Web Interface Error - "You are not allowed to modify..."

Question

We get the following error when attempting to edit a room or equipment mailbox in the web interface. We can edit them using the admin console. I am a full Adaxes Admin so I don't think permissions. I also don't see an error in the logs.

Answer 1

Hello!

Please, specify whether you are able to modify the mailboxes when signed in to the Web Interface using Adaxes service account (specified during Adaxes installation). If you do, most probably the account that is facing the Access Denied error is missing permissions to modify the corresponding object types or there are Security Roles that deny the Write permission for the object types. Note: Deny permissions always override the Allow ones. By permissions here we mean those granted by Adaxes Security Roles. For information on how to view roles assigned to a user, have a look at the following help article: https://www.adaxes.com/help/?HowDoI.ManageSecurityRoles.ViewSecurityRolesUserGroupPerforms.html.

Comments

I was able to do it with the service account. My account is a service administrator as well. We don't have deny's in place except for a specific custom command for editing a users expiration date. Any way to trace this back to see what would be preventing it?

---

Hello!

As you are able to edit the mailbox while signed in to a Web Interface using credentials of the Adaxes service account, it means that the issue is related to a lack of permissions. By default only the Adaxes service account is present in the list of service administrators and has unrestricted permissions in Adaxes. Most probably your account is not added to the list of service administrators and is missing required permissions. You can either add your account to the list or make sure there is a Security Role assigned to your account that is granting permissions to modify room and equipment mailboxes. For details on how to grand rights to perform Exchange tasks, have a look at the following tutorial: https://www.adaxes.com/tutorials_DelegatingPermissions_GrantPermissionsToPerformExchangeTasks.htm.

---

Hi,

My account is in the service administrators through membership in a group. As well we have granted full rights to the mailboxes. I understand it is something to do with permissions but don't see it.

---

Hello!

Thank you for the provided information. For further troubleshooting, please, send us (support[at]adaxes.com) a screenshot of the service administrators list and a members section screenshot of the group that grants your account service administrator privileges. To get the screenshots:

1. Launch Adaxes Administration Console.
2. In the Console Tree, right-click your service node.
3. In the context menu, click Properties.
4. Activate the Administrators tab.
5. Make sure that the group that grants your account service administrator privileges is present in the list.
6. Take a screenshot and send it to us. We need something like this:
7. Expand your service node.
8. Expand Active Directory.
9. Navigate to the container where the group that grants you service administrator privileges resides.
10. Right-click the group and then click Properties.
11. Activate the Members tab.
12. Make sure that your account is present in the members list.
13. Take a screenshot and send it to us.

---

Sent.

Edit: Ticket#2020121810000905

---

Well thanks again Adaxes! For everyone else, I was signed in with the wrong account because of SSO. I thought I had signed in with my admin account but had not.

The user must have not refreshed the page or it took some time for the permissions to replicate.

All is working now.