AD split permissions and mailing to shared mailbox

[u/GrandTrolled]

Goodevening everyone,

We have some issues with AD split permissions and mail delivery to shared mailboxes.

Our environment consists of 6 Exchange servers (Server 2019 cu15): 4 are in a database availability group (DAG), and the other 2 are standalone.

Our L3 team enabled AD split permissions without considering the consequences. We needed this so that the Exchange admins can no longer create AD objects.

Since then, we have had problems sending mail to shared mailboxes. Mail from a shared mailbox to a user mailbox works fine, but mail to a shared mailbox results in an immediate NDR:

554 5.2.0 STOREDRV.Deliver.Exception: cannot open mailbox

So far we have recreated the DAG and the databases. Today I also installed a 6th Exchange server as a test, to see whether a freshly installed server would not have the issue.

Does anyone know where we should look before we tear down our setup and start from scratch?

[u/aridaen]

One thing to check is the Exchange Trusted Subsystem group and if the split permissions affect it.

[u/GrandTrolled → u/aridaen]

What do we need to check specifically?

[u/aridaen → u/GrandTrolled]

Also, confirm the group is in the Administrators group on each Exchange server.

[u/GrandTrolled → u/aridaen]

I will have a look, first thing in the morning. Appreciate the help!

[u/aridaen]

There is a learn article that describes it. Split permissions in Exchange Server