Missing Users in GAL on Exchange 2007

Sorry,

Last command should be :

Get-GlobalAddressList | Update-GlobalAddressList

Get-GlobalAddressList | fl *Filter returned the following:

RecipientFilter            :
LdapRecipientFilter        : (& (mailnickname=*) (| (&(objectCategory=person)(objectClass=user)(!(homeMDB=*))(!(msExchHomeServerName=*)))(&(objectCategory=person)(objectClass=user)(|(homeMDB=*)(msExchHomeServerName=*)))(&(objectCategory=person)(objectClass=contact))(objectCategory=group)(objectCategory=publicFolder)(objectCategory=msExchDynamicDistributionList) ))
LastUpdatedRecipientFilter :

Then when I ran Get-GlobalAddressList | Update-GlobalAddressList I got the following warning:

GlobalAddressList
WARNING: The recipient "spiegelhoffs.com/Microsoft Exchange System
Objects/Offline Address Book - \/o=Spiegelhoff\/cn=addrlists\/cn=oabs\/cn=De"
is invalid and could not be updated.
WARNING: The recipient "spiegelhoffs.com/Microsoft Exchange System
Objects/Offline Address Book - First Administrative Group" is invalid and could
 not be updated.
WARNING: The recipient "spiegelhoffs.com/Microsoft Exchange System
Objects/Schedule+ Free Busy Information - First Administrative Group" is
invalid and could not be updated.
WARNING: The recipient "spiegelhoffs.com/Microsoft Exchange System Objects/OAB
Version 2" is invalid and could not be updated.
WARNING: The recipient "spiegelhoffs.com/Microsoft Exchange System Objects/OAB
Version 3a" is invalid and could not be updated.

That doesn't look good to me. So this is the Default Global Address List entry?

Can you run Get-GlobalAddressList | fl Id* for me, and clarify it is the "Default" global address list. If it's the only set of results returned then it must be.

Doesn't sound at all good to me. When did this happen? Any history prior to this happening?

Shaun

Get-GlobalAddressList | fl Id* returned the following:

Identity : \Default Global Address List

I only ever had the default GAL, I never created any others.  There is nothing out of the ordinary that I can tell.  This started about a week ago when a user said someone was missing from the GAL.  I can still send emails to these users, it is just when you hit the To: button they are not showing up.  I didn't notice it because I never click on the To: button to use the GAL, I just type in the names and choose from the dropdown it gives me in Outlook.  Thanks for you help thus far.

Is Exchange running on a DC with global catalog? If not, is communication to the DC ok?

Can you go to Exchange Management Console --> Toolbox --> ExBPA (Best Practices Analyser) and run a Health check

Also, does the event viewer App log / sys log show anything unusual?

Do you have any Exchange related third party software? AV / Spam etc in the mix?

Report back findings.

Exchange is not running on a Domain Controller with a global catalog.  It is communicating with the Domain Controller.

I do not have any thrid party software running on exchange, no AV or SPAM.

The app log shows that on Tuesday of this week exchange lost communication with the DC, however that was due to a power failure on the DC and I have been having this problem long than that.

When I ran the Health check, I got a warning "Connection to Recipient Update Service domain controller failed" this failure is happening from a DC that I decomissioned a while ago.  It also ran the health check against an old Exchange 2003 server that was also long ago decomissioned.  It also warned me that I am running exchange on a VMWare computer.  Other than that, everything seems good.

When did you migrate from 2000/2003 to 2007? Does the time tally with this issue?

Please read: http://msexchangeteam.com/archive/2006/10/02/429053.aspx

Shaun

We have been running Exchange 2007 for at least 6 months if not more.  The problems just started a little over a week ago, so I don't believe that they have anything to do with one another.  

Any problems during the migration?

Can you run dcdiag netdiag routines, make sure there is no comms problems with the DC.

Also, does Test-ServiceHealth - make sure all services are up and running.

The part here that is concerning is that the Recipient filter results for your Default GAL are non-standard. That's why I ask about the migration, and if any problems?

Shaun

This is what I got when I ran dcdiag /s:dc-01

Directory Server Diagnosis

Performing initial setup:
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\DC-01
      Starting test: Connectivity
         ......................... DC-01 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\DC-01
      Starting test: Advertising
         ......................... DC-01 passed test Advertising
      Starting test: FrsEvent
         ......................... DC-01 passed test FrsEvent
      Starting test: DFSREvent
         ......................... DC-01 passed test DFSREvent
      Starting test: SysVolCheck
         ......................... DC-01 passed test SysVolCheck
      Starting test: KccEvent
         ......................... DC-01 passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... DC-01 passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... DC-01 passed test MachineAccount
      Starting test: NCSecDesc
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
            Replicating Directory Changes In Filtered Set
         access rights for the naming context:
         DC=ForestDnsZones,DC=spiegelhoffs,DC=com
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
            Replicating Directory Changes In Filtered Set
         access rights for the naming context:
         DC=DomainDnsZones,DC=spiegelhoffs,DC=com
         ......................... DC-01 failed test NCSecDesc
      Starting test: NetLogons
         ......................... DC-01 passed test NetLogons
      Starting test: ObjectsReplicated
         ......................... DC-01 passed test ObjectsReplicated
      Starting test: Replications
         ......................... DC-01 passed test Replications
      Starting test: RidManager
         ......................... DC-01 passed test RidManager
      Starting test: Services
         ......................... DC-01 passed test Services
      Starting test: SystemLog
         An Error Event occurred.  EventID: 0x0000165B
            Time Generated: 09/03/2009   13:59:28
            Event String:
            The session setup from computer 'WKST-2430-GR-01' failed because the
 security database does not contain a trust account 'WKST-2430-GR-01$' reference
d by the specified computer.
         An Error Event occurred.  EventID: 0x000016AD
            Time Generated: 09/03/2009   14:03:32
            Event String:
            The session setup from the computer WKST-2430-GR-01 failed to authen
ticate. The following error occurred:
         ......................... DC-01 failed test SystemLog
      Starting test: VerifyReferences
         ......................... DC-01 passed test VerifyReferences


   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : spiegelhoffs
      Starting test: CheckSDRefDom
         ......................... spiegelhoffs passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... spiegelhoffs passed test CrossRefValidation

   Running enterprise tests on : spiegelhoffs.com
      Starting test: LocatorCheck
         ......................... spiegelhoffs.com passed test LocatorCheck
      Starting test: Intersite
         ......................... spiegelhoffs.com passed test Intersite

Here is what I got when I ran Test-ServiceHealth

Role          RequiredServicesRunning ServicesRunning        ServicesNotRunning
----          ----------------------- ---------------        ------------------
Mailbox       True                    IISAdmin
                                      MSExchangeADTopology
                                      MSExchangeIS
                                      MSExchangeMailboxAssis
                                      tants
                                      MSExchangeMailSubmissi
                                      on
                                      MSExchangeRepl
                                      MSExchangeSA
                                      MSExchangeSearch
                                      MSExchangeServiceHost
                                      MSExchangeTransportLog
                                      Search
                                      MSFTESQL-Exchange
                                      W3Svc
Client Access True                    IISAdmin
                                      MSExchangeADTopology
                                      MSExchangeFDS
                                      MSExchangeServiceHost
                                      W3Svc
Hub Transport True                    MSExchangeADTopology
                                      MSExchangeEdgeSync
                                      MSExchangeTransport
                                      MSExchangeTransportLog
                                      Search

No problems with the migration as far as I could tell.  Everything went off without a hitch.

What is netdiag?  Where do I run it?  I ran it from both the command line and from Exchange Management Shell and did not work at either.

http://www.microsoft.com/downloads/details.aspx?FamilyID=1EA70814-7E6C-46E5-8C8C-3C439A732E9F&displaylang=en

Shaun

The page says windows 2000, will it run on windows 2008?

Sorry, its not supported in 2008.

Did you do anything with the Default Global address list when you migrated from E2003 to E2007? It just doesn't look right to me:

Review this article here:

http://blogs.technet.com/msukucc/archive/2009/02/23/recipients-list.aspx

Particularly at the very bottom:

Address Lists Common Issues

A couple of common issues that you may experience are, either you are unable to edit an address list properties, or changes you have done on an address list don't show up when you see them.

On the first issue if address lists have been created using Exchange Server 2003 they must be upgraded in order to be able to modify them using Exchange Management Console. This is due to the fact that Exchange Server 2007 uses OPATH filters based on the Exchange Management Shell instead of using LDAP filters as in Exchange Server 2003. In order to have a list of the address lists which should be upgraded you may use Get-AddressList | Format-List Name,*RecipientFilter*,ExchangeVersion or Get-GlobalAddressList | Format-List Name,*RecipientFilter*,ExchangeVersion  Exchange Management Shell cmdlets. If one of the below conditions occurs you will have to upgrade the Address Lists:

LDAPRecipientFilter: Populated but RecipientFilter is empty (Exchange Server 2003 doesn't populate RecipientFilter);
RecipientFilterType: Legacy;
ExchangeVersion: 0.0 (6.5.6500.0)
At least three of the basic Address Lists can be corrected using pre-canned filters:

Set-AddressList "All Users" -IncludedRecipients MailboxUsers
Set-AddressList "All Groups" -IncludedRecipients MailGroups
Set-AddressList "All Contacts" -IncludedRecipients MailContacts
Others may need custom filters (Public Folders and Global Address List)

Set-AddressList "Public Folders" -RecipientFilter { RecipientType -eq 'PublicFolder' }
Set-GlobalAddressList "Default Global Address List" -RecipientFilter {(Alias -ne $null -and (ObjectClass -eq 'user' -or ObjectClass -eq 'contact' -or ObjectClass -eq 'msExchSystemMailbox' -or ObjectClass -eq 'msExchDynamicDistributionList' -or ObjectClass -eq 'group' -or ObjectClass -eq 'publicFolder'))}
On the second issue since Exchange Server 2007 has no Recipient Update Service, the address lists must be manually updated if you experience the described issue, using Exchange Management Console or the Exchange Management Shell cmdlet Update-AddressList. If that still doesn't work and in order to troubleshoot issues related to the Recipient Update Service API you may enable diagnostic logging of the Recipient Update Service API using the cmdlets Get-EventLogLevel MSExchangeAL and Set-EventLogLevel.


Can you enable the logging as described.

Shaun

I did not do anything to the Default GAL when I upgraded from 2003 to 2007.  Am I supposed to cut and paste the cmdlet

Set-GlobalAddressList "Default Global Address List" -RecipientFilter {(Alias -ne $null -and (ObjectClass -eq 'user' -or ObjectClass -eq 'contact' -or ObjectClass -eq 'msExchSystemMailbox' -or ObjectClass -eq 'msExchDynamicDistributionList' -or ObjectClass -eq 'group' -or ObjectClass -eq 'publicFolder'))}

from your last posting and run it on Exchange or did I need to do something else first?

Yes, the cmdlet references generic object types that are native to all all Mailbox servers, so it should be fine to run this command.

Shaun

I ran the cmdlet

Set-GlobalAddressList "DefaultGlobal Address List" -RecipientFilter {(Alias -ne $null -and (ObjectClass -eq 'user' -or ObjectClass -eq 'contact' -or ObjectClass -eq 'msExchSystemMailbox' -or
 ObjectClass -eq 'msExchDynamicDistributionList' -or ObjectClass -eq 'group' -or
 ObjectClass -eq 'publicFolder'))}

and got the follow which I answered yes to.

Confirm
To save changes on object "Default Global Address List", the object must be
upgraded to the current Exchange version. After the upgrade, this object cannot
 be managed by a previous version of Exchange System Manager. Do you want to
continue to upgrade and save the object?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help
(default is "Y"):

Do I need to do anything else or should I be able to check and see if user are showing up now.  I really do appreciate all of your help.

The users are not showing up in the Global Address List, but they are now showing up under All Users (which they weren't doing before).  So we have fixed part of it but not all of it.  Thanks for your help so far.  At least this is a crutch that can get them by.

Is the GAL ok on OWA now?

Shaun

Yes it is working on OWA and also on the Global Address List in Outlook.  I just needed to regenereate the Offline Address Book so I could see Global Address List in Outlook.  Thanks for all of you help, I would not have been able to figure this out without it.