Exchange 2010 SP3: Event ID 1053 Exchange ActiveSync doesn't have sufficient permissions to create the "CN" container under Active Directory use "Active Directory operation failed on dc.domain.local. This error is not retrial. Additional information: Access is denied".

You are experiencing problems with certain users connecting a mobile device to the Exchange Server using ActiveSync, after checking all of the usual things such as Mobile Device associations from the ECP, and if ActiveSync is enabled for the users. After checking the event logs on one of the Exchange Client Access Servers (CAS) under the Application Log the event "Event ID 1053 Exchange ActiveSync doesn't have sufficient permissions to create the "CN" container under Active Directory use "Active Directory operation failed on dc.domain.local. This error is not retrial. Additional information: Access is denied". is present stating the user you cannot connect to Exchange.

There is a Microsoft known-issue fix for this but although this fix is similar doing exactly what this document stated did not fix the issue for me http://support.microsoft.com/kb/2579075

The first step was to look at the Security Permissions on one of the effected users objects. I always enable the Advanced Features view from the Active Directory Users and Computers MMC.

Then do a search for the user object and open the Properties, click on the Security tab and click on the Exchange Servers security principal. When I first did this only "Read Exchange Information" and "Read Exchange Personal Information" was Allowed in the entire list.

To test this was causing my issue I gave the Exchange Servers principal Full Control over the object. Although I do not normally like to grant explicit Full Control to anything I was hesitant but since it's the Exchange Servers security principal I could not see any reason why not to.

Exchange 2010 SP3 Users Experiencing Issues with ActiveSync Device (iPhone) "Event 10031 : A folder view which previously experienced consistency issues has been deleted and will be rebuilt the next time it is needed. "

After an unexpected power outage and some "Dirty Shutdown" repairs last week a number of users are having problem connectivity to Exchange via ActiveSync. New messages were being delivered to the device but message being sent out were returning errors. On investigation of the Event Log "Event 10031 : A folder view which previously experienced consistency issues has been deleted and will be rebuilt the next time it is needed. " was populating the Events. One of the problem users was also listed in the Event.

According to the following Microsoft article http://support.microsoft.com/kb/2548246/en-us the work around is to create a new Mailbox Database and simply create a New Local Move Request to that new database. Although I can do this, I would imagine some environments would not have that flexibility.

I created the New Mailbox Database using the Exchange Management Console, this can be done by clicking Organization Configuration\Mailbox and right clicking on the white space selecting New Mailbox Database.

On this particular Exchange deployment the Mailbox Databases and the Transaction Logs are separated on to different partitions, I reconfigured the paths to reflect this.

Exchange successfully create the new databases, I also selected the option Mount this Database so the wizard also automatically done this.

I then right clicked on the new Mailbox Database "MailDB2" and selected Properties and then Limits this was to reconfigure the Database Wide Quota's. I set these to 5GB.

I then click on Recipient Configuration\Mailbox, selected one of the problem users and right clicked on them. I then chose New Local Move Request from the drop down.

From the New Local Move Request window I then pointed to the new Mailbox Database and clicked Next.

As I was sure some items in the user's mailbox were corrupt I clicked Skip the Corrupted Messages and set the value to 50. This ensured the move request would not completely fail should a few e-mails be corrupt. Click Next.

The move request completed, but with a warning that some items may not be moved if they are considered corrupt. I clicked Finish.

From the Exchange Management Shell I then used the following PowerShell command to check on the progress of the move request.

Get-MoveRequestStatistics “Username”

I then checked in the Event Logs to see if the Warnings had stopped, there was a number of errors relating to the move request. It advised a number of e-mails were considered corrupt and would not be moved.

I gave the move request about 10 minutes to complete and I used the Move Request section inside the Exchange Management Console to view the details of the move itself. 

I right clicked on the Move Request and selected Properties and this confirmed the move had completed, with 6 corrupt messages. This particular mailbox had 30,000 e-mails so I thought 6 was not a bad result.

I asked the user to reset their device and try again and it worked as excepted.