• BlackBerry® Enterprise Server
• Microsoft® Exchange 2000, 2003 

The SetSendAsPermission tool allows you to automatically assign the required Send As permission for previously existing Microsoft Windows® Active Directory® user objects.

To assign the Send As permission automatically, complete one of the procedures below. After completing the appropriate procedure, if you restart the Microsoft Exchange Information Store, stop the BlackBerry Router for 20 minutes, then restart the BlackBerry Router to complete the changes. This allows the Microsoft Exchange servers to clear the cached permissions for the BlackBerry Enterprise Server administration account.

Note: Microsoft recommends changing the default time of two hours (120 minutes) for clearing the cached permissions to 20 minutes.  The default time is controlled by a registry key; therefore, the amount of time needed for clearing the permissions cache depends on the value that has been set for that registry key. The cache will also be cleared if the Microsoft Exchange Information Store is restarted. For more information, search for article 327378 in the Microsoft Support Knowledge Base or search for the Mailbox Cache Age Limit registry entry in the Microsoft TechNet web site.

If the SetSendAsPermission tool displays an error during any of these procedures, see the Troubleshooting section below or see the Send As Permission FAQ for more information. For descriptions of the switches that may be used in the SetSendAsPermission.exe command line, see the Command line parameters section below.

Note: This procedure will not work for BlackBerry Enterprise Server software version 3.6.

Depending on the authentication type for the BlackBerry Configuration Database, to set the Send As permission for all BlackBerry device users on the BlackBerry Enterprise Server, use one of the command lines below.

Windows Authentication for the BlackBerry Configuration Database

From a command prompt, type the following line, then press ENTER:

SetSendAsPermission.exe -a <service_account_name> -db <database_name> -n <network_address> -o <output_file_name>

SQL Authentication for the BlackBerry Configuration Database

From a command prompt, type the following line, then press ENTER:

SetSendAsPermission.exe -a <service_account_name> -db <database_name> -n <network_address> -dbauth -dbuser <SQL_Authentication_user_name> -dbpass <SQL_Authentication_password> -o <output_file_name>

Depending on the authentication type for the BlackBerry Configuration Database, if you want to make changes to only one BlackBerry Enterprise Server instance, use one of the command lines below.

Windows Authentication for the BlackBerry Configuration Database

From a command prompt, type the following line, then press ENTER:

SetSendAsPermission.exe -a <service_account_name> -db <database_name> -n <network_address> -b <BlackBerry_Enterprise_Server_name> -o <output_file_name>

SQL Authentication for the BlackBerry Configuration Database

From a command prompt, type the following line, then press ENTER:

SetSendAsPermission.exe -a <service_account_name> -db <database_name> -n <network_address> -b <BlackBerry_Enterprise_Server_name> -dbauth -dbuser <SQL_Authentication_username> -dbpass <SQL_Authentication_password> -o <output_file_name>

To grant the Send As permission at the root or object levels, use one of the command lines below.

Important: If inheriting permissions is allowed, the Send As permission will be passed to all Active Directory objects below it. If new user objects are added and are set to inherit permissions, they will automatically have the Send As permission without having to run the tool again. If inheriting permissions is denied at any level below the base object used for the SetSendAsPermission tool, run the tool against all child objects for which inheriting permissions is denied.

At the root level

From a command prompt, type the following line, then press ENTER:

SetSendAsPermission.exe –a <service_account_name> -adroot

At the object level

From a command prompt, type the following line, then press ENTER:

SetSendAsPermission.exe –a <service_account_name> –adobject "ou=<organizational_unit>, dc=<domain>, dc=com"

To set the Send As permission for a list of user objects, from a command prompt, type the following line, then press ENTER:

SetSendAsPermission.exe -a <service_account_name> -i <input_file_name> -o <output_file_name>

Note: To use this procedure, it is necessary to create an input text file containing user object Simple Mail Transfer Protocol (SMTP) addresses that require the Send As permission. The text file contents must be line-separated values of SMTP addresses in the following format:

<user_name>@<domain>

To grant the Send As permission for one user object,  complete the following steps:

1. From a command prompt, type the following line, then press ENTER:

   SetSendAsPermission.exe -a <service_account_name> -u

2. Type the SMTP address of the BlackBerry device user in the <user_name>@<domain> format, then press ENTER.

To download the SetSendAsPermission tool, click here.

The procedures in this article can be completed from any computer provided you have the appropriate permissions for Active Directory.

Note: The SetSendAsPermission tool only sets the Send As permission on existing Active Directory user objects unless the adroot or adobject switches are used. To set the Send As permission for any new user objects created in Active Directory or added to the BlackBerry Enterprise Server, run the SetSendAsPermission tool again. To set the Send As permission on a domain level, see KB04707.

The SetSendAsPermission tool will not be able to modify Active Directory permissions to allow BlackBerry device users who are members of protected groups to send messages. If the SetSendAsPermission tool runs successfully, but the BlackBerry device user loses the Send As permission, make sure the BlackBerry device user is not a member of a protected group or is not a former member of a protected group.

Note: It is possible to modify Active Directory permissions to allow BlackBerry device users who are members of protected groups to send messages from their BlackBerry devices without creating secondary email accounts. Microsoft Support Knowledge Base article 817433 outlines a procedure for modifying the permissions associated with the AdminSDHolder Active Directory object that were modified by the recent Exchange update. However, this procedure is not recommended by Microsoft or by Research In Motion (RIM).

The command line for the SetSendAsPermission tool has the following format:

SetSendAsPermission.exe -a <service_account_name> -u <SMTP_address> -i <input_file_name> -adobject "ou=<organizational_unit>, dc=<domain>, dc=com" –adroot -db <database_name> -n <network_address> -b <server_name> -dbauth -dbuser <user_name> -dbpass <password> -o <output_file_name> -? -help

Note: Not all parameters are needed simultaneously in the command line for the SetSendAsPermission tool. Make sure to use only the parameters that are applicable for your environment.

The table below describes the parameters that may be used in the SetSendAsPermission tool command line:

The table below describes resolutions for errors that may occur when using the SetSendAsPermission tool:

Note: The SetSendAsPermission tool must be run from a command prompt. If a window appears to open and close after double clicking on the SetSendAs.exe file, open a command prompt, go to the folder containing the SetSendAs.exe file, and run the SetSendAsPermission tool with the appropriate switches.