Microsoft KB Archive/320098

= XADM: Error Message When You Assign New Task to User =

Article ID: 320098

Article Last Modified on 2/27/2007

-

APPLIES TO


 * Microsoft Exchange 2000 Server Standard Edition

-



This article was previously published under Q320098



SYMPTOMS
In Microsoft Outlook, if you try to assign a new Task to a user who is listed in the Global Address List (GAL), you may receive the following error message:

You do not have the permission to send the message on behalf of the specified user.



CAUSE
The security on the user object in Active Directory is incorrect.



RESOLUTION
To resolve this issue, you must change the security on the user object in Active Directory.

To restore the default security to the user object by using the Directory Services Access Control List command-line tool (Dsacls.exe):

Install Dsacls.exe

 * 1) Insert the Microsoft Windows 2000 CD into the CD-ROM drive.
 * 2) In the Microsoft Windows 2000 CD dialog box, click Browse This CD.
 * 3) Locate  :\Support\Tools, and then double-click the Support.cab file.
 * 4) In the SUPPORT.CAB dialog box, right-click the Dsacls.exe file, and then click Extract.
 * 5) In the Browse for Folder dialog box, locate the %Systemroot%\System32 folder, and then click OK.
 * 6) Close the SUPPORT.CAB dialog box.
 * 7) Quit Windows Explorer, and then close the Microsoft Windows 2000 CD dialog box.

Restore Default Security by Using Dsacls.exe
 Click Start, and then click Run. In the Run dialog box, type cmd, and then click OK. At the command prompt, type dsacls  /S, where   is the distinguished name or path to the user object in Active Directory, for example:

dsacls CN=Jeff Smith, OU=Software, OU=Engineering, DC=Widget, DC=US /S

 Press ENTER.NOTE: For help using Dsacls.exe, type dsacls /? at the command prompt.

 Close the command prompt.

Restore Default Security by Using Dsacls.exe
WARNING: If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client, and you incorrectly modify the attributes of Active Directory objects, you can cause serious problems. These problems may require you to reinstall Microsoft Windows 2000 Server, Microsoft Exchange 2000 Server, or both. Microsoft cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk.  Start ADSI Edit.</li> Expand Domain NC.</li> Expand DC=.</li> Expand CN=Users.</li> Right-click the affected user account, and then click Properties.</li> In the Show properties to View list, click DistinguishedName.</li> Select the attribute value, press CTRL+C to copy the value to use it later, and then close or minimize ADSI Edit.</li> Click Start, and then click Run, type cmd, and then click OK.</li> At the command prompt type the following command, and then press ENTER:

dsacls &quot; &quot; /S

where  is the Value copied in step 7.</li></ol>

Alternatively, to reset all objects in a specific Organizational Unit (OU):  Start ADSI Edit.</li> Expand Domain NC.</li> Expand DC=.</li> Right-click Target OU, and then click Properties.</li> In the Show properties to View list, click DistinguishedName.</li> <li>Select the attribute value, press CTRL+C to copy the attribute to use it later, and then close or minimize ADSI Edit.</li> <li>Click Start, and then click Run, type cmd, and then click OK.</li> <li>At the command prompt type:

dsacls &quot; &quot; /S /T

where  is the Value copied in step 6.

For example:

dsacls &quot;CN=Users,DC=Widget,DC=US&quot; /S /T

</li></ol>

Keywords: kbprb KB320098

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.