Unable to access mailbox: (403) Forbidden

[ekrayzman]

I'm trying to get Exchange Granular Restore working for my Exchange 2007 with Windows Server 2008 R2.
I'm trying all kinds of solutions for couple of weeks and still no working.
I've read numerous articles from Veeam forum dated 2010 and 2011 and everywhere Mr.Gostev was promising this to be working in the next version.
Well I'm on version 7 and now is 2013 and it seems it still not working.
although I watched one video on YouTube where somebody was able to access the mailbox, but please Mr.Gostev, just acknowledge that it is not working and nobody in Veeam knows how to setup it up. That will be fair for many Veeam users and I won't be wasting anymore of my time trying to set it up.

Details: I have an open case with Veeam support (Case # 00480331) and the latest your support could come along was with idea to add impersonation to my Exchange.
Well I already have done impersonation and it still not working.
I''m stuck at the mailbox sections of AIR wizard and the most I was able to get was Windows Security windows asking to enter mailbox credentials.
the only way I can get to this windows is by using the following user name: VCENTER\administrator in domain section.
Using option "Use the currently logged on account" doesn't even get me that far.
And I tried entering all kinds of variations of a user name to access mailbox and none of them works.

Articles I've used:
http://www.youtube.com/watch?v=sN9TFKIbPAw
http://www.veeam.com/kb1265
http://forums.veeam.com/viewtopic.php?f=2&t=6131
http://msdn.microsoft.com/en-us/library ... 80%29.aspx

Anybody knows how to move to the next step?

[foggy]

Eugene, just to make sure, have you granted full mailbox rights to administrator account on Exchange server prior running the backup job?

[ekrayzman]

Not a simple question for me. I will need to research that.
On another hand from reading Veeam article for full mailbox rights, it seems it needs to be done only for administrator who doesn't know users passwords and thus needs to use administrative one.
In my case I keep track of users passwords and I do not necessarily need to use administrative one.
Or may be you actually require to use the administrative account to restore emails from user's mailboxes?

[foggy]

No, user account should be enough. Please continue investigating the issue with support.

[ekrayzman]

First of all I 'd like to add that error 403 is coming from IIS to make it clear what this message is about.

There is a good article here describing everything that needs to be checked in order for granular restore to work: http://www.veeam.com/kb1265

It seems that after all, the most important part for me was the part number 3 from the KBA above - my WebDav is not setup.
And although OWA had to be working in order to do granular restore (https://mail.domain.com/owa), however the main point is to have another working link:
https://mail.domain.com/Exchange

In fact the IIS has to redirect Exchange to OWA folder.

Great thanks to 2nd tier of Veeam support who pointed to the right direction.
An articles which describes what needs to be done in great details is here:
http://community.spiceworks.com/how_to/ ... nvironment

I will keep you posted on my progress as so far the solution is not exactly where the previous similar forums were pointing me to...

[ekrayzman]

Did some more research:
Here is the definition of the /exchange folder. Basically, it appears that Veeam is trying to access OWA as though it is a 2003 mailbox.
Per Veeam support:
/*
It is quite common to have the CAS role and MBX role installed on the server as many of our users who are still on Exchange 2007 have a similar setup when using UAIR for Exchange so I'm not certain what limitation the article below is referring to. More importantly from that article is that the Client Access Server should redirect Exchange 2007 users to the /owa directory from /Exchange. This is so UAIR can access all mailboxes in a situation where an Exchange environment has a mixed collection of 2003 and 2007 mailboxes and so on.
*/
At this point it seems that I still need a tremendous amount of work to have done in order for Veeam granular restore to start working.

May be the finish line is not so far away but I am going to use the BackupAssist, which is cheap and easy to use right of the box with a granular restore using Explorer. No surebackup, no WebDav re-direction - just click restore button and select the appropriate mailbox. All that had to be done to make BackupAssist working was one cmdlet to allow impersonation for administrator.