Supporting Technology

I was getting this error message on my SBS 2008 Server:

Log: Security

Type: Failure Audit

Event: 4625

Agent Time: 11:26:36 am 4-Apr-09

Event Time: 3:26:36 pm 4-Apr-09 UTC

Source: Microsoft Windows security auditing.

Category: Logon

Username: N/A

Computer: ICS-S01.ics.local

Description: An account failed to log on.

Subject:

 Security ID: S-1-5-18

 Account Name: ICS-S01$

 Account Domain: ICS

 Logon ID: 0x3e7

Logon Type: 3

Account For Which Logon Failed:

 Security ID: S-1-0-0

 Account Name: ICS-S01$

 Account Domain:

Failure Information:

 Failure Reason: Unknown user name or bad password.

 Status: 0xc000006d

 Sub Status: 0xc0000064

Process Information:

 Caller Process ID:  0xc88

 Caller Process Name: C:\Program Files\Microsoft\Exchange Server\Bin\Microsoft.Exchange.Search.ExSearch.exe

Network Information:

 Workstation Name: ICS-S01

 Source Network Address: -

 Source Port:  -

Detailed Authentication Information:

 Logon Process: Advapi

 Authentication Package: Negotiate

 Transited Services: -

 Package Name (NTLM only): -

 Key Length: 0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.

 - Transited services indicate which intermediate services have participated in this logon request.

 - Package name indicates which sub-protocol was used among the NTLM protocols.

 - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Last week I had a client who wanted the BES installed on his SBS 03 server.  No big deal, I’ve done it before…

Anyway, I had some problems with the “SendAs” permissions being revoked.  I wanted to detail some KB’s that helped me get everything straightened out.  Hopefully it will be good for someone else!

First, here is the install guide from Blackberry:  http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8067/645045/1382175/1404165/1382176/Getting_Started_Guide.pdf?nodeid=1382253&vernum=0

Here are the details on setting up the permissions for the Blackberry service account:  http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB02276&sliceId=SAL_Public&dialogID=6316111&stateId=0%200%203804961

Here is a KB from BB regarding the SendAs getting revoked:  http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB04707&sliceId=SAL_Public&dialogID=6306833&stateId=0%200%203804284

Here is a KB from Microsoft regarding the SendAs getting revoked:  http://support.microsoft.com/kb/912918/en-us

Keep in mind that Blackberry is VERY picky about permissions!!!  I can’t stress that enough.  I thought well, I can do what I want to and make it work.  No!  FOLLOW THE INSTRUCTIONS and save yourself some headache.  Also, keep in mind that permissions on the user account that you are syncing with (not the BES admin account) are important too.  They cannot be domain admins or power users or administrators.

UPDATE

Ok, all that I did and all my googling solved the problem.  I finally called BB tech support.  Here is the solution that they gave:

Go to Active Directory Users and Computers

Go to View->Advanced

Expand your domain.

Expand System.

Right click on AdminSDHolder, and click properties

Go to the Security tab, and click the Advanced button

Click “Allow inheritable permissions from the parent to propogate to this object……”

Click Apply and OK.

Now go to the User account that you are trying to use with the Blackberry server.

Right click and click properties and choose Security and Click advanced and check “allow inheritable….”

Apply, Ok, Done!  (Hopefully!!!)

Hopefully that saves someone else some pain!

All the best,

Luke

I just did my first Exchange Active Sync configuration.

Here’s the procedure:

1) Make sure you have a valid cert on your site. https://FQDN/exchange should NOT give you an cert errors. If you do insist on using a self-signed cert, it requires saving the cert to a XML file format, sticking that XML file into a CAB file, and then transferring and installing that CAB file on the mobile phone (Windows Mobile only). Use a cert from a recognized certificate authority. Here are some KB’s on it:

2) Make sure you have port 443 open on your router and directed to your Exchange FE server.

3) You will need to follow the following KB to get Exchange AS to work on Exchange server 2003 Standard and Enterprise: http://support.microsoft.com/kb/817379. Note that if you have SBS 2003, Microsoft has kindly already taken care of getting it to work. This site http://www.amset.info/exchange/mobile-85010014.asp also has some valuable content. Basically a reproduction of KB 817379, except he gives some additional steps that I used - but don’t know if I would have had to or not!

4) Finally, go to your mobile phone and setup ActiveSync to the FQDN of your Exchange server. This should be public DNS resolvable.

Finally, let me add that my synchronization of Windows Mobile was totally smooth. Getting the Treo 755 (Palm OS) to work was a bit of a challenge. However installing Exchange SP2 ultimately resolved that problem. To determine the Exchange Service pack level, go to Exchange System Manager and right click on your server. You should see the service pack level under the “General” tab of “Properties.”