Exchange 2003 to 2010 new forest migration 'bug' - replying to Outlook internal emails poisons NK2 file

I am just finishing up a migration to a new Exchange 2010 server, from an old 2003 system.  It wasn't a "normal" migration, actually -- I created a separate new forest and totally new mailboxes and then manually exported/imported PST files into each mailbox on the new Exchange 2010 server...

More important details:

The old 2003 server was an GC + Exchange 2003, for '' and also hosted email for a second ""... which was to become our NEW name/company re-brand... but we didn't have new servers yet, so we just hosted on the Exchange 2003 box in the mean time...

So we get new servers going finally, and set them up for the new forest as '' -- 2 servers: and as the GC.

We still want to get emails for (for legacy purposes) so I add that as a second accepted domain into Exchange 2010 and all seemed to be working...

Until someone "replies" to an old INTERNAL email (any internal email that was imported from the 2003 server), it somehow corrupts the outlook NK2 file and from that point forward, ALL INTERNAL emails bounce!  External SMTP still works, but ALL internal bounces... if I delete the Outlook NK2 file, it fixes the problem and users can send internal emails once again!

It seems like it's reading some sort of Active Directory attributes from the old emails.. or something.. I don't know enough at this point to further track down the problem and was hoping for some advice!.. here is the bounce error:

Delivery has failed to these recipients or groups:


The e-mail address you entered couldn't be found. Please check the recipient's e-mail address and try to resend the message. If the problem continues, please contact your helpdesk.

Diagnostic information for administrators:

Generating server:
#550 5.1.1 RESOLVER.ADR.ExRecipNotFound; not found ##

(^^^^^^^^^ it references the old domain here at the beginning of this line, then the new domain at the end???)

Original message headers:

Received: from
 ([fe80::900a:2390:8831:dbaa]) by
 ([fe80::900a:2390:8831:dbaa%10]) with mapi id 14.01.0270.001; Mon, 2 May 2011
 09:07:11 -0700
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: UserExample2 <>
To: 'UserExample1' <>
Subject: test
Thread-Topic: test
Thread-Index: AcwI4v7gNrIlpE8CSFCV9dh8kuyfXQ==
Date: Mon, 2 May 2011 09:07:10 -0700
Message-ID: <>
Accept-Language: en-US
Content-Language: en-US
X-MS-TNEF-Correlator: <>
MIME-Version: 1.0
X-Originating-IP: []

More potentially important info: I have a 2 way trust between the 2 forests, and I have DHCP set to assign Primary DNS as the newdomain DNS IP, and the Secondary DNS as the DNS IP.  The new servers are also configured with their secondary DNS set as the olddomain DNS server.  I wasn't planning on totally retiring the olddomain server for another couple weeks and wanted it online at the same time as the new system and have them talking to each other... but I am not sure if this is contributing to the problem or if it's just some weird active directory thing?

Who is Participating?
ckeshavConnect With a Mentor Sr. Infrastructure SpecialistCommented:
You can delete the cache for 1 or 2 users but not for all users.
After migrating any mailbox to your new server you need to add the X.500 address of the old organization as a secondary email ID in the new mailbox.
That would correct the problem

aconwayAuthor Commented:
UGH.. ok.. I am going to sleep on it and try to figure that out tomorrow with a fresh brain...

I tried adding in an X500 a few times, in different variations, but I think I'm not getting the syntax exactly right...  will try again tomorrow after sleep.
Shabarinath RamadasanInfrastructure ArchitectCommented:
At the time of moving mailbox from old domain to new domain, Did you manually stamped Legacy Exchagne DN of the old domain as an SMTP address in the new domain?

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

aconwayAuthor Commented:
I created fresh mailboxes on the new server...and added an SMTP address for the old domain to each user, yes... (then imported PST's manually, logged in as each user through Outlook).

Shabarinath RamadasanInfrastructure ArchitectCommented:
What I mentioned is the legacy exchange dn attribute which outlook uses by default while replying to old emails. See if you can get that value from old domain and add it on proxy address attribute on the users you created on the new domain.

Shabarinath RamadasanConnect With a Mentor Infrastructure ArchitectCommented:
To make you clear on LegacyExchagneDN attribute,

The Outlook client submit message by using recipient’s LegacyExchangeDN value. If you create a new message, the LegacyExchangeDN value is retrieved from Auto-Complete Entry, OAB or Gal. If you reply a message, the LegacyExchangeDN is retrieved from the message which you replied. Therefore, if the submitted recipient’s legacyExchangeDn cannot be found in AD user object, a NDR message will be generated indicated that the recipient does not exist. The issue can be caused by several factors. I suggest you check the following settings:

1) Whether the issue occurs sending a new message or replying an old message? If you reply a message, the MAPI property PR_SENDER_EMAIL_ADDRESS of the    original message is used to submitted the legacyExchangeDn. If the property is not matched the current legacyExchangeDN of the user in AD, the NDR message will be received.

2) If the issue also occurs when sending a new message, you need to check NK2 (Outlook Autocomplete) file, Offline Address Book files which will be used to submit the recipient’s LegacyExchangeDN. You can rename the NK2 file and have Outlook works in Online Mode to narrow down the issue.
aconwayAuthor Commented:
Whats the easiest way to find the correct DN?  ADSIedit on the old server for each user?  What am I looking for, exactly?
aconwayAuthor Commented:
Ok, I found "Distinguished Name" in ADSI edit:

CN=User Example1,OU=Users,DC=olddomain,DC=com

So I would set up an X500 "custom" address for the mailbox on Exchange 2010, and the input would be exactly that?

aconwayAuthor Commented:
Oh wait, I need LegacyExchangeDN.. I just found it.. working on it now...
Shabarinath RamadasanInfrastructure ArchitectCommented:
Yea.. You did it.

Hope this issue is fixed :)

aconwayAuthor Commented:
YES, I believe it is fixed!  That was it! Thanks so much for your guidance.  It totally makes sense now.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.