Symptom

The following error details are presented for the ActiveSync or OWA connectivity test indicators:


[Microsoft.Exchange.Monitoring.CasHealthStorageErrorException]: An error occurred while trying to access mailbox EXCHANGE2010SERVER.contoso.com, on behalf of user contoso.com\extest_00d34ef5c0754 Additional information: [Microsoft.Exchange.Data.Directory.ADOperationException]: Active Directory operation failed on DOMAINCONTROLLER.contoso.com. This error is not retriable. Additional information: Access is denied. Active directory response: 00000005: SecErr: DSID-031A11D7, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0 Inner error [System.DirectoryServices.Protocols.DirectoryOperationException]: The user has insufficient access rights..


Cause

The configured service account for the ENow Client and ENow admin services that run on the Exchange 2010 Client Access servers does not have the Reset password permission for the Client Access test account.  Usually the account name for Exchange 2010 environments starts with "extest_"


Resolution

Please assign the service account as a security principal of the extest_account and assign it the "Reset Password" permission: