Offline Address Book (OAB) Download problem in Fresh Exchange Environment

Question: Issue while downloading Offline Address Book (OAB) in a Fresh Exchange Environment.

Answer:
Below is the solution which applies to both Exchange 2007 and 2010. 

    1.  Access Active Directory server and proceed to following path:
        Start :: Run :: Adsiedit.msc .

    2.  Right click on Adsi Edit and select Connect to. From the drop down list choose Configuration. Go to the following path:
        Configuration :: Services :: Microsoft Exchange :: First  Organization :: Address Lists Container.
 
    3.  Right click on Offline Address Lists and select Security tab. 

   

 4.  The container "CN=Offline Address Lists" by default has Deny permission for the HC-created security group "AllHostedDomainsCombinedDL". Because of that all HC-created mailboxes have Deny permission on all OABs created by HC. This will create a problem as mailbox users are more able to download their respective OAB using Outlook 2007/2010 clients. 

 5.  Remove the security group "AllHostedDomainsCombinedDL" from the container "CN=Offline Address Lists", and all OABs created till that time. Now, the user will no more face the problem of Deny permission on OABs. 













 

    6.  This invalid permission applies when HC runs one of the Powershell command, included in the Address List Segregation document by Microsoft, at the time when HC mail domain was created initially. This command applies Deny permission on root Address List container "CN=Address Lists Container", from where this permission propagates to child containers including "CN=Offline Address Lists".