We had incorrect acl permissions on the domain admin account. In our case FullAccess was denied on the top entry of the acl permissions. Further down there was also a correct entry with the necessary permissions. I had to remove the top acl entry from the account acls.
- get-mailboxPermission | FL
- enter domain account
remove the faulty acl permission with cmdlet: Remove-mailboxpermission Account -user domain\Account -AccessRights FullAccess -deny:$true