Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. Owner cannot create modern public folders by using Outlook in Exchange Server 2013 or Exchange Server 2016

Owner cannot create modern public folders by using Outlook in Exchange Server 2013 or Exchange Server 2016

View products that this article applies to.

Symptoms

Assume that you are the owner of a public folder mailbox or have sufficient access permissions to create a public folder in a Microsoft Exchange Server 2013 or Microsoft Exchange Server 2016 environment. The mailbox uses the secondary hierarchy as the default public folder mailbox. In this situation, when you try to create a public folder by using Microsoft Outlook, you receive the following error message:
Cannot create the folder. You do not have sufficient permission to perform this operation on this object.
See the folder contact or your system administrator.

Note If the default public folder mailbox is changed to a public folder mailbox that contains the primary hierarchy, you can create public folders by using Outlook.

See More information about how to troubleshoot the issue in this article.

↑ Back to the top

Cause

This issue occurs because the LmCompatibilityLevel registry entry on the Exchange Server Mailbox Server role is configured to a value that is less than 2.

↑ Back to the top

Workaround

Important
Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restoration in case problems occur.

To work around this issue, follow these steps on the Exchange Server Mailbox Server role that is hosting the secondary hierarchy public folder mailbox: 
  1. Change the value of the LmCompatibilityLevel registry entry to 2 or greater.

    Note The entry is located under the following registry path:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

  2. Restart the following services:
    • Microsoft Exchange Information Store
    • Microsoft Exchange RPC Client Access
    • Microsoft Exchange Health Manager

↑ Back to the top

More Information

For more information about the LmCompatibilityLevel setting, see the following articles:
General information about the LmCompatibilityLevel registry entry

Security Watch: The Most Misunderstood Windows Security Setting of All Time

More information to troubleshoot this issue
When this issue occurs, other than the error message, you can also find the following information that may help troubleshoot this issue.
  • The following message is logged under the "RPC Client Access" log in Event Viewer:
    Client=MSExchangeRPC,,,,-2147024891 (rop::AccessDenied),00:00:00.0310000,,"RopHandler: CreateFolder: [AccessDeniedException] Cannot open mailbox /o=Contoso/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=9f049c7972fb4d8ebe9f5ece73e136fe-PFHierarchy. -> [MapiExceptionNoAccess] Unable to make connection to the server. (hr=0x80070005, ec=-2147024891)  [diag::AAAGAgAA/wAAAAAAAAAAA/gBAACYMvAvAQAAACwQAsAAAAAA6PIAEHA5FpCYP/AvBQAAAG4vYQBwORaQmCHwH/Q1AACYMfAvcDkWkAk00AEsEALAmCnwHw0AAACYOfAfLBACwJgl8B95BQAAmDXwHwAAAACYLfAfAAAAAOjyABBwORaQmD/wLwUAAABuL2EAcDkWkJgh8B/0NQAAmDHwL3A5FpAJNNABkQEAAJgp8B8NAAAAmDnwH5EBAACYJfAfiQUAAJg18B8AAAAAmC3wHwEAAACYIvA/AAAAAFVuYXV0aG9yaXplZAAAAADo8gAQcDkWkJg/8C8FAAAAbi9hAHA5FpCYIfAf9DUAAJgx8C9wORaQCTTQAQAAAACYKfAfDQAAAJg58B8AAAAAmCXwH+ELAACYNfAfAAAAAJgt8B8AAAAA6PIAEHA5FpCYP/AvBQAAAG4vYQBwORaQmCHwH/Q1AACYMfAvcDkWkAk00AHhCwAAmCnwHw0AAACYOfAfAAAAAJgl8B/hCwAAmDXwHwAAAACYLfAfAAAAAHHoQBAFAAeAcMVAIQAPFIQZAPAvBQAAAHDLQBAFAAeA0McAEPQ1AADxzEAQBQAHgKHqABAFAAAA8YNAEAUAB4Cd6QAQBQAAAAfNQBAFAAeAQk0AEAAAAABCbUAQBQAHgEJFABAAAAAAQmVAEAUAB4A=]  
    at M.E.D.S.RPCPrimaryHierarchyProvider.GetHierarchyStore()    
    at M.E.D.S.RPCPrimaryHierarchyProvider.CreateFolder(String folderName, String folderDescription, StoreId parentFolderId, CreateMode mode, Guid& contentMailboxGuid)   
     at M.E.R.H.PublicFolderOperations.<>c__DisplayClass1.<CreateFolder>b__0(StoreId& folderIdToSync, Guid& contentMailboxGuid)    
    at M.E.R.H.PublicFolderOperations.InvokeOnPrimaryHierarchyAndSync[T](Boolean isCompleteSync, PublicLogon publicLogon, PrimaryHierarchy",,,admin@contoso.com,
  • If you run the Get-ServerHealth -Identity ServerIdParameter  -HealthSet 'Outlook.Protocol' command in Exchange Management Shell (EMS), the Outlook.Protocol health set reports unhealthy, specifically for the following monitors that are related to Outlook remote procedure call RPC):
    • OutlookRpcDeepTestMonitor
    • OutlookRpcSelfTestMonitor
  • The failure of the OutlookRpcDeepTestProbe probe logs the following message:
    Microsoft.Exchange.Rpc.RpcException: Error 0x5 (Access is denied) from ClientAsyncCallState.CheckCompletion: RpcAsyncCompleteCall

↑ Back to the top

Keywords: kbsurveynew, kbprb, kbtshoot, kbexpertiseadvanced, kb

↑ Back to the top

Article Info
Article ID : 3035230
Revision : 1
Created on : 1/7/2017
Published on : 10/1/2015
Exists online : False
Views : 286