Possible Bug - Manage Full Access Permissions GUI - Exchange 2010
I think I have found a bug, or something is messed up with the Exchange console on all of my Exchange 2010 servers. I right click a mailbox in the management console GUI, and select "Manage Full Access Permissions", I then click the "Add " button. THe Select User or Group box comes up, and starts loading AD objects, however, the Search box at the top does not work. I have to wait until all objects are loaded until I can find the user I am looking for. Sometimes, it's even faster to scroll down if I am looking for a security group to add. This was NOT the case in Exchange 2007, and I could easily just search and add somebody as soon as the box came up. This also happens when you try to manage "Send-As Permissions." For, now I have resorted to using the Exchange shell since it is quicker, but can anyone else confirm this bug? It may not be as bad for a small domain, but our domain has 150,000+ users, tons of groups, and 4,500 mailboxes. Exchange 2010 SP1 (no rollup 1 installed yet)
November 29th, 2010 9:24am

I have found it very slow and clunky as well. I typically set the recipient scope to the OU I need to pick the account from and that speeds it up. ( rather than having it scoped to the entire forest)
Free Windows Admin Tool Kit Click here and download it now
November 29th, 2010 9:37am

Yeah, I tried setting it at the OU/Container level, but with 100,000 plus users in the Users container it still takes far to long. And I am not going to start moving users to a blank OU in order to speed up the process, only to move them back to the Users container after I am done.
November 29th, 2010 9:41am

I set the Maximum Number of Recipients to disply to 1, so the serch filter option comes up immediately. Just wish it would let you choose what you want the default filter property and condition to be. How often do you search on "ActiveSync Mailbox Policy"?[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "
Free Windows Admin Tool Kit Click here and download it now
November 29th, 2010 9:53am

That didn't help me. It's not how long the search option comes up, its the fact it won't show you your search results, even when I have the filter property set to 1 in the console. I went over to a test lab we have set up wtih Exchange 2010, and the same thing is happening in that test domain, so just looks like a bug that I can confirm. Exchange 2007 didn't have this problem. Both my production, and test lab for Exchange 2010 are on SP1. So I can't verify if it was working properly before SP1 was installed.
November 29th, 2010 10:01am

Hi LE2Strat, I am using the exchange 2010 sp1, and everything seems work well. I could use search bar to search the account what I want to. Regards! GavinPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
December 1st, 2010 6:08am

How big of a domain there Gavin? If I switch it to an OU with only 100 or so objects, it works fast as expected. I just noticed though, the problem is not present on other sections of the MMC where the same search feature is used. For example: If I right click a mailbox and select properties and go to the Mail Flow Settings Tab, and select Delivery Options, if I use the browse feature on the Forwarding address section, or set the send on behalf of permission with the Add button, it works just fine. Very fast like in Exchange 2007. It only appears to be happening in the main MMC, when you right click a mailbox and try to set Full Access or Send-As permissions from there. Testing some more, the more users you have, the more slow and sluggy it becomes. I started with a blank OU and added one user and set the filter to that OU. Very quick. Scripted the creation of 50 users, still somewhat quick. Added 1,000 users. Starts to get a little slow. 5,000 users, 25-30 seconds. 10,000 users even longer.
December 1st, 2010 10:24am

Hi LE2Strat, May be you are right :), sure, I have not a domain as large as yours. If so,I would use a powerful box or do some develop to change the concole search feature, or use EMS. Or you could open a ticket from MS. Regards! GavinPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
December 1st, 2010 10:23pm

I am having this same issue. The "Select User or Group" picker is extremely slow when trying to assign permissions to existing mailboxes or resources. Exch2010 SP1 Rollup2 I am wondering if this may be related to slow GC performance and/or network latency.
January 26th, 2011 2:33pm

I would say it could be Kirk related to GC performance, but in my test lab enviroment I have set up...there is NO activity at all on it's network, and it's still slow as garbage. I have got adapted to doing things via the SHELL, but would like to see the GUI issue to be fixed because sometimes it's just quicker. We are still on SP1 (no rollups) in production, and I did go to Rollup 2 in our test lab to see if it helped, but nope, same issue, and you have confirmed. Microsoft, FIX!
Free Windows Admin Tool Kit Click here and download it now
January 26th, 2011 2:36pm

Definitely something wrong... we have 6 DC/GCs in the site, so any queries should not be slow. I wonder if this is related to being in a multi-domain forest ? I had 25,000+ mailboxes in an Exchange2007 environment, and the picker was always extremely fast, and you could hit STOP and then start typing and it would find it instantly. It's unusable in Exch2010.
January 26th, 2011 3:58pm

Our production enviroment is multi-domain, but our test lab enviroment is a single domain, and it has the problem as well. Yeah, it was fine in Exchange 2007. Something is a miss with 2010.
Free Windows Admin Tool Kit Click here and download it now
January 27th, 2011 9:46am

I think this may be related to IPV6 not being disabled correctly on the Exhange servers and all the DCs. Do you have IPV6 enabled/disabled in your environments ? Can't just disable IPV6 by unchecking on the NIC properties. There's also a registry key that needs to be configured. In my "problem" environment, this has not yet been done. only the NIC props were unchecked on both the Exchange servers and all the DCs. http://msmvps.com/blogs/acefekay/archive/2010/05/27/how-to-disable-rss-tcp-chimney-feature-and-ipv6.aspx Uncheck IPv6 in NIC properties Uncheck the two LinkLayer Topology Discovery components Then follow the registry changes procedure below to completely disable IPv6. 1. Navigate to: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters] 2. In the details pane, click New, and then click DWORD (32-bit) Value. 3. Type in DisabledComponents , and then press ENTER. 4. Double-click DisabledComponents, 5. Type ffffffff in Hexadecimal. 6. It should like this when completed: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters] "DisabledComponents"=dword:ffffffff
February 2nd, 2011 1:04pm

Thanks for the suggestion Kirk. We have IPV6 enabled, although no configured. Just using the address the server auto generates I don't want to be disabling IPV6 as we are starting to roll it out in our enviroment this spring/summer. To test though, I did disable IPV6 as listed above in our test lab enviroment. It made no difference at all. Same issue.
Free Windows Admin Tool Kit Click here and download it now
February 2nd, 2011 1:11pm

Thanks for the suggestion Kirk. We have IPV6 enabled, although no configured. Just using the address the server auto generates I don't want to be disabling IPV6 as we are starting to roll it out in our enviroment this spring/summer.
February 2nd, 2011 1:11pm

Are your powershell sessions slow too ? I run a get-mailbox and it takes 26 seconds to complete the command. There are only 443 mailboxes. That command should take about 3 seconds to rip through on a dual-quad 32Gb Exchange server.
Free Windows Admin Tool Kit Click here and download it now
February 3rd, 2011 11:18am

No, the Powershell sessions for my enviroment seem fine. We have over 3,000 mailboxes. Even if I change the -ResultSize to unlimited, it still goes pretty quick. Just the GUI is slow. Now I know with Exchange 2010, both the MMC and Exchange all run through the CAS servers. Our active mailbox server is dual quad core 48 GB in our DAG, but our CAS servers are dual duad core 12 GB (we have 3 of them in production, and 2 in our test lab) and it's slow no matter what CAS server I set GUI to run against. Our 2007 servers are still online (have our medical school that hasn't been migrated yet in or production enviroment). The 2007 servers are still fast as always. I really feel this is a bug.
February 4th, 2011 8:25am

I am seeing the same behaviour on our newly built Exchange 2010 SP 1 Rollup 2 servers. I have all roles cas/hub/mailbox on the same server and seeing the same slow behavior. As previously stated, the Manage Send-AS and Manage Full-Acces permissions are horribly slow. Functions fine in other GUI parts.
Free Windows Admin Tool Kit Click here and download it now
February 11th, 2011 3:51pm

Right on Lance. Just hoping somebody at Microsoft takes notice of this thread.
February 11th, 2011 3:53pm

I have the same problem with our environment of around 20,000 mailboxes. I must use Powershell to add Send As and Full Access permissions to any/all mailboxes as required. I can *remove* those permissions using the GUI, however. When I try to add permissions to users/groups through the GUI, the list just populates until it simply runs out of steam. Clicking Stop and then searching for a user does not work. This did work with Exchange 2007. I have disabled IPv6 using only the checkbox in the Networking properties for the NICs on all Exchange servers; I haven't done "complete" disable of IPv6 per the above comment.
Free Windows Admin Tool Kit Click here and download it now
March 3rd, 2011 12:06pm

It's not IPv6 Rblissitt, so its not even worth that route. I went through the complete way to humor myself and the problem is still there. We have had all of our DCs on 2008 R2 even back on Exchange 2007, never had the problem as well and the only thing that has changed is the version of Exchange. Strange it only happens on the main MMC recipient screen though when setting full access or send-as permissions. Everywhere else the picker is used, its normal.
March 9th, 2011 10:21pm

The issue has been noticed and being tracked by MSFT here. People Picker is extremely slow http://social.technet.microsoft.com/Forums/en/exchangesvradmin/thread/e85d02e3-17e5-45fe-8ecb-a42a4c206690James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com
Free Windows Admin Tool Kit Click here and download it now
March 10th, 2011 9:50am

We have issue here too, it is terrible, most aspects of 2010 are slow and doggy, if you write your own gui/code it's tons faster than microsoft code, even remote powershell is fast going over the virtual directory. Adding a full access permission is a joke, i've waited 30 minutes for the list to appear. pretty confident AD is okay. it is a bit frustrating, i mean, 2010 rtm clearly is not rtm, it's sp1 as manay program functions like rules and web services managed api only only work with sp1.
March 28th, 2011 6:31pm

Same issue here as well. Exchange 2010 SP1 RU3. It's pretty annoying.
Free Windows Admin Tool Kit Click here and download it now
May 5th, 2011 3:32pm

I'm seeing the same issue here ... Exchange 2010 SP1 RU3v3. Very Annoying. I've been using the shell to grant permissions ... just a pain that the console doesn't work well.
May 12th, 2011 10:31am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics