Fix Exchange 2010 Event ID 1020: “Provided Valid Credentials, but Is Not Authorized”

Exchange Server 2010 administrators often run into this error:

The account 'Domain\Administrator' provided valid credentials, but is not authorized to use the server; failing authentication.
Event ID: 1020

What It Means

The account is missing permissions on the receive connector. Specifically, it doesn’t have the ms-Exch-SMTP-Submit right on the Hub Transport or Edge Transport server that hosts the receive connector, even though it may be allowed to use that connector for inbound messages.

Receive connectors are assigned predefined permission groups, which grant sets of permissions to users, computers, and security groups. Those groups determine who can submit messages through the connector. In Exchange 2010 the predefined permission groups can’t be modified and you can’t create new ones, so the fix is to grant the right directly.

How to Fix It

Open the Exchange Management Shell and list your receive connectors, noting the identity of the one on the affected server:

Get-ReceiveConnector

Check the user’s current permissions on that connector:

Get-ReceiveConnector -Identity "SERVERNAME\Default SERVERNAME" | Get-ADPermission -User UsernameHere | Format-Table -View User

Grant the submit permission:

Add-ADPermission -Identity "Default SERVERNAME" -User Username -ExtendedRights ms-Exch-SMTP-Submit

If that doesn’t solve it, use the Exchange troubleshooting tools available from the Exchange Management Console to dig further.