• BlackBerry® Enterprise Server software version 3.6 and later
• Microsoft® Exchange

When applying the hotfix described in Microsoft Support Knowledge Base article 895949 to Microsoft Exchange Server 2003 Service Pack 1 or Service Pack 2, or applying the hotfix to Microsoft Exchange Server 2000 Service Pack 3, the store.exe utility revokes the Send As permission for all Microsoft Exchange administration accounts that have been granted the Administer Information Store permission at the mailbox store level. This means that the BlackBerry Enterprise Server cannot send messages for BlackBerry device users.

To confirm that your BlackBerry device users can send messages, complete the following tasks:

1. Make sure that the BlackBerry Enterprise Server is using a unique administration account.
2. Make sure that the BlackBerry Enterprise Server administration account has the correct permissions.
3. For Microsoft Exchange 2003, complete the procedures outlined in the Microsoft Support Knowledge Base article 895949.
4. Clear the permissions cache on the BlackBerry Enterprise Server.

Note: This information is explained in KB04707.

Task 1

Make sure that a unique administration account is being used to complete administrative tasks on the BlackBerry Enterprise Server.

Note: By default, this account is called BESAdmin.

If you do not have a unique administration account, create one. Depending on the BlackBerry Enterprise Server software version, for instructions, see one of the following knowledge base articles:

• If you are running BlackBerry Enterprise Server software version 4.0 or later, see KB04293.
• If you are running BlackBerry Enterprise Server software version 3.6, see KB04334

Task 2

Make sure that the BlackBerry Enterprise Server administration account has the correct permissions. Depending on the Microsoft Exchange Server version, complete the following steps:

Microsoft Exchange Server 2000 and 2003

1. Within the domain, make sure the administration account is a member of the Domain Users group only.
2. Note: On a domain controller, the administration account should be a member of the Builtin Administrators group.
3. On the BlackBerry Enterprise Server, make sure the account is a member of the Local Administrators group, then assign the Log on Locally and Log on as a service permissions.
4. To grant Exchange View Only Administrator permissions at the Administrative Group level in Exchange System Manager, right-click the first Microsoft Exchange administrative group name, then click Delegate Control. The BlackBerry Enterprise Server administration account should be listed with the role of Exchange View-Only Administrator.
5. To grant the Send As, Receive As, and Administer Information Store permissions at the Server level for each Microsoft Exchange Server, complete these steps:
   • In Exchange System Manager, right-click the first Microsoft Exchange administrative group name, then expand the Servers group.
   • Right-click a Microsoft Exchange Server, then select Properties > Security.
   • Select the BlackBerry Enterprise Server administration account from the top pane, then in the bottom pane, make sure that the three permissions (Send As, Receive As, and Administer Information Store) are set to Allow.
   • Repeat these steps for each Microsoft Exchange Server.
6. To grant the Send As, Receive As, and Administer Information Store permissions on the Mailbox Store, complete these steps:
   • In the Exchange System Manager, right-click the first Microsoft Exchange administrative group name, then expand the Servers group.
   • Expand the First Mailbox Store group.
   • Right-click each Mailbox Store, then click Properties > Security.
   • Select the BlackBerry Enterprise Server service account from the top pane, then in the bottom pane, make sure that the three permissions (Send As, Receive As, and Administer Information Store) are set to Allow.
   • Complete these steps for each Mailbox Store on each Microsoft Exchange Server.

Microsoft Exchange 5.5

1. Within the domain, make sure the administration account is a member of the Domain Users group.
2. On the BlackBerry Enterprise Server, make sure the account is a member of the Local Administrators group, then assign the Log on Locally and Log on as a service permissions.
3. In the Exchange Administrator, grant the Service Account Admin permission for the new administration account in both the Site and Configuration containers. For more information on how to set permissions, see the documentation for Microsoft Exchange 5.5.

Task 3

For Microsoft Exchange 2003 environments only, complete the procedures outlined in Microsoft Support Knowledge Base article 895949. Before applying the hotfix described in article 895949, refer to Microsoft Support Knowledge Base article 912918 for instructions on fulfilling permission requirements.

Note: You do not need to restart any BlackBerry services.

For additional information on setting permissions for the BlackBerry Service Account in a typical Microsoft Exchange environment, see KB02276.

Note: These instructions are based on a default environment and may not apply to all configurations.

Task 4

Clear the permissions cache on the BlackBerry Enterprise Server. This allows the permissions changes to take effect. Depending on the BlackBerry Enterprise Server software version, to clear the permissions cache, do one of the following:

• If you are running BlackBerry Enterprise Server software version 4.0 or later, stop the BlackBerry Router. After 20 minutes, restart the BlackBerry Router.
• If you are running BlackBerry Enterprise Server software version 3.6, stop the BlackBerry Enterprise Server <server_name> services for each BlackBerry Enterprise Server instance. After 20 minutes, restart the services.

  Important: Restarting certain BlackBerry Enterprise Server services will delay message delivery to BlackBerry devices. For more information, see KB04789.

If you have completed the steps in this article and are still experiencing the problem for some or all BlackBerry device users, contact Microsoft support to assist with troubleshooting Active Directory® and Microsoft Exchange permissions. For more information, go to the Microsoft Help and Support web site.