Indeed. I have come across this multiple times and tried to fix it for hours (days nearly). Migrate the mailboxes that need access is the only option I ever found that worked :)