Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

The user ... does not have the required Exchange Administrator permissions ( Deployment Scanner )

Created: 05 Nov 2007 • Updated: 02 Jan 2015 | 3 comments
de_geiren's picture
This issue has been solved. See solution.


I'm busy installing a EV 2007, but I ran into a problem...

When I run the Deployment Scanner, Everything is Passed excep the Exchange Server Permissions. This is the messages that is shown : The user GURU\vaultservice does not have the required Exchange Administrator permissions (including 'send as' and 'receive as' permissions) on all exchange servers...

Little more info :
- Exchange is 2007 ( seperate server )
- EV server has Outlook 2003, ESM 2003 with SP2 installed.
- Permissions are set like described in the install and config guide for EV 2007 ( adsiedit.msc  )
- In the Shell of Exchange I tried the add-ADpermission command, but no luck!!

Oh yeah, when I try to send a mail from outlook with the ev account as another user, I always get the message : You do not have the right permissions to send a mail on behalf of...... So the send-as permissions is not ok.

Any idea...

Thanks in advance!

Discussion Filed Under:

Comments 3 CommentsJump to latest comment

MichelZ's picture


Try doing the Permissions thing again like this:

To assign the permissions at Organization or Administrative Group level (Exchange Server 2007)

  1. To assign permissions at Exchange Organization level, expand the tree in adsiedit.msc as follows:

    Configuration[your domain]/CN=Configuration,[your domain]/CN=Services/CN=Microsoft Exchange/CN=[your Exchange organization]

    To assign permissions at Administrative Group level, expand the tree as follows:

    Configuration[your domain]/CN=Configuration,[your domain]/CN=Services/CN=Microsoft Exchange/CN=[your Exchange organization]/CN=Administrative Groups/CN=Exchange Administrative Group(FYDIBOHF23SPDLT)

  2. Right-click the object and select Properties.

  3. Click the Security tab.

  4. Add the Vault Service account and grant this account Full Control.

  5. Click Apply.

  6. Click Advanced.

  7. For the permission entry for the Vault Service account:

    • Select the permission entry and click Edit....

    • Change Apply onto to This object and all child objects.

    • Click OK to exit the Edit window.

    • Click OK to close the Advanced Security Settings window.

    • Click OK and close the Properties window.

  8. Close adsiedit.msc.

If it does not work, would you mind posting some screenshots of this configurations?


Marc van Duuren's picture
I am having the same problems.
I tried to give the permissions with the help of adsiedit, but running the Deployment Scanner still gives me the comment that the service account is missing the required send as and receive as permissions.

Message Edited by Marc van Duuren on 04-25-2008 04:09 AM

GertjanA's picture
Also, (obvious perhaps, but still worth checking) make sure the account you use is not a member of domain admins groep. This group has send as/recieve as denied by default.

Thank you, Gertjan, MCSE, MCITP,MCTS, SCS, STS