Email not sending

[Jonathan]

Hi all, this is my time in a forum so please be patient.

For some unknown reason my Blackberry can recieve emails however cannot send, sent messages have a red cross next to them.

We have seven devices in our company and they all work fine.

Please help.

[arjey]

Are you in an administrator group?

[Jonathan]

I'm not sure, how do I check?

[GaryCutri]

Hi,

If you open an email that has failed to send on the device it will contain an error message at the top of the email. If you have a "Send As" issue the error displayed in the email will be "Desktop email program unable to submit message". If this is the case follow the steps below to correct the issue:


1. Stop the Blackberry Router service.

2. Open Active Directory and from the View menu select "Advanced Features". Then go to each user that will be added to the BES and open their properties, go to the security tab and add the user BESadmin and add the security permission "Send As".

3. Run the following script logged on as Administrator

dsacls "cn=adminsdholder,cn=system,dc=domainname,dc=c om " /G "DOMAINNAME\BESadmin:CA;Send As"

Example 1: dsacls "cn=adminsdholder,cn=system,dc=experts-exchange,dc=com " /G "EXPERTS_EXCHANGE\BESadmin:CA;Send As"

Example 2: dsacls "cn=adminsdholder,cn=system,dc=blackberryforum s,dc =com,dc=au " /G "BLACKBERRYFORUMS\BESadmin:CA;Send As"

Example 3: dsacls "cn=adminsdholder,cn=system,dc=mobilenetwork,d c=lo cal" /G "MOBILENETWORK\BESadmin:CA;Send As"

NOTE: dsacls can be found in the Windows Server 2003 SP1 Support Tools pack: Download details: Windows Server 2003 Service Pack 1 32-bit Support Tools

4. Wait 20 minutes and then restart the BlackBerry Router service.

5. Restart the BES server.


Additional Information

To globally apply Send As permissions to all user objects follow these steps:
1. Open Active Directory.
2. Select the "View" menu and ensure "Advanced Features" is checked.
3. Right mouse click on your domain name and select Properties
4. Select the Security tab
5. Press the Advanced button at the bottom on the security tab
6. Select "Add" and enter your Blackberry Service Account name (e.g. BESadmin) and select OK
7. When the permissions screen appears change "Apply onto:" to "User Objects"
8. In the permissions box scroll down and check the Allow box beside "Send As" and press OK
9. Press Apply and OK to exit

[Jonathan]

Thanks Gary, I'll give a go today.

Jonathan - Aloha Pools

[peaky69]

Hi Gary,
just trying to understand this a little more as I have the same issue.
What is the purpose of step 3?
And why do you need to stop the router service if you are rebooting the server?

Cheers
Jason Peak

[GaryCutri]

Originally Posted by peaky69

Hi Gary,
just trying to understand this a little more as I have the same issue.
What is the purpose of step 3?
And why do you need to stop the router service if you are rebooting the server?

Cheers
Jason Peak

Re: AdminSDHolder

The AdminSDHolder container is a special container object inside of the System container in Active Directory. The basic function of AdminSDHolder is exactly what it says it does - it holds the Access Control List (ACL) for every admin account. This container is just a template. Once every hour, the DC that holds the PDC Emulator role goes through every account that is in built-in Administrators group and checks the ACL for each user object. It compares this ACL to that of the AdminSDHolder container and if any Access Control Entry (ACE) is different, it rips out the old ACL and copies the ACL from the AdminSDHolder over to it.

The purpose of AdminSDHolder is to prevent against a specific attack scenario. Active Directory is extremely flexible down to it' s most granular level. Because of this, a user can have write access to anything inside of a specific OU. If an admin account is moved to an OU that a non-admin has rights to, he could give himself privileged access to the admin account. AdminSDHolder tries to prevent this from happening by continuously refreshing the ACL on an admin account.

Re: Stopping the BlackBerry Router Service

Stopping the BlackBerry Router allows the Exchange Servers to clear the cached permissions for the BlackBerry Enterprise Server administration account.

[peaky69]

Thanks Gary,
all very clear now.

Cheers
Jason