users that are connecting to a 2010 CAS for redirection back to a 2003 server.  This hotfix is located <a title="Exchange ActiveSync Hotfix" href="http://support.microsoft.com/kb/937031" target="_blank">here</a> that allows the 2010 CAS servers to be able to access the 2003 Mailboxes via Windows Integrated Authentication.

However, I did recently run into a different issue that is well documented, but not at the level that where I needed to make the change.

<!--more--><img src="http://stevesgeeklab.wordpress.com/wp-includes/js/tinymce/plugins/wordpress/img/trans.gif" alt="" />

After migrating one of the IT users mailbox from 2003 to 2010, I found that I could not get that user to access ActiveSync from their mobile device.  I tested it out at <a href="https://www.testexchangeconnectivity.com/">https://www.testexchangeconnectivity.com/</a> and kept getting a HTTP 500 response failure.

Everywhere I looked, I found the same answer.  For users in a protected OU (like Domain Admins), browse to the user in Active Directory Users and Computers and set their security settings to "Include inheritable permissions from this object's parent" (see TechNet article <a title="TechNet Article" href="http://technet.microsoft.com/en-us/library/dd439375(EXCHG.80).aspx" target="_blank">here</a>)

After making the changes to the user listed in the article above, I would still not be able to access ActiveSync.  But the fix was a little deeper.

I noticed that after replication had taken place between the Domain Controllers, the user in question's security setting for "Include inheritable permissions from this object's parent" was unchecked again!!  What??

Come to find out that to fix this you need to go into ASDI Edit.

- Navigate to the domain partition

- Go to "System"

- Right click on AdminSdHolder and go to security tab

- Click Advanced

- Select the checkbox that says "Include Permissions"

That fixed it.  Something to keep in mind when testing with users that are in those protected OUs.

</div>