Mail Target Agent is unable to login to a mailbox on an Exchange 2010 Server and gives the error MAPI_E_FAILONEPROVIDER (4258319)

Mail Target Agent is unable to login to a mailbox on an Exchange 2010 Server and gives the error MAPI_E_FAILONEPROVIDER

When processing PRV files on an Exchange 2010 (E2010) target server, the Mail Target Agent (MTA) is unable to login to the mailbox and the log contain the following error: 

CSession::Logon Error -2147221219 The Microsoft Exchange Server computer is not available.  Either there are network problems or the Microsoft Exchange Server computer is down for maintenance. - MAPI_E_FAILONEPROVIDER (Microsoft Exchange Server Information Store)  Low level error: 0x0 File: 'aeWrapHelpers.h' Line: '279' 

MailKernel::Connect Informational 2079 Synchronization status: Object '/o=Org_Name/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=mailbox' synchronization was not started due to connection errors.

A closer look at the log revealed that the mailbox used as the Migration Administrator Mailbox has been logged into without issue.

9/16/2010 4:40:38 PM CSession::Logon TraceMsg 4800 Logging on to the mailbox '/o=Org_Name/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=mailbox' (Server: 'server_name', user: 'Domain\service_account'). 

This mailbox is in the same database as the mailbox generating the error above. 

The permissions for the service account used to access the Exchange 2010 server have not been set correctly.

The instructions in the Migrating to Exchange 2010 guide (MigrationManager_8.6_MigratingToExchange2010.pdf) on page 5 can easily be applied incorrectly.  The instructions are in two parts.  The mail "database" is set to Receive As permission and then the "Databases" container is set to Full Control.  Extra care should be taken when applying the instructions.

The following is from the guide mentioned above but modified to make the instructions easier to follow.

Access to Exchange 2010 Mailboxes

For every mailbox database and its associated public folder database that is involved in migration, take the following steps:

1.  In the ADSIEdit snap-in, open the Active Directory configuration partition and browse to DC=<...>,DC=<...>,CN=Configuration,CN=Services,CN=Microsoft Exchange,CN=<ExchangeOrganizationName>,CN=Administrative Groups,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Databases,CN=<DatabaseName>

2.  Right click on each CN=<DatabaseName> object and select the Properties.

3.  Select the Security tab and click the Advanced button and select Add.  Retrieve the service account.

4.  In the "Permission Entry for Mailbox Database" dialog box, scroll down thru the permissions and select the Receive as in the Allow permission.

5.  Make sure the "Apply to:" is set to This object and all descendant objects.

6.  Select the OK button(s) all of the way out.


For the "Databases" container take the following steps:

1.  In the ADSIEdit snap-in, browse to DC=<...>,DC=<...>,CN=Configuration,CN=Services,CN=Microsoft Exchange,CN=<ExchangeOrganizationName>,CN=Administrative Groups,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Databases

2.  Right click on the CN=Databases object and select the Properties.

3.  Select the Security tab and click the Advanced button and select Add.  Retrieve the service account.

4.  In the "Permission Entry for Databases" dialog box, select Full Control in the Allow permission.

5.  Make sure the "Apply to:" is set to This object and all descendant objects.

6.  Select the OK button(s) all of the way out. 

Restart the Information Store service twice on every target Exchange 2010 server that is involved in the migration and hosts the Mailbox role.  The interval between restarts does not matter.   If a restart is not possible then wait 2 hours.

Please note that the Powershell commands for impersonation permissions in the Migrating to Exchange 2010 guide (MigrationManager_8.6_MigratingToExchange2010.pdf) are incorrect.  Please see the following solution which contains the corrections for the impersonation permissions:

SOL65192 -  Cannot set Exchange impersonation (Step 2) permissions while running cmdlets as per "QMM 8.6 Migrating to Exchange 2010" guide. - https://support.quest.com/Search/SolutionDetail.aspx?id=SOL65192