"Insufficient access rights to perform the operation." when running "Update-AddressList" or "New-AddressList"

We noticed that one of the Address Lists has outdated information.

When we try to manually update the list by running "Update-AddressList -Identity "\AddressListName", we get "Insufficient access rights to perform the operation." error.

Resolution: 

1. Run ADSIEdit.

2. Connect to "Configuration".

3. Navigate to "Configuration/Services/Microsoft Exchange//Address Lists Container".

4. Right Click "All Address Lists"/Properties.

5. "Security/Advanced".

6. Check "Include inheritable permissions from this object's parent" (was not checked for me).

Issue: Out-Of-Office (OOF) is not being sent

Issue: Out-Of-Office (OOF) is not being sent.

(also you see event id 3004 in the application log of Exchange mailbox Server:

The Rules quota of mailbox XXX has been reached and the automatic reply rules can't be enabled or updated. Delete some existing rules or increase the user's rule quota and try to set the automatic reply again. You can use the Set-Mailbox cmdlet to increase a user's rules quota.)

Resolution:

Increase the user rules quota:

Get-mailbox XXX | select rulesquota

Set-mailbox XXX –RulesQuota 128KB

Exchange Control Panel - not only Control Panel after all

When the user goes to Options/Change password in OWA (Exchange 2010), user gets redirected to https://yourmailserver.yourdomain.com/ecp...  Therefore 'ecp' is not for working as 'control panel' only.  (You have to make sure ecp is available from outside access if you configure OWA access through TMG or another reverse proxy device)

Configuring POP3s/SMTPs access to Exchange 2010 (part 2 - POP3s)

POP3s:

• Setting up the X.509 certificate name: in EMC – Server Configuration/Client Access; highlight the server, click “POP3 and IMAP4” tab in the lower pane; highlight POP3/right click/Properties; on “Authentication” tab put popserver.yourdomain.com in the “X.509 certificate name” field

• Assigning the certificate to POP3:

Unlike the IIS, SMTP, the POP3 certificate assignment fails when you use the “normal” way (ie. Server Configuration/highlight the server/select the proper certificate in the lower pane/right click/”Assign Services to Certificate”), you have to run following command in the Powershell “Set-PopSettings –X509CertificateName popserver.yourdomain.com” (check PopSettings using the command “Get-Popsettings | fl”)

• Publish POP3 settings to outside:

Follow the article: http://exchangeserverpro.com/exchange-2010-publish-pop3-client-settings/ .   Basically, if you follow the article they have you do following:

•  Run command “Set-PopSettings –ExternalConnectionSettings {popserver.yourdomain.com:995:ssl}

• Check the setting by running “Get-Popsettings | fl”

• Do iisreset

Configuring POP3s/SMTPs access to Exchange 2010 (part 1 - SMTPs)

SMTPs:

• Create ‘Receive Connector’ for this (in EMC: Server Configuration/Hub Transport, highlight the server, ‘New Receive Connector’ from the right pane) – on the production servers naming convention like ‘Fancy Name Connector’

• Following are parameters of the new connector:    

       On General Tab: Specify the FQDN: smtphost.yourdomain.com 
       On Network Tab: Use these local IP addresses to receive mail: 'All Available IPv4'; Port: 465; Receive mail from remote servers that have these IP addresses: all 
       On Authentication: Following to be check marked: 'Transport Layer Security' (TLS), 'Basic Authentication', 'Offer Basic Authentication after starting TLS', 'Integrated Windows authentication
       On Permission Groups: 'Exchange users'

• Allow the group “Authenticated Users” proper permissions (ie. “Accept any Sender”) using ADSIEdit:

  Run ADSIEDIT

Connect to “Configuration”

Navigate to: “CN=Configuration,DC=yourdomain,DC=com/CN=Services/CN=Microsoft Exchange/CN=First Organization/CN=Administrative Groups/CN=Exchange Administrative Group (FYDIB…)/CN=Servers/CN=’ServerName’/CN=Protocols/CN=SMTP Receive Connectors”

             Right click the connector/Properties/Security Tab 
             Set “Accept Any Sender” for “Authenticated Users” 

• Follow the article: http://exchangeserverpro.com/exchange-2010-publish-pop3-client-settings/ .   Basically, if you follow the article they have you do following: Set the attribute “AdvertiseClientSettings” to true (default is “false”):

Run command “Get-ReceiveConnector "hubserver.yourdomain.com\ Fancy Name Connector " | fl” to note the “AdvertiseClientSettings” set to false

Run command: “Set-ReceiveConnector " hubserver.yourdomain.com \ Fancy Name Connector " –AdvertiseClientSettings $true”

Check the setting by running “Get-ReceiveConnector " hubserver.yourdomain.com \ Fancy Name Connector”

 

How to add the list of email addresses to the single mailbox

If you have a txt file with the email addresses to add to the single mailbox you can run following PS script in MS Exchange Management Shell (Exchange 2010 - should work on Exchange 2007 too):
1. $a = Get-Content c:\emailaddresses.txt

(this get content of emailaddresses.txt file with email addresses in it to the variable $a, which is the array)

2. foreach ($b in $a) {set-mailbox user1@yourdomain.com -emailaddresses @{Add=$b} }

(as you see, it's a cycle, where it picks up an item out of array $a to the variable $b and for every item in the array $a, command adds it to the mailbox user1@yourdomain.com)