Mailbox or Public Folder List for Scheduled/Manual Scans is Empty or Incomplete When Symantec Mail Security for Microsoft Exchange (SMSMSE) Service Account Does not have Appropriate Permissions
search cancel

Mailbox or Public Folder List for Scheduled/Manual Scans is Empty or Incomplete When Symantec Mail Security for Microsoft Exchange (SMSMSE) Service Account Does not have Appropriate Permissions

book

Article ID: 152129

calendar_today

Updated On:

Products

Mail Security for Microsoft Exchange

Issue/Introduction

SMSMSE is installed on an Exchange 2010 mailbox server. A scheduled or manual scan is created or edited.  However the list of mailboxes to select is empty. 

Perform the following steps to verify that the public folders are empty:

1. Log into the Symantec Mail Security for Exchange (SMSMSE) adminstration console.
2. Click on the Scans tab.
3. Perform the following steps to configure a manual scan:

a. Click on Views|Manual Scan.
b. Click on Tasks|Edit manual Scan...
c. Click the Next button.
d. Validate that there are no mailboxes listed in the Mailboxes section of the dialog box.

4. Perform the following steps to configure a scheduled scan:

a. Click on Views|Scheduled Scans.
b. Click on either Tasks|New scan... or Tasks|Edit Scan....
c. Enter a name for the scan if appropriate then click the Next button.
d. Validate that there are no mailboxes listed in the Mailboxes section of the dialog box.

 

Cause

SMSMSE service account does not have the rights to build a list of mailboxes on the Exchange 2010 Mailbox role server or the appropriate assemblies are not registered correctly

Resolution

The SMSMSE Service account should already be a member of the "SMSMSE Admins" active directory group. You will need to ensure that "Organization management" or "View-only Organization Management" rights are assigned to this account also:

To verify the account the SMSMSE service is using

  1. Open the services console (Start -> Run, type services.msc, click Ok).
  2. Locate the "Symantec Mail Security for Microsoft Exchange" service, right click, and select Properties
  3. Select the Log On tab
  4. Make a note of the domain account entered under the This account: field (referred to from this point as 'service account')


To assign the appropriate permissions to the service account

  1. Open Active Directory Users and Computers (Start -> Administrative tools -> Active Directory Users and Computers)
  2. In the console tree expand <your domain>, then select Users.
  3. Locate the 'service account' you verified earlier, right click and select Properties.
  4. Select the Member Of tab, and click Add...
  5. In the 'Enter the object names to select' field type Organization Management, then click Check Names (Organization management should now be underlined), then click Ok.
  6. Click Apply then click Ok.


To apply the changes made to permissions to the SMSMSE service

  1. Open the services console (Start -> Run, type services.msc, click Ok).
  2. Locate the "Symantec Mail Security for Microsoft Exchange" service, right click, and select Restart


After completing these steps, check to determine if you can now see your mailboxes listed in the "Scan location" tree.

If you see this issue even with the appropriate permissions assigned to the SMSMSE user account, verify that a list of mailboxes is stored in:
C:\Program Files(x86)\Symantec\SMSMSE\6.5\Server\Config\master.mb (open with notepad).
There should be entries for each mailbox, one per line, that look similar to the following:
[email protected];S-1-5-21-1449310211-615098520-2967644832-500

If there are still no entries in this file, there may be a corruption problem with the existing service account. This can be verified in the security event log. In this instance, you will need to create a new Service Account and assign the appropriate permissions and group memberships.

If the issue persists, you may need to verify .NET registration of SMSMSE components as follows:

  1. Navigate to C:\Windows\System32, right click cmd.exe, and select Run as administrator 
  2. Run the command cd C:\Windows\Microsoft.NET\Framework64\v2.0.50727 
  3. Register the EWS assembly by typing

    Regasm.exe /tlb "<Installdrive>:\Program Files (x86)\Symantec\SMSMSE\<version>\Server\Symantec.MailSecurity.EWS.Client.dll" "<Installdrive>:\Program Files (x86)\Symantec\SMSMSE\<version>\Server\Symantec.MailSecurity.EWS.Client.tlb"

    then press Enter.

    NOTE:
    Change the value of <Installdrive> & <version> to the appropriate drive and version of SMSMSE installed. The following is an example for SMSMSE 7.5 on 64-bit OS:

    Regasm.exe /tlb "C:\Program Files (x86)\Symantec\SMSMSE\7.5\Server\Symantec.MailSecurity.EWS.Client.dll" "C:\Program Files (x86)\Symantec\SMSMSE\7.5\Server\Symantec.MailSecurity.EWS.Client.tlb"
     
  4. Register the EMSstoreAccess assembly by typing

    Regasm.exe /tlb "<Installdrive>:\Program Files (x86)\Symantec\SMSMSE\<version>\Server\EMSStoreAccess.dll" "<Installdrive>:\Program Files (x86)\Symantec\SMSMSE\<version>\Server\EMSStoreAccess.tlb"

    then press Enter.

    NOTE:
    Change the value of <Installdrive> & <version> to the appropriate drive and version of SMSMSE installed. The following is an example for SMSMSE 7.5 on 64-bit OS:

    Regasm.exe /tlb "C:\Program Files (x86)\Symantec\SMSMSE\7.5\Server\EMSStoreAccess.dll" "C:\Program Files (x86)\Symantec\SMSMSE\7.5\Server\EMSStoreAccess.tlb"
     
  5. Restart the Symantec Mail Security for Microsoft Exchange service.