Verify/Add the ApplicationImpersonation Role

If the ApplicationImpersonation Role is missing, you will see these entries in the Scanmail_Master.log (Debug Mode)

[DEBUG] user UserName doesn't have this role ApplicationImpersonation
[DEBUG] [DEBUG] CheckDomainUserPrivilege Result: Not Pass

If the ApplicationImpersonation Role is present then you should see the following in the ScanMail_Master.log (Debug Mode)

[DEBUG] user UserName have this role ApplicationImpersonation
[DEBUG] [DEBUG] CheckDomainUserPrivilege Result: Pass

1. Open the Exchange Management Shell. Use the following command to list the groups and accounts that have the Application Impersonation Role:

   Get-ManagementRoleAssignment -Role "ApplicationImpersonation”

2. You should see the account used to run the ScanMail Master Service. If not, run the following command to add it:

   New-ManagementRoleAssignment -Name:SmexImpersonation -Role:ApplicationImpersonation -User:UserName

3. After running the command you need to restart the "ScanMail for Exchange Master Service".

You should also confirm if the "Exchange Servers" group has the ApplicationImpersonation privilege:

1. Run the following cmdlet and check for "Exchange Servers" group in the results:

   Get-ManagementRoleAssignment -Role "ApplicationImpersonation" -GetEffectiveUsers

2. If there are none, run the following cmdlet to add ApplicationImpersonation to "Exchange Servers":

   New-ManagementRoleAssignment -Role ApplicationImpersonation -SecurityGroup "Exchange Servers" -name "SmexImpersonate1"

Verify/Add the Organization Management Role

1. Open the Exchange Management Shell and run the following command:

   Get-RoleGroupMember "Organization Management"

2. You should see the account listed. If not, run the following command to add it:

   Add-RoleGroupMember "Organization Management" -Member UserName

3. After running the command, you need to restart the "ScanMail for Exchange Master Service".

This may also be done via the Exchange Administration Center:

1. Navigate to Permissions > Admin Roles.
2. In the Members section, click Add.
3. Select the user, click Add, and click OK.
4. Click Save to save the changes to the role group.
5. After adding the role you need to restart the "ScanMail for Exchange Master Service".

Verify SQL dbcreator Role

Open SQL Mgmt Studio, connect to the SMEX SQL server --> Security --> logins Verify the account has access to Database and that the dbcreator role is selected.

1. Open SQL Mgmt Studio
2. Connect to the SMEX SQL server > Security > logins.
3. Verify that the account has access to Database and that the dbcreator role is selected.

   

Verify Local Admin Rights on Exchange Server

If you have access to log on to the Exchange server, from a command line run the following:

net localgroup administrators

Verify Domain Admin Rights (if required)

If required, Domain Admin rights can be checked from a Domain Controller cmd prompt using the following command:

net group "Domain Admins"

Check Connection to the Exchange Database:

SMEX needs to get the mailbox database by running the following cmdlet from the Exchange Management Shell:

Get-MailboxDatabase -Server EXServer01