Exchange 2010 and ActiveSync issues with mobile devices

[CiscoInside]

I have been having this problem for a while but finally sat down to tear it apart. I have been up half the night trying to figure this out.

Basically off by androids, either using the stock app or touchdown, my main account will not work.

I have been doing troubleshooting and used Exchange's test site and recieved this on that account:



Additional Details
Exchange ActiveSync returned an HTTP 500 response.

I checked inheritance and it is checked. This account used to be a domain admin account, plus other stuff. I even tried to clear the admincount. Still no luck.

Yet, other accounts work just fine. I had to setup another account just to forward e-mail from this account to the other so I can at least have my e-mail on the devices. But I would really like to get this account to work.

It has been attached to a device before, but ever since then it will not work. No devices are shown either, nothing is ADSI.

Any thoughts on this?

Thanks

 

[Eickst]

Does your account work on another person's phone?

The reason I ask is that I have run in to some occurrences of having to wipe the device in order to get specific exchange accounts working again. Doesn't happen all of the time but happens enough to be annoying.

Also, this is a no-brainer....but I have to double check.....is mobile access turned on in the exchange console for the mailbox?

 

[Keiichi]

http://technet.microsoft.com/en-us/library/dd439375(EXCHG.80).aspx

If the user is a member of certain protected groups such as Domain Administrators, it is normal for this box to be unchecked. If you are experiencing a problem with members of these protected groups you should check the permissions on the AdminSDHolder object.

 

[Nate7311]

http://technet.microsoft.com/en-us/library/dd439375(EXCHG.80).aspx

+1 for this

 

[Eickst]

http://technet.microsoft.com/en-us/library/dd439375(EXCHG.80).aspx

If you read the OP you will see that he already checked this.

 

[Nate7311]

OP, are you absolutely sure that it is not an admin account anymore. AD runs a process in the background to flip the inheritence box on admin accounts every hour.

Have you tried this account on any other device? i.e. an iPhone or Windows Mobile?

 

[CiscoInside]

Hey guys,

@Eickst:
Yup I tried to not only attach my phone but also two other tablets I have. No success.

And its okay that you ask, yes the account is enabled for mobile access.

@Nate7311
Well I cleared domain admin privileges from the account, including the left over security settings. The only issue I am seeing under security permissions is a lot of unknown SIDs... which I have a feeling drilled down something is there is causing this issue.

I looked at the AdminSDHolder container - but that is where I stopped and came to the forums after researching, I did not want to messing with settings that could potentially cause more issues in the forest.

I have not tried to sync with other devices non-like devices as listed.

Thanks all.

 

[Keiichi]

If you read the OP you will see that he already checked this.

If you read the link, you will see a link that explains "AdminSDHolder, Protected Groups and SDPROP." In that page you will see a link to a MS provided script that will fix the orphaned object's inheritence properties.