The first time that a user tries to synchronize an EAS device, the Microsoft Exchange Server tries to create a container of the type msExchActiveSyncDevices under the user object in Active Directory Domain Services (AD DS). The Exchange Server then tries to change permissions on the container.
By default, the Exchange Server group has rights to Create and Delete msExchActiveSyncDevices objects. However, the Exchange Server group does not have rights to change permissions on msExchActiveSyncDevices. Instead, the rights are inherited from the Owner Rights security principal. By default, the Owner Rights security principal has Full Control permissions
usually this should be resolved by following KB http://support.microsoft.com/kb/2579075
in some cases the above KB article doesn't solve the issue so we have to add the permissions at a higher level using dsacls as below
in my case I found the below permissions missing
Domain Name\Exchange Servers SPECIAL ACCESS for msExchActiveSyncDevices <Inherited from parent>
CREATE CHILD
DELETE CHILD
LIST CONTENTS
Dsacls “dc=contoso,dc=com” /I:S /G “Contoso\exchange servers:CCDC;msexchActiveSyncDevices;user”
Dsacls “dc=contoso,dc=com” /I:S /G “Contoso\exchange servers:LC;;user”
after that the user should be able to sync his mobile