Today while moving mailboxes between Exchange 2003 and Exchange 2010, I hit an issue with a couple of mailboxes. These mailboxes all popped access denied errors or more exactly: Insufficient Access Rights to perform the operation. The cause was similar to the mail flow issue in that inheritable permissions were not turned on for the user object in Active Directory. This also presented it’s own unique problem in that since the initial move request failed because of permissions, it had to be cleared before a new move request could be created. On top of that, the request did not show up in the EMC. I used the following process to clear the request, assign permission, then create a new request: 1. First you need to know the ExchangeGUID of the mailbox for the remove-moverequest command. To quickly get the GUID for a mailbox simply run: 2. Next we need to clear out the move request using PowerShell by running: [PS] c:\>Remove-moverequest -moverequestqueue "mailbox database 1030639620" -mailboxguid 8525686f-d4d3-42b7-92f1-46d77ea841a3 3. Then to re-establish inheritable permissions. This can be done by using AD Users and Computers, switching to View Advanced Features, then under the Security tab of the object. Click Advanced, then check “allow inheritable permissions of parent to propagate to this object” 4. Once the Inheritable permissions are restored, we need to create a new move request: NOTE: The EMC can also be used to initiate the Move Request once the permissions are corrected. [PS] c:\>New-moverequest –identity jyoung -baditemlimit 100 -targetdatabase "mailbox database 1030639620" And that’s it. The mailbox should move over smoothly with no access denied error.
