When this issue occurs, the following event is logged in the Application log in Event Viewer:
- Start Active Directory Users and Computers.
- Click View, and then click to enable Advanced Features.
- Right-click the object where you want to change the Exchange Server permissions, and then click Properties.
Note You can change permissions against a user, an organizational unit, or a domain.
- On the Security tab, click Advanced.
- Click Add, type Exchange Servers, and then click OK.
- In the Apply to box, click Descendant msExchActiveSyncDevices objects.
- Under Permissions, click to enable Modify Permissions.
- Click OK three times.
By default, the Exchange Server group has rights to Create and Delete msExchActiveSyncDevices objects. However, the Exchange Server group does not have rights to change permissions on msExchActiveSyncDevices. Instead, the rights are inherited from the Owner Rights security principal. By default, the Owner Rights security principal has Full Control permissions.
If the permissions for the Owner Rights security principal are changed, the issue that is described in the "Symptoms" section can occur. For example, this issue can occur if the Owner Rights security principal has Read permissions on msExchActiveSyncDevices objects.
The Troubleshoot ActiveSync with Exchange Server guided walkthrough helps troubleshoot the following issues:
- Unable to create a profile on the device
- Unable to connect to the server
- Mail issues
- Calendaring issues
- Delays on device/CAS performance
Article ID: 2579075 - Last Review: Oct 1, 2015 - Revision: 1