I got a solution from Blackberry support (cost me my complimentary incident which is annoying).
They told me to open tADUC and make sure Advanced Features was selected.
I then went to the OU where my BES users are and then right clicked on it and selected properties.
On the security tab I clicked on Advanced and then Add on the Advanced Security Settings window.
Once I chose the user the permission entry window opened. Using the Apply to drop down list I selected Descendant User Objects. From that I chose Send As. Clicking Apply and OK all the way back out apparently sets the permissions in the same was as the ESM command.
Apparently it is a known issue documented on Blackberrys site under KB article 21225 although I couldn't find it on a keyword search. Would be nice if they mentioned it in the readme or in the online documentation to save you using up the complimentary support call (or is that the idea - maybe I'm being cynical!)