This access control list is not in canonical form / Exchange 2019 CU 12 - General Questions

RE: This access control list is not in canonical form / Exchange 2019 CU 12

bogdan_k — Tue, 20 Sep 2022 06:10:17 +0000

The issue will be fixed in the next release without the need to remove the deny permissions. There is already a pull request for this issue: https://github.com/FuseCP/SolidCP/issues/2

Best regards

Bogdan

RE: This access control list is not in canonical form / Exchange 2019 CU 12

rickstinson — Fri, 19 Aug 2022 19:42:42 +0000

Hi,

there are no deny rules for the exchange subsystem nor in the root of the ad domain.
The only to two deny rules at root level were "Exchange Windows Permissions" and "Exchange Server".

Both added with CU12

i also deleted this two rules at root level and everyhing is working again.
But this should not be a final solution, its more a bad workaround.

i will investigate this with the next CU 13 further..

RE: This access control list is not in canonical form / Exchange 2019 CU 12

gflex — Wed, 17 Aug 2022 21:43:09 +0000

@rickstinson

Check if Exchange subsystem has any deny rules on the customer OU. If they do remove it and it will work

RE: This access control list is not in canonical form / Exchange 2019 CU 12

rickstinson — Wed, 17 Aug 2022 12:32:28 +0000

attached our "customer" OU.

On root level i see only two deny rules (exchange windows permissions + exchange servers).

136

This access control list is not in canonical form / Exchange 2019 CU 12

rickstinson — Wed, 17 Aug 2022 12:09:19 +0000

Hi...

since upgrading to CU12 my favorite error "This access control list is not in canonical form" is back again.
Deleting the deny rule for the exchange sub system doesnt helped this time.

any ideas about this?

i googled a lot, but cant identify what is not "canonical"...

Thanks for any help!
Patrick