Seems to me Like it was a group Policy Issue. Someone ahs Applied a "deny" Log on locally GP to the Everyone group. Having a second backup admin account would Help as the everyone group means everyone. Never use deny and everyone in a gp or security option.
Only Real Solution was in the end to Backup Data and Exchange and Load SBS from Scratch.
I wouldnt mind knowing the way around something like this. for future but for now I need to close the question.