Exchange – Insufficient Access Rights when trying to modify permissions on a public folder


Today I faced a new problem, on some Public folders I wasn’t able to change the send as permission. When I tried to configure the send as permission trough the EMC or Powershell I goth this error message:

Summary: 1 item(s). 0 succeeded, 1 failed. Elapsed time: 00:00:00


Error: Active Directory operation failed on ADSERVER.DOMAINNAME.COM. This error is not retriable. Additional information: Access is denied. Active directory response: 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

The user has insufficient access rights. Click here for help...

Exchange Management Shell command attempted: Add-ADPermission -Identity 'CN=PUBLICFOLDER,CN=Microsoft Exchange System Objects,DC=DOMAINNAME,DC=COM' -User 'DOMAINNAMEUSERNAME-ExtendedRights 'Send-as'

Elapsed Time: 00:00:00

This what what you need to do to solve this problem:

  1. Create a new public folder and see if you can add the Send-As permissions to it or you will have the same error above. If that the case stop here and this will not sort your issue or may be yes (let me know please)
  2. Open ADSIEdit and check that the ownership of the new folder by going to Default naming context -> DC=domainname,DC=co,DC=uk ->CN=Microsoft Exchange System Objects -> right click on the object of the PF you just created and select properties then Advanced, Ownership and note the name of who owned the public folder (in my case the servername$)
  3. Repeat step 2 for the Public Folder object in question and go to the ownership tab in (in my case it said system is the owner) change it to one that worked in step 2 (in my case the servername$)
  4. Save and try again the send as permission again and it should work.


Get number of mailboxes in each database?

Many times we need to find number of mailboxes in each database and the size of the database (EDB file) of all servers in an Exchange 2010 environment. With PowerShell, it is fairly simple to grab in a single line.

Get-MailboxDatabase | Select Server, StorageGroupName, Name, 
@{Name="Number Of Mailboxes";expression={(Get-Mailbox -Database 
$_.Identity | Measure-Object).Count}} | Format-Table -AutoSize

Export to CSV:

Get-MailboxDatabase | Select Server, StorageGroupName, Name, 
@{Name="Number Of Mailboxes";expression={(Get-Mailbox -Database 
$_.Identity | Measure-Object).Count}} | Export-Csv C:\ServerStat-1.csv

PowerShell – Search the Public Folder

If you want search in the public folder database for an folder you can use the scripts below.

If you know the exact name of the folder:

Get-PublicFolder -Identity "" -Recurse | where {$_.Name -eq "FOLDERNAME"}

If you don’t know the exact name:

Get-PublicFolder -Identity "" -Recurse | where {$_.Name -like "FOLDER*"}


How to Delete the First Database and Move the System Mailboxes

When you try to delete the Default Mailbox Database(created with 1st installation of the Mailbox Role), you receive the error below:

“This mailbox database contains one or more mailboxes or arbitration mailboxes. Before you can remove this mailbox database, you must disable, move or remove user mailboxes and move arbitration mailboxes.”

The First database contains the SystemMailboxes which are the Arbitration mailbox(es).

We have to move these system mailboxes to another database before of remove the Default Database.

1. Find the Arbitration Mailbox using the Exchange MAnagement Shell (EMS):

Get-Mailbox -Arbitration | Where {$_.Name -like "SystemMailbox*" } | ft –wrap, name, alias, database

2. Now create a new move request in order to move the system mailboxes to another mailbox database:

New-MoveRequest -Identity "SystemMailbox{1f05a927-32d1-4e19-8ea5-67eba859f541-yourGUID}" -TargetDatabase "dbxxxx"

3. Verify whether the move request completed:


4. Now remove the move request

Remove-MoveRequest -Identity "the name of the request like Microsoft Exchange Approval Assistant"

PowerShell – Disconnected mailboxes are not yet marked as disconnected

Use the Clean-MailboxDatabase cmdlet to scan the Active Directory directory service for disconnected mailboxes that are not yet marked as disconnected in the Microsoft Exchange store and update the status of those mailboxes in the Exchange store.
This cmdlet is not able to update the Exchange store unless the Microsoft Exchange Information Store service is running and the database is mounted.

Run from exchange management shell:

$mailboxDatabase = Get-MailboxDatabase

foreach ($cont in $mailboxDatabase){
	clean-MailboxDatabase -Identity $cont.Name

From remote or normal Powershell window:

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010
	$mailboxDatabase = Get-MailboxDatabase	
	foreach ($cont in $mailboxDatabase){
		clean-MailboxDatabase -Identity $cont.Name
Remove-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010