Home / server / Questions / 995940
Accepted
supernova666666
Asked: 2019-12-18 12:44:19 +0800 CST

Error 4003 (INSUFF_ACCESS_RIGHTS) after CU23 update

  • 772

I've just upgraded our exchange 2013 to CU23 from CU15. I prepared AD, updated the framework and c++ as instructed then kicked off the update for the CU. All went well, did some testing after and everything is working perfectly, except if try to add send as permissions to a mailbox I the attached error. So far I have...

  1. added the trusted exchange subsystem to the servers as a member of.
  2. run Test-ExchangeServerHealth.ps1 and everything comes back as OK.
  3. run Get-CASHealthCheck.ps1 and everything is OK.
  4. Protect/Unprotect Objects from Deletion in AD.
  5. The account is a member of the enterprise admins
  6. advanced features enabled in AD.

I've had a few suggestions like check AdminSDHolder and Check inheritance is enabled for Exchange objects in ADSI but I'm unsure were.

Screenshot of error

exchange-2013

1 Answers

  1. Best Answer

    According to the snapshot you attached, the issue could be caused because your admin account doesn’t have the rights "Organization Management" and "Recipient Management" to grant the right "Send As" to your mailbox(From the official document Recipient Permissions, the feature "Send as" needs the previous permissions), therefore, you could check whether your admin account has the permissions by running the commands Get-RoleGroupMember -Identity "Organization Management" and Get-RoleGroupMember -Identity "Recipient Management" :

    enter image description here

    If the account doesn't have the permissions, you could run the commands Add-RoleGroupMember -Identity "Organization Management" -Member Administrator and Add-RoleGroupMember -Identity "Recipient Management" -Member Administrator to add them to your account, then grant "Send As" to your mailbox again to check whether the error still exists: enter image description here

    At the same time, I found a thread unable to give Send As Permissions to users which had the similar issue, in it, DamnComputers gave the solution to fix the issue: Add "Exchange Trusted Subsystem" permissions to the server(According to your description, you could bypass it), then enable Inheritance on the users account: enter image description here enter image description here

    Finally, you could try granting "Send As" permission to your mailbox to check the result. Hope everything goes well with you!

    • 0