Assume that you are the owner of a public folder mailbox or have sufficient access permissions to create a public folder in a Microsoft Exchange Server 2013 or Microsoft Exchange Server 2016 environment. The mailbox uses the secondary hierarchy as the default public folder mailbox. In this situation, when you try to create a public folder by using Microsoft Outlook, you receive the following error message:
Cannot create the folder. You do not have sufficient permission to perform this operation on this object. See the folder contact or your system administrator.
Note If the default public folder mailbox is changed to a public folder mailbox that contains the primary hierarchy, you can create public folders by using Outlook.
This issue occurs because the LmCompatibilityLevel registry entry on the Exchange Server Mailbox Server role is configured to a value that is less than 2.
Important Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restoration in case problems occur.
To work around this issue, follow these steps on the Exchange Server Mailbox Server role that is hosting the secondary hierarchy public folder mailbox:
Change the value of the LmCompatibilityLevel registry entry to 2 or greater.
Note The entry is located under the following registry path:
When this issue occurs, other than the error message, you can also find the following information that may help troubleshoot this issue.
The following message is logged under the "RPC Client Access" log in Event Viewer:
Client=MSExchangeRPC,,,,-2147024891 (rop::AccessDenied),00:00:00.0310000,,"RopHandler: CreateFolder: [AccessDeniedException] Cannot open mailbox /o=Contoso/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=9f049c7972fb4d8ebe9f5ece73e136fe-PFHierarchy. -> [MapiExceptionNoAccess] Unable to make connection to the server. (hr=0x80070005, ec=-2147024891) [diag::AAAGAgAA/wAAAAAAAAAAA/gBAACYMvAvAQAAACwQAsAAAAAA6PIAEHA5FpCYP/AvBQAAAG4vYQBwORaQmCHwH/Q1AACYMfAvcDkWkAk00AEsEALAmCnwHw0AAACYOfAfLBACwJgl8B95BQAAmDXwHwAAAACYLfAfAAAAAOjyABBwORaQmD/wLwUAAABuL2EAcDkWkJgh8B/0NQAAmDHwL3A5FpAJNNABkQEAAJgp8B8NAAAAmDnwH5EBAACYJfAfiQUAAJg18B8AAAAAmC3wHwEAAACYIvA/AAAAAFVuYXV0aG9yaXplZAAAAADo8gAQcDkWkJg/8C8FAAAAbi9hAHA5FpCYIfAf9DUAAJgx8C9wORaQCTTQAQAAAACYKfAfDQAAAJg58B8AAAAAmCXwH+ELAACYNfAfAAAAAJgt8B8AAAAA6PIAEHA5FpCYP/AvBQAAAG4vYQBwORaQmCHwH/Q1AACYMfAvcDkWkAk00AHhCwAAmCnwHw0AAACYOfAfAAAAAJgl8B/hCwAAmDXwHwAAAACYLfAfAAAAAHHoQBAFAAeAcMVAIQAPFIQZAPAvBQAAAHDLQBAFAAeA0McAEPQ1AADxzEAQBQAHgKHqABAFAAAA8YNAEAUAB4Cd6QAQBQAAAAfNQBAFAAeAQk0AEAAAAABCbUAQBQAHgEJFABAAAAAAQmVAEAUAB4A=] at M.E.D.S.RPCPrimaryHierarchyProvider.GetHierarchyStore() at M.E.D.S.RPCPrimaryHierarchyProvider.CreateFolder(String folderName, String folderDescription, StoreId parentFolderId, CreateMode mode, Guid& contentMailboxGuid) at M.E.R.H.PublicFolderOperations.<>c__DisplayClass1.<CreateFolder>b__0(StoreId& folderIdToSync, Guid& contentMailboxGuid) at M.E.R.H.PublicFolderOperations.InvokeOnPrimaryHierarchyAndSync[T](Boolean isCompleteSync, PublicLogon publicLogon, PrimaryHierarchy",,,firstname.lastname@example.org,
If you run the Get-ServerHealth -Identity ServerIdParameter -HealthSet 'Outlook.Protocol' command in Exchange Management Shell (EMS), the Outlook.Protocol health set reports unhealthy, specifically for the following monitors that are related to Outlook remote procedure call RPC):
The failure of the OutlookRpcDeepTestProbe probe logs the following message:
Microsoft.Exchange.Rpc.RpcException: Error 0x5 (Access is denied) from ClientAsyncCallState.CheckCompletion: RpcAsyncCompleteCall