[ActiveDir] AD object (User accounts) Permissions dissappearing

[Danny]

Environment: Windows Server 2003 R2 and 2000 mixed AD forest with Exchange Server 2003 SP2 and one BES (Blackberry Enterprise Server) server.

Scenario: Existing AD account with full Exchange mailbox and provisioned BES user. Out of the blue the user is unable to send from their BlackBerry. Permissions are checked in ADUC, and the required SendAs permission granted to the BES account have disappeared. This has happened to new and existing users.

I do not know where to start. I am reviewing a dcdiag /e /v to see if there are any potentially related problems.

Thanks,

...D