XADM: Recovering Permissions on Public Folders When Deny Is Set

When you try to mount a public folder store by using Exchange 2000 Server version of Exchange System Manager, you may receive the following error message: After you receive the preceding error message, you receive the following error message: The following error message is logged in the event log:

This issue can occur if the public folder permissions for the Everyone group are set to Deny at the root of the public folder hierarchy in Exchange System Manager.

To resolve this issue, determine how the permissions are set, and then remove the assigned Deny permission:

1. To determine how the permissions are set, run the Dsacls utility from the command line.
   
   NOTE: Dsacls is a command-line utility that is included with Microsoft Windows 2000 Server and is installed when you install the Windows 2000 Support Tools. Open a command prompt window and type the following command:
   DSACLS "CN=Public Folders,CN=Folder Hierarchies,CN=First Administrative Group,CN=Administrative Groups,CN=ORGANIZATION,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=DOMAIN,DC=com" >text.txt
   NOTE: In the preceding command, replace CN=ORGANIZATION and DC=DOMAIN with the names of your Exchange organization and domain. If you are running this command on a server in a child domain, you need to add a DC=DOMAIN field for each level of the domain name.
   
   This command produces an output file of which accounts have been set to deny. The following output shows the permissions settings when the Group Everyone has been set to Deny:

   Effective Permissions on this object are: 
   
   Deny  Everyone   SPECIAL ACCESS 
                    READ PERMISSIONS 
                    LIST CONTENTS 
                    READ PROPERTY
   						

2. Remove the assigned Deny permission by using the following command:
   DSACLS "CN=Public Folders,CN=Folder Hierarchies,CN=First Administrative Group,CN=Administrative Groups,CN=Microsoft,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=DOMAIN,DC=com" /I:T /R EVERYONE