SELF permission is missing from the Mailbox Rights for the target mailboxes. (4217575)

In some complex migration scenarios involving merging of accounts using different migration products (QMM, EMW, DMW) the SELF permission may be missing from the Mailbox Rights on the target mailboxes.  As a result target users will loose the ability to access their mailboxes after the SIDHistory cleanup.  How can this be fixed?

The SID that was associated with the SELF permissions (NT AUTHORITY\SYSTEM) that was stored in the msExchMailboxSecurityDescriptor is invalid.  This can be resolved in following ways:

1. For just a single account deleting the mailbox and reconnecting it in Exchange System Manager will put SELF permission back.
    
2. By running the FIX_ACL.vbs script (attached) to correct SELF, the SID is checked for and if needed, updated on the mailbox rights for the accounts.  The resulting new msExchMailboxSecurityDescriptor is valid and the mailbox can be accessed normally.
    
3. If the target is running Exchange 2007  there are some PowerShell commands that  can be used to set the permissions on all mailboxes.
   
   get-Mailbox -server [servername] -ResultSize Unlimited | Add-ADPermission -User 'NT AUTHORITY\SELF' -ExtendedRights 'Send-as'
   get-Mailbox -server [servername] -ResultSize Unlimited | Add-MailboxPermission -User 'NT AUTHORITY\SELF' -AccessRights FullAccess
    
4. If the AD object's Security page is also missing SELF permission the following command can be used to restore ACL to the schema defaults:
   dsacls "CN=User,OU=Users,DC=DCNAME,DC=COM" /S

Note: This will not remove permissions that existed prior to running command.  The "/S" option above is case sensitive. 

For additional information please refer to these Microsoft KB articles:
How to set Exchange Server 2003 and Exchange 2000 Server mailbox rights on a mailbox that exists in the information store - http://support.microsoft.com/kb/310866/en-us
How to set Exchange Server 2000 and 2003 mailbox rights at the time of mailbox creation - http://support.microsoft.com/kb/304935/en-us