Access rights error when moving mailboxes from Exchange Server 2003 to Exchange Server 2010

When I did the mailbox migrations from Exchange Server 2003 to Exchange Server 2010 yesterday, I received the following error for a couple of mailboxes:

Active Directory operation failed on <DomainControllerName>. This error is not retriable. Additional information: Insufficient access rights to perform the operation.
Active directory response: 00002098: SecErr: DSID-03150E8A, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

The user has insufficient access rights.

Exchange Management Shell command attempted:
’<PathtoOrganizationalUnit>’ | New-MoveRequest -TargetDatabase ‘Mailbox Database 147171981′ -BadItemLimit ‘-1′

In my case, this was caused by inheritable permissions for the user object. To check this setting do the following:

  1. On a domain controller, Open Active Directory Users and Computers.
  2. Make sure that you have advanced features activated. Choose view and then Advanced Features.
  3. Find the user that matches the mailbox you where trying to move.
  4. Open properties for the user and navigate to the Security tab.
  5. Click on Advanced and activate the checkbox Include inheritable permissions from this object’s parent”, then click Ok twice.

And that should do it, you can try to move the mailbox again and it should work. Thanks for reading and do not hesitate to let me know if you run in to any problems!

Increase the number of simultaneous mailbox moves

Yesterday I did a mailbox migration for a customer and it hit me that I have never shared this tip with you before. By default Exchange 2010 allows 2 simultaneous mailbox moves to run. When you perform a migration of many mailboxes you might want to increase this number. Here is how you do it:

    1. Open explorer on the Exchange server and navigate to C:\Program Files\Microsoft\Exchange Server\V14\Bin (This is the default path, the path on your server might be different)
    2. Make a backup copy of the file MSExchangeMailboxReplication.exe.config. I have a habit of creating a file copy and naming it <filename>_backup but that’s just my approach.
    3. Use your favorite text editor and open MSExchangeMailboxReplication.exe.config.
    4. Find the following part in the file:
      MaxRetries = “60”
      MaxCleanupRetries = “5”
      MaxStallRetryPeriod = “00:15:00”
      RetryDelay = “00:00:30”
      MaxMoveHistoryLength = “2”
      MaxActiveMovesPerSourceMDB = “5”
      MaxActiveMovesPerTargetMDB = “2”
      MaxActiveMovesPerSourceServer = “50”
      MaxActiveMovesPerTargetServer = “5”
      MaxTotalMovesPerMRS = “100”
      FullScanMoveJobsPollingPeriod = “00:10:00”
      MinimumTimeBeforePickingJobsFromSameDatabase = “00:00:04”
      ServerCountsNotOlderThan = “00:10:00”
      MRSAbandonedMoveJobDetectionTime = “01:00:00”
      BackoffIntervalForProxyConnectionLimitReached = “00:30:00”
      DataGuaranteeCheckPeriod = “00:00:10”
      DataGuaranteeTimeout = “00:30:00”
      DataGuaranteeLogRollDelay = “00:01:00”
      EnableDataGuaranteeCheck = “true”
      DisableMrsProxyCompression = “false”
      DisableMrsProxyBuffering = “false”
      MinBatchSize = “100”
      MinBatchSizeKB = “256” />
    5. Change the following parameters to match you requirements:
      MaxActiveMovesPerSourceMDB = “5”
      MaxActiveMovesPerTargetMDB = “2”
      MaxActiveMovesPerSourceServer = “50”
      MaxActiveMovesPerTargetServer = “5”
      MaxTotalMovesPerMRS = “100”
    6. Feel free to look through the rest of the parameters in this file, you will see that there is plenty more parameters you can change.
    7. Restart the Mailbox Replication service using the following command: Restart-Service MSExchangeMailboxReplication

Please note that changing these values and allowing more simultaneous mailbox moves etc. increases the load on the server. Change these values with care and do not add extremely high numbers. As a final note, this is not the only thing affecting moves, server performance is a big part of it and especially disk performance. So even if you change these values you might not get a better result.

Thanks for reading and do not hesitate to let me know if you run in to any problems!