f1tech, thank you for posting the dsacls command. Prior to this we could not get BES to send on behalf of the Domain Admin enabled accouts even though we explicitly enabled the send-as rights on the adminSDholder container per the shovelware knowledge base article (can you say 'Prep for MS Activesync 2007?'). Let me say that my chest hurts from the classic strong-arm tactics by Microsoft and the massive arch changes under the guise of security changes. Keep up the good work admin-base and please Microsoft continue to dictate end-luser policy as you see fit; perhaps this is the new "Trustworthy Computing" model we heard about so long ago. Meanwhile, I eagerly await the next unholy incarnation of "Typical Tuesday".