Access denied when you try to give user “send-as” or “receive as” permission for a Distribution Group in Exchange Server

To work around this issue, add the “modify permissions” permission for the Exchange Trusted Subsystem to the organizational unit (OU) that contains the Distribution Group. To do this, follow these steps: (One must connect to the DC that handles the email [the exchange server itself or a dedicated DC])

1. Open Active Directory Users and Computers.
2. Select View > Advanced Features.
3. Right-click the OU that contains the distribution lists, and then select Properties.
4. Select Security > Advanced.
5. Select Permissions > Add.
6. In the Permissions Entry for <OU NAME> window, select Select a principal.
7. In the Enter object name to select box, type Exchange Trusted Subsystem, and then select OK.

   Note: If Exchange Server is installed in a domain other than this Organizational Unit’s domain, Exchange Trusted Subsystem may not be found in the current domain. It will be necessary to change the From this location setting to the domain in which Exchange is installed.

8. In the Permissions Entry for <OU NAME> window, change the Applies to value to Descendant Group objects.
9. To clear all permission selections that have been added by default, scroll to the bottom of the window and select Clear all.
10. In the Permissions section of the window, select Modify permissions.
11. To apply the permission and close all windows, select OK three times.
12. Verify at the end the inheritance of permissions.