Activesync with Exchange 2013 does not work, ADMINSHOLDER Flag (an old bad friend)


Activesync with Exchange 2013 does not work, ADMINSHOLDER Flag (an old bad friend)

ERROR YOU SEE: Access+is+denied.%0d%0aActive+directory+response%3a+00000005%3a+SecErr%3a+DSID-03152612%2c+problem+4003+(INSUFF%5FACCESS%5FRIGHTS)%2c+data+0%0a_

We just had a user with Activesync with a user migrated from 2007 to 2013. The user was fresh made on 2007 and migrated forth and back a few times.

Did show all info he can get and one thing triggered alerts with us. 4003+(INSUFF%5FACCESS%5FRIGHTS)

This was back 2003 > 2007 Migrations but comes again and again. Strange thing is that the test user account is only in a few groups and we never made him LOCALADMIN. But one group still seems to trigger the ADMINSHOLDER flags which should protect special accounts like "IISUSER" or Administrator.

Then we did see why. If the user is member of the group "PRINT OPERATORS" this will be the case.

So GPO, Activesync and many other things will not work. This has been mentioned here:

Good explanation from John Pollicelli


FIX the Inheritance of the account and all will work fine. See our other two posts on how to do that.


The Red part below (RED-X)

Activesync Log from



blUh4pH%2b19L4b%2fRk6uRZ%2bwFDxipa3umOc5NWKd8j3WZE%2f1rztOVQr3A7yqhQbWsCubcT0xJwV4JpO6fVK4ruS7rFkPgTuafoTzZOwv5kvn2wZAkGBr1hGm6NGz8%2fo4vFol0hWLVSJE3%2fX78fmSReawv4CBVixAAzyTR%2bm65WPSw86qwPxjfVseQiOrJ9qzUR8%2bPztEYmDjqvAfiVSNT6ouXwZf8%2fIpLnSalOyvp6n73yvkLu9rfgOsaQxOzJAX1TueDMkuiGV1EsG6HEYy3lD0Mdxo40pR EXCHANGE2013BUTSCH


Cache-Control: private

Content-Type: text/html; charset=utf-8

Set-Cookie: ClientId=IARSMT0ZIEEVVIXDSSW; expires=Thu, 18-May-2017 08:05:50 GMT; path=/; HttpOnly,X-BackEndCookie=S-1-5-21-4456168801-1912567065-1745900225-5325=u56Lnp2ejJqBysnJysyZzJzSz5maztLLnZvO0sabnszSncrHms3JzZ7Jm8zIgYHNz87J0s/J0s7Iq8/Hxc/Jxc7P; expires=Fri, 17-Jun-2016 08:06:10 GMT; path=/Microsoft-Server-ActiveSync; secure; HttpOnly

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET



Get a list of all user who have such a behaviour:

Windows Server 2008R2, blaue Powershell aufmachen

Import-Module ActiveDirectory

Get-ADUser -LDAPFilter "(objectcategory=person)(samaccountname=*)(admincount=1)"

Es gibt eine einfache Möglichkeit, um festzustellen, welche Benutzer und Gruppen in Ihrer Domäne AdminSDHolder geschützt.Sie können Abfragen das Attribut AdminCount, um festzustellen, ob ein Objekt durch das AdminSDHolder-Objekt geschützt ist.Die folgenden Beispiele verwenden das ADFind.exe-Tool, das von Joeware gedownloadet werden kann.NET.

  • Suchen alle Objekte in einer Domäne, die durch AdminSDHolder geschützt sind, geben Sie:

    Adfind.exe -b DC=domain,DC=com -f "adminCount=1" DN

  • Suchen alle Benutzerobjekte in einer Domäne, die durch AdminSDHolder geschützt sind, geben Sie:

    Adfind.exe -b DC=domain,DC=com -f "(&(objectcategory=person)(objectclass=user)(admincount=1))" DN

  • Suchen alle Gruppen in einer Domäne, die durch AdminSDHolder geschützt sind, geben Sie:

    Adfind.exe -b DC=domain,DC=com -f "(&(objectclass=group)(admincount=1))" DN

    Hinweis: Ersetzen Sie in den vorherigen Beispielen, DC = Domain, DC = com mit dem definierten Namen Ihrer Domäne.


Exchange 2007 > 2013 Transition/Migration, POPUP on Outlook 2010 or Public Folder can’t be open from 2007


Exchange 2007 > 2013 Transition/Migration, POPUP on Outlook 2010 or Public Folder can't be open from 2007


Error1: When you click a Public Folder which lies on 2007 in Outlook.exe

"Cannot expand the folder. Microsoft Exchange is not available. Either there are network problems or the Exchange server is down for maintenance."

Event 401 is logged in IIS log file on 2007 side

Error2: Even if you have selected the option not to DOWNLOAD and other resources or public folder you Recieve constant authentication POPUPS "Windows Security" with username password. Outlook.exe shows password need at some point. Even if you chose remember my Credentials.

Quick Reason:

You have to change the Authentication for "Outlook Anywhere" on old 2007 side to NTLM.

A general reason is that Exchange 2013 works OVER "Outlook Anywhere" all the time. To make it correct you could enable "Outlook anywhere" backwards/afterwards on the old Exchange 2007. Warning: However this function will run from 10-60 Minutes depending on your Exchange 2007. Read and search more if it not enabled on the old Exchange 2007 and you want to do that while the old 2007 is productive. Most blogs don't mention that and most of them do 2007>2010>2013 and some 2007>2013 direct. However they assume you have "Outlook anywhere" on 2007 already on before you begin the swing Transition (Migration).


Exchange 2007 and 2013 Coexistence:

  • Exchange 2013 runs with Outlook Anywhere
  • If you have Outlook Anywhere on 2007 change the a) Authentication b) Internal and External URL to something else than on the 2013
  • Both Authentication settings for the "Outlook Anywhere" Option have to be the same. As example "NTLM" only.


  • You have an Exchange 2007 existing running and a fresh 2013 setup
  • Exchange 2013 is ready and ALL Virtual directories are changed in Powershell
  • The SAN/UC Certificate with a) The old exchange name sample, and is ordered imported and activated
  • Just ONE User was moved from 2007 > 2013, rest of them still on 2007 side
  • Autodiscover is setup correct in DNS also the old name (important can be whatever some use the term legacy [It does not have to be!]) and also a new names for the new exchange 2010.



Check Logfiles on Exchange 2007 under:


Search for string "/rpc/rpcproxy.dll"

This is the Health check the Exchange 2013 does:

RPC_IN_DATA /rpc/rpcproxy.dll - 443 - HttpProxy.ClientAccessServer2010Ping 401 2 5 0

Controll the Settings on the Exchange 2007.

get-OutlookAnywhere -Server "servername2007" | fl identity, IISAuthenticationMethods

Set-OutlookAnywhere -Identity " servername2007\Rpc (Default Web Site)" -IISAuthenticationMethods Ntlm

Or in GUI on the Exchange 2007


If that does not work > Also recycle the IIS folders and Reboot the 2007.

Open IIS Konsole

Go to "Application Pools"

  • On right side "Select" Recycle
  • From "Defaultpool" downwards to "MSexchagesyncappool" press Recycle RIGHT side in IIS console



IIS Logfile after the change should be with a 500 value.

2016-04-26 14:20:35 RPC_IN_DATA /rpc/rpcproxy.dll - 443 - HttpProxy.ClientAccessServer2010Ping 500 0 64 45021


Change on client side

IF account still under 2007 and using ONLY Outlook Anywhere you then have to change something in outlook.exe on each client THAT is laptop or workgroup and not domain joined. If Autodiscover and the EXPR-Record are correct this should work by itself.




Exchange Netvault/Netapp: Failed backup leftover Snapshots

  • Dell Netvault Backup Agent
  • SME for Exchange 6.1
  • Netapp Snapdrive

You have LEFTOVER SYMBOL Link on all drives or OLD NVBUShadowcopy Directory on LUNS you handle with Netvault Backup.

Solution 1a)

Stuck left over drives from failed backup in Netapp Plugin:

Solution 1b)

In cmd.exe


List shadows all

Search for corresponding leftover folder like "E:\NvbuShadowCopy_2052"

Get the SHADOW COPY ID of the stuck one

* Shadow copy ID = {e08f4105-1d42-4d53-afdd-838247c03529}

<No Alias>

- Shadow copy set: {e9f98574-49b1-4df1-bcb9-67d5c485764a}

<No Alias>

- Original count of shadow copies = 4

- Original volume name: \\?\Volume{b304d909-0cc1-11e4-b5ec-00505

68121c3}\ [E:\]

- Creation time: 30.11.2015 12:34:36

- Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeS


- Originating machine:

- Service machine:

- Exposed locally as: E:\NvbuShadowCopy_2052\

- Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}

- Attributes: No_Auto_Release Persistent Differential


Delete it:

Delete shadows id {e08f4105-1d42-4d53-afdd-838247c03529}

Exchange 2007/2010/2013 with SPLIT DNS and ONE single Certificate


You have to renew an Exchanger SAN/UC-Certificate and you can't do this anymore after 2015 because it contains a NON EXTERNAL First Level Extension like ".LOCAL".

  1. Rename the Full Windows Domain in a 1 year project and have fun
  2. Integrate a SPLIT DNS as below, Bend all Exchange URL to the same FQDN

Main Technet Link:


I personally don't like this solution since you may in most complex case end up in trouble with some special cases like "RPC-over-HTTP" (Outlook anywhere) and some Autodiscover functions.

On the other side don't like Wildcard Certs for this because if you have that the other departments want to use the same Certificate and at the end everyone uses it. Worst it lays around on laptops and Servers then if you don't Controll it strict.

Currently still March 2015 this is the only solution quick and fast if you customer has a First Level Windows Domain with .LOCAL. Most it's urgent because Cert has expired.


Just to mention that there is another way but this needs planning and time

Enterprise way:

Internal Domain: Cover these with your own internal Certificate Authority (Ask if you have one, make a project separate for that because it's sensitive and complex) .

External Domain: Use a Cert Provider SAN/UC-Certificate as we had before for all external FQDN

This enterprise mix however leads us to splitting the CAS/OWA Directories on separates SITES within the IIS (Because of only 1 Cert per IIS-Site) or we make single separate CAS Server for internal and external (Which Microsoft does not want us).

On the other side if we have Load Balancers for the CAS mostly those separate CAS are not in the Load Balancer HA team.



Timeline for SAN/UC Certs with Local ending or non-external First level (www.technet.local)

Such a SAN Certificate which includes LOCAL is not valid anymore after some date. And you can't reorder it. (Screenshot)

Powershell: Get-exchangecertificate | fl

In Green BOX there are the First Level Domains .LOCAL Domains that you can't COVERY anymore in ONE Cert in 2015.

INTERNAL DNS NAME:    customer.local (The Active Directory Domain)

EXTERNAL DNS NAME: (Your Webserver, FTP, MX-E-Mail Domain from external)

Third level DOMAIN:

Why can't I renew?


Because we can't make a UC/SAN-certificate after November 2015 anymore we have to convert the DNS into SPLIT DNS setup. That means we copy the Extern DNS into Internal DNS. Even if you CAN renew it WILL only run until November 2015 with some Cert Issuer.

Make the SPLIT DNS


See links at end for more help on the SPLIT DNS.

SPLIT DNS Copy External ZONE File to internal Active Directory DNS

  1. Get the info from External ZONE file from the Provider ISP like Ask them you need an extract (copy) of the ZONE file for your external Domain.
  2. Do a new Active Directory integrated Forward ZONE File with same name "" internal
  3. Make the A-Records internal so INTERNAL users can reach www and ftp also from internal (These are shown on the right side). Make "FTP", "WWW" point to same IP as the external. (If you don't do that your INTERNAL users will not be able to reach the External Website or Cloud Service you use with your ISP)
  4. The ASYNC in OUR sample POINTS to the IP of the Exchange 2010 CAS
  5. On the External DNS the ASYNC points to our Firewall and then to the Exchange 2010 CAS

This is how this may look.

Get the NEW SINGLE FQDN Certificate



We need to change all FQDN that Exchange uses for different Service now to the SAME FQDN the SINGLE Domain Cert runs on.

FQDN Single Domain Certificate was ordered for:

OLD Entry in Exchange somewhere:





Analyze the values you need to change by Powershell





get-ClientAccessServer | fl Identity,AutodiscoverServiceInternalUri


Identity : CAS1

AutoDiscoverServiceInternalUri : https://async.customer.local/Autodiscover/Autodiscover.xml


Set-ClientAccessServer -Identity CAS1 -AutodiscoverServiceInternalUri



get-WebServicesVirtualDirectory | fl Identity, InternalUrl , ExternalUrl


InternalUrl : https://cas1.customer.local/EWS/Exchange.asmx

ExternalUrl : https://mobile.customer.local/ews/exchange.asmx


Set-WebServicesVirtualDirectory -Identity "CAS1\EWS (Default Web Site)" -InternalUrl

Set-WebServicesVirtualDirectory -Identity "CAS1\EWS (Default Web Site)" -ExternalUrl



get-OABVirtualDirectory | fl Identity, InternalUrl, ExternalUrl


InternalUrl : http://cas1.customer.local/OAB

ExternalUrl : https://mobile.customer.local/OAB


Set-OABVirtualDirectory -Identity "CAS1\OAB (Default Web Site)" -InternalUrl

Set-OABVirtualDirectory -Identity "CAS1\OAB (Default Web Site)" -ExternalUrl


If you don't have UTM Service (Unified Messaging leave that)

Change Values in Exchange 2010 GUI


Change all other things in Exchange 2010 GUI on the tabs below to corresponding values.

Some you may have changed above already. Check them twice.




  • Do this for all possible location Web app/Activesync/Offline etc.
  • DO this for INTERNAL and EXTERNAL (Set the SAME value)
  • Do not change AYNTHING behind the FQDN name as example
  • AT the end Restart Exchange or do a CMD.exe then IISRESET






Activate the Certificate in Exchange 2010 GUI or Powershell and RESET IIS


Activate the new SINGLE Certificate in Exchange for IIS.


Get-exchangecertificate | fl

Get the GUID sample: 020564B683E9D540DA0DF20A

enable-exchangecertificate -identity 020562B683E5D540DA0DF20A -Services "IIS"


AT the end Restart Exchange:





SPLIT DNS, Windows Server 2008: The Definitive Guide


Exchange PRO

Main Technet Link


Outlook/Exchange: Malformed Kalender Einträge selber suchen

Malformed Kalender Einträge im Outlook.exe selber suchen.

Diese ist primär bei Kalendern welche in Public Folder sind. Kann aber auch bei regulären Einträgen vorkommen.

Kalender / Liste wählen damit man alle Termine von A-Z sieht:


Doppelklick auf den TERMIN falls man diesen JETZT sieht


Zwingend und immer gut > Ein Enddatum setzen

z.B. Fiktiv 2025

Kategorie prüfen ob keine spezielle Kategorie welche der User selber erstellt hat. Nur die im Outlook

vorhandenen am besten nehmen. (keine selber machen)



Links von uns: