Tony's Blog

Access Denied when Adding or Removing Retention Policies in Outlook

Tony_Williams — Wed, 19 Jun 2013 13:23:00 GMT

After enabling users for a Personal Archive you go to the properties of one of your folders in Outlook and you will notices a new Policy tab that wasn't there before. You select "Add or Remove Retention Policies"

This will launch your default browser and take you to your Exchange Control Panel /ecp. You might see this error after logging in:

Sorry! Access Denied. The page may not be available or you might not have permission to open the page. Please contact your administrator for the required credentials. For new credentials to take effect, you have to close this window and log on again.

If you receive this error it is because you don't have the role "MyRetentionPolicies" assigned to your current Role Policy"

Here is an example of the Default Role Assignment Policy and you will notice that "MyRetentionPolicies" is not there:

Get-RoleAssignmentPolicy | fl Name,AssignedRoles

Now to add the "MyRetentionPolicies" role to the Default Role Assignment Policy:

New-ManagementRoleAssignment -Name "Default Role Policy - MyRetentionPolicies" -Role MyRetentionPolicies -Policy "Default Role Assignment Policy"

Note you can change the -Name "" to fit your environment

Now if you go back into Outlook and try to access "Add or Remove Retention Polices" it should take you back to the Exchange Control Panel but this time after logging in you should see you options:

Block Outbound Emails for a Group of Users

Tony_Williams — Mon, 20 May 2013 12:17:22 GMT

Request was to block all Exchange Admins accounts from sending out external emails.

This can be done easily with a Transport Rule:

Create a Distribution Group and add all the Exchange Admin accounts that you want to block: ExAdmins@e2k10.local

Start the New Transport Rule Wizard

Give the New Transport Rule a Name: "Block Exchange Admins External Email

For the Conditions select "From a member of distribution list"

Select the Distribution Group you just created for the ExAdmins

Also under Conditions select:

"from users that are inside or outside the organization" - Inside the Organization

"sent to users that are inside or outside the organization" - Outside the Organization

For Actions select "send rejection message to sender with enhanced status code"

Message: External Email Blocked

Status code: 5.7.1

Complete the wizard and create the rule

If you don't want to use the New Transport Rule wizard you can just edit and run the following command:

New-TransportRule -Name 'Block Exchange Admins External Email' -Comments '' -Priority '0' -Enabled $true -FromMemberOf 'ExAdmins@e2k10.local' -FromScope InOrganization -SentToScope 'NotInOrganization' -RejectMessageReasonText 'External Email Blocked' -RejectMessageEnhancedStatusCode '5.7.1'

OST still gets created and continues to grow after switching Outlook to Online Mode

Tony_Williams — Wed, 17 Apr 2013 09:57:00 GMT

Question:

When changing users from Cached Mode to Online Mode in Outlook and deleting the OST file, after starting Outlook the OST was recreated and continued to grow.

Recreating the problem:

New Profile created in Cached Mode and OST is created

You uncheck Cached Mode option in Outlook

Close Outlook and manually delete the OST

You launch Outlook again and shows in Online mode

But when you look the OST file was recreated and starts to grow in size

The Solution:

The problem we were running into here was due to a GPO setting was enabling folders for offline use, and by just unchecking Cached Exchange Mode that did not remove the Offline Use settings on the folders so the OST would still get created

Here is the GPO that was effecting this environment, it was set to "Download Headers and then Full Items" which is fine and what they want it just means we need to get an extra step when moving users to Online Mode and not wanting the OST to be recreated

After changing an profile from Cached Mode to Online mode if you check your Send/Receive Group settings you will notice that folders are marked for Offline Use still.
Tools, Send/Receive, Send/Receive Settings, Define Send/Receive Groups
Under Folder Options some default folders are selected.

To fix this and stop it from recreating the OST file

Close Outlook
Go to Control Panel and Mail
Select the profile you are working with, go into the profile properties and More Settings, and select the Advanced Tab

Select Offline Folder File Settings

Select Disable Offline Use

Select Yes
Close out of the Profile settings and manually delete the OST file again

ReOpen Outlook

You will notice that the OST does not get recreated now and in your Send/Receive groups your folders are not marked for offline use:

Note, this was the solution for this environment, it might be different in others.