Exchange Server: Send-As Problem 4003 (INSUFF_ACCESS_RIGHTS)

MS Exchange ServerWhen you create a Distribution Group in and want to grant "Send As" or "Send on Behalf" permissions to this group, you may encounter an error.

Exchange Server Send-As Problem 4003 (INSUFF_ACCESS_RIGHTS) Error

Access is denied. Active directory response: 00000005: SecErr: DSID-03146551, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

Active Directory operation failed on . This error is not retriable. Additional information: Access is denied.
Active directory response: : SecErr: DSID-03146551,, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

CategoryInfo : WriteError: (0:Int32) [Add-ADPermission], ADOperationException

FullyQualifiedErrorId : 5557AD82,Microsoft.Exchange.Management.RecipientTasks.AddADPermission

Exchange Server Send-As Problem 4003 (INSUFF_ACCESS_RIGHTS) Error Solution

This error, “Exchange Trusted Subsystem“due to insufficient access permissions being granted to”Add-ADPermission" command is run. You can get this error via ECP (Exchange Control Panel) and PowerShell.

The reason for the error you have received is that the Add-ADPermission set is giving a warning because the Exchange Trusted Subsystem is not granted permission to change the permission.

To solve this problem, “Exchange Trusted SubsystemYou must add the “change authorization” definition to the OU containing the DG.

  1. Open Active Directory Users and Computers:
    • "Viewfrom the ” menuAdvanced Features Activate the ” option.
  2. Accessing the OU Containing Distribution Groups:
    • Including distribution groups Organizational Unit (OU) Right click on it and open “Properties”.
  3. Security and Permissions:
    • "Security” tab and select “AdvancedClick the ” button.
    • "Permissions” tab “AddSelect the ” button.
  4. Add Exchange Trusted Subsystem:
    • In the “Enter the object name to select” box, enter “Exchange Trusted SubsystemType ” and select “OK”.
    • Note: If Exchange Server is installed in a domain other than the domain in which this Organizational Unit is located, “Exchange Trusted Subsystem” may not be found in the current domain.
  5. Setting Permissions:
    • “ In the “Permission Entry for” window, “Descendant Group ObjectsEnable the “Modify” permission for .
    • To remove all permission selections added by default, scroll to the bottom of the window and select “Clear All.”
    • In the Permissions section, select “Change Permissions.”

After these operations, you can grant authorization without any problem.


Similar Articles – Exchange Server: Send-As Problem 4003 (INSUFF_ACCESS_RIGHTS)

Comment