Unable to access the Default Global Address Lists container in Exchange System Manager

When you try to expand the All Global Address Lists container by using the Microsoft Exchange System Manager tool in Microsoft Exchange 2000 Server or in Microsoft Exchange Server 2003, you may experience one or more of the following symptoms:

• You receive the following error message:
  You will not be able to add, remove or rename Global Address Lists because you do not have the required permissions on all Global Address Lists
• The Default Global Address List container no longer appears under All Global Address Lists.
• The Default Global Address List container appears under All Global Address Lists. However, when you right-click Default Global Address List and then click Properties, you receive the following error message:
  The specified directory service attribute or value does not exist.
• Microsoft Outlook users can still access the Global Address List.

This issue may occur if the Authenticated Users group does not have Full Control permissions to the Default Global Address List. Typically, this issue occurs if the Authenticated Users group is assigned Deny permissions to the Full Control check box on the Security tab of the Default Global Address List Properties dialog box.

To resolve this issue, use one of the following methods as applicable to your situation.

Method 1: You can access the Default Global Address List Properties dialog box

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

To resolve this issue, follow these steps:

1. Start Exchange System Manager.
2. Expand the Recipients container, and then expand All Global Address Lists.
3. Right-click Default Global Address List, and then click Properties.
4. Click the Security tab, click Authenticated Users, and then click to select the Allow check box next to Full Control.

Note An "Unable to display security information" message may appear when you click the Security tab on the Default Global Address List object. If this message appears, open the All Global Address Lists object's properties before you open the Default Global Address List object's properties.

Method 2: You cannot access the Default Global Address List Properties dialog box

In this scenario, the Default Global Address List container may not appear in Exchange System Manager, or you receive an error message when you right-click Default Global Address List, and then click Properties. To resolve this issue, use the DSACLS.exe command to view and to modify the permissions on the Default Global Address List container. To do this, follow these steps:

1. Type the following DSACLS.exe command, and then press ENTER to view the permissions that are assigned to the Default Global Address List container in the Active Directory directory service:
   DSACLS "CN=Default Global Address List,CN=All Global Address Lists,CN=Address Lists Container,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Example,DC=com"
   Replace Example and com with your domain and domain suffix names. Additionally, if your organization does not have the default name of First Organization, modify this command accordingly.
   
   Note This command is one line.
2. View the results that are returned by this command to see if any Deny permissions are assigned to the NT AUTHORITY\Authenticated Users group.
3. Type the following DSACLS.exe command, and then press ENTER to reset the permissions on the Default Global Address Lists container for the Authenticated Users group:
   DSACLS "CN=Default Global Address List,CN=All Global Address Lists,CN=Address Lists Container,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Example,DC=com" /N /G "Authenticated Users":SDRCWDWOWPRPCALO
4. Log off the computer, and then log on again.
5. Start Exchange System Manager.

MORE INFORMATION