Certain users cannot send email messages to a mail-enabled public folder in an Exchange Server 2010 environment

In a Microsoft Exchange Server 2010 environment, users cannot send email messages to a mail-enabled public folder. Additionally, the users receive non-delivery reports (NDRs) that contain a 5.2.0 status code. The NDRs resemble the following:
This issue occurs if the following conditions are true:

• You have more than one domain in your Active Directory forest.
• You are running Windows Server 2008 or Windows Server 2008 R2 on the domain controllers in your domains.
• The users who cannot send email messages to mail-enabled public folders are members of one or more of the following built-in security groups:
  • BUILTIN\Event Log Readers
  • BUILTIN\Cryptographic Operators
  • BUILTIN\IIS_IUSERS
  • BUILTIN\Certificate Service DCOM Access

This issue occurs because new domain local security groups are defined in Windows Server 2008 and in Windows Server 2008 R2. In a multiple-domain environment, these groups share the same well-known security identifier (SID). However, these groups are not included in the well-known SIDs list that is maintained by Exchange Server 2010 that is excluded from the check for ambiguity. Therefore, members of these groups that send email messages to a mail-enabled public folder are considered as ambiguous alias.

To resolve this issue, install the following update rollup:

To work around this issue, remove the users from these security groups.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

For more information about a similar issue, click the following article number to view the article in the Microsoft Knowledge Base: For more information about well-known SIDs in Windows, click the following article number to view the article in the Microsoft Knowledge Base: For more information about how to mail-enable a public folder, visit the following Microsoft website:
For more information about well-known security identifiers and accounts, visit the following Microsoft website: