Checking and setting Read Member Of permission for the Network Service account

Relevant Product: Signature Manager Exchange Edition

Scenario

When using Signature Manager Exchange Edition with a group specified in the policy, you observe that the Policy Tester is showing the correct behaviour. However, when an email message is sent, the membership of this group cannot be correctly identified, so the policy does not get applied.

Resolution

Ensure that the appropriate account has Read Member of permissions to the user object you are testing with; for example: Colin Smith. 

The step-by-step instructions below show an example with the Network service account:

1. Open Active Directory User and Computers. (dsa.msc).
   
   
2. From the View menu,  select Advanced Features:
   
   
   
   
3. Locate a problem user and open their Properties.
   
   
4. Select the Security tab, click Advanced then select the Effective Permissions tab.
   
   
5. Click Select and type NETWORK SERVICE account, then click OK.
   
   
6. Locate the permission Read Member of and confirm that the permission is present:
   
   
   
   If the Read Member of permission is not present against the NETWORK SERVICE account, then follow the next steps below:
   

   
   To apply the permission change to all users in an OU:

7. Right-click the OU and select Properties.
   
   
8. Select the Security tab, then click Advanced.
   
   
9. Click Add and type NETWORK SERVICE, then click OK.
   
   
10. Select the Properties tab and from the Apply to: drop-down list, select Descendant User objects:
    
    
11. Locate the permission Read Member of and tick the Allow check box:
    
    
    
    
12. Click OK until you return to Active Directory Users & Computers.
    
    
13. Repeat steps 1 to 5 above to confirm that NETWORK SERVICE now has the permission "Read Member of".