It has been observerd that in some environments the cmdlets suggested by QMM documentation do not allow the service account to log on to any newly created Exchange 2010 mailboxes. That is, the cmdlets grant enough permissions to log on to the mailboxes existing in the database, however, when a new mailbox is created by the MMEX Directory Synchronization Agent (or manually, if this is the source database), the service account cannot log on to it and requires applying Send as and Receive as permissions explicitly.
In some cases Exchange 2010 "does not see" Receive As right granted over the database if it has been assigned as part of Generic All permissions set.
Please also see https://support.quest.com/migration-manager-for-exchange/kb/101781 for reference.
It has been found that running the following two cmdlets allows logging on to newly created mailboxes in Exchange 2010:
Get-MailboxDatabase | Add-ADPermission -User TARGET\QMM-SRV -AccessRights GenericAll
Get-MailboxDatabase | Add-ADPermission -User TARGET\QMM-SRV -ExtendedRights Receive-As
To validate permissions have been granted correctly, run:
get-mailboxdatabase DATABASENAME | get-adpermission | where {$_.user -like "*qmm*"} | ft identity,user,accessrights,extendedrights,*inherit*
This cmdlet should report BOTH GenericAll AND Receive As for each Exchange database in two separate lines, as follows:
AccessRights: <ExtendedRight>
ExtendedRights: <Receive-As>
Instead of
AccessRights: <GenericAll>
ExtendedRights: [empty]
that is displayed when permissions have been granted according to the documentation instructions.
