Topic Last Modified: 2008-12-17

This topic describes how to resolve a problem that occurs when the Microsoft Exchange System Attendant service does not start on a computer that is running Microsoft Exchange Server 2007. To resolve this problem, you must use the ADSI Edit tool to modify the permissions on the Schema partition.

This issue may occur when the Schema partition has incorrect permissions for the Authenticated Users group.


To resolve this issue, follow these steps:

  1. Start the ADSI Edit tool. To do this, click Start, click Run, type adsiedit.msc, and then click OK.

    By default, the ADSI Edit tool is installed in Windows Server 2008. In Windows Server 2003, the ADSI Edit tool is included with the Windows Support Tools. To install the Windows Support Tools, double-click Supptools.msi in the Support\Tools folder on the Windows Server 2003 CD.
  2. Connect to a domain controller. To do this, follow these steps:

    1. Click ADSI Edit in the navigation pane.

    2. In the Actions pane, click More Actions, and then click Connect to.

    3. In the Connection Settings dialog box, click Select a well known Naming Context, click Configuration in the Select a well known Naming Context list, and then click OK.

  3. Expand the following path:

    • Configuration [<domainController>]

    • CN=Configuration,DC=contoso,DC=com

    • CN=Partitions

  4. In the details pane, right-click CN=Enterprise Schema, and then click Properties.

  5. Click the Security tab, and then click Authenticated Users.

  6. Configure the following permission settings:

    Permission entry Permission option



    List contents


    Read all properties


    Read permissions


    To configure these settings, follow these steps:

    1. Click to clear all the check boxes.

    2. Click to select the Read check box in the Allow column.

    3. Click Advanced.

    4. In the Permission entries list, click Authenticated Users, and then click Edit.

    5. Click to clear all the check boxes, and then click to select the following check boxes:

      List contents: Allow

      Read all properties: Allow

      Read permissions: Allow

    6. Click OK three times.

  7. Exit the ADSI Edit tool.