While performing the initial Exchange 2010 deployment for a customer migrating from Exchange 2003, I ran into an issue with mail flow between the two environments. The Exchange 2003 mailboxes could send to Exchange 2010, as well as to and from the internet. Exchange 2010 mailboxes could send and receive to the internet, however they could not send to Exchange 2003 mailboxes. After scouring the internet for a solution, it seemed quite a few people were experiencing this issue with no resolution to be found, or at least not easily. After many attempts of manually deleting and recreating the routing group connectors, I finally lucked onto the answer in an obscure comment left to another blogger. If inheritable permissions are not allowed on the Exchange 2003 object in the Active Directory schema, exchange server authentication cannot be achieved between the servers. It seems when Blackberry Enterprise Server gets added to 2003 environments, a lot of Admins get tricky and add the BES Admin user explicitly to the server object to allow inheritance down from there to all mailboxes. The problem is they also coincidently turn off inheritance to the server object itself from its parent containers. You can re-establish inheritance without overwriting the existing ACL however so that the BES Admin can remain in the server object ACL. By re-establishing inheritance to the 2003 server object, mail flow was instantly restored between the servers. To re-establish inheritance: 1. Open ASDIedit by adding the snap-in to a MMC (should be included on your 2008 server where Exchange 2010 is installed) 2. Navigate to Configuration > Services > Microsoft Exchange > Exchange Organization > Administrative Groups > First Administrative Group > Servers 3. In the right pane, right click on the CN=Server Name of your Exchange 2003 Server, select properties 4. Navigate to the Security tab, hit advanced toward the bottom. 5. Check the checkbox that reads “include inheritable permissions” toward the bottom of the dialogue box.
