Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Problem connecting and creating AD account via Exchange 2010 new mailbox wizard

Posted on 2014-04-17
18
349 Views
Last Modified: 2014-04-22
We have Exchange 2010, when creating a known existing AD account(new user), populate all the fields and when clicking finish get the attached error. We have on AD DC and when I show FSMO, all point to this DC.

Where can I look to fix this problem?
Test-account-build-with-Exchange.png
0
Comment
Question by:Harold
  • 10
  • 7
18 Comments
 
LVL 15

Expert Comment

by:achaldave
ID: 40007480
Can you create account in AD first and create mailbox?

How many domain controllers do you have? do you see any other error on domain controllers' event logs or on exchange server's event logs?
0
 
LVL 36

Expert Comment

by:Mahesh
ID: 40007533
Check if your active directory replication is working
run dcdiag /v and post output here
Also run repadmin /showrepl and check if replication is successful

You need to make sure that every DC in domain can show same RID master server
Means you need to run netdom query fsmo command on every DC in domain for verification
You need to install 2003 SP2 support tools on 2003 domain controllers to get netdom utility
The above situation may occurs when AD unable to decide who has got originally RID master FSMO role

Check below workaround as well
http://support.microsoft.com/kb/2028216
http://support.microsoft.com/kb/822053
http://support.microsoft.com/kb/839879

Mahesh.
0
 
LVL 1

Author Comment

by:Harold
ID: 40007566
The reverse works, yes. We have to create AD account, the use Existing User.

1 DC...the other failed a couple months ago. Lot of replication errors about that in Event Viewer.
Where do I check in Exchange?
0
Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 1

Author Comment

by:Harold
ID: 40007601
I knew there were some issues with replication, as the secondary DC failed a couple months ago.

FSMO points to the current and only DC.

Schema owner                TSN-RAL-FILE01.tsn.corp

Domain role owner           TSN-RAL-FILE01.tsn.corp

PDC role                    TSN-RAL-FILE01.tsn.corp

RID pool manager            TSN-RAL-FILE01.tsn.corp

Infrastructure owner        TSN-RAL-FILE01.tsn.corp
showrepl.txt
dcdiag.txt
0
 
LVL 36

Accepted Solution

by:
Mahesh earned 300 total points
ID: 40007630
So you have only DC

Do metadata cleanup for failed DC with ntdsutil

http://support.microsoft.com/kb/216498

Also delete old domain controller stale records from below locations

DNS NS , SRV, Host (A) , PTR records, and CNAME record from _msdcs.domain.com zone
Server entry in AD sites and services
Server entry in domain controllers OU if exists
Server entry under domain.com\system\File replication services\domain system volume container

Then navigate to %systemroot%\system32 and locate netlogon.dns and rename it to netlogon.dnsold
restart netlogon service and then check if you are able to create new user with exchange mailbox

Mahesh.
0
 
LVL 1

Author Comment

by:Harold
ID: 40014657
Mahesh: thank you...I've started this process.

What is "Server entry in AD sites and services?"

Also get the following when I start to remove domain controller, should I just remove or something else first?
print01-DC-warning.png
0
 
LVL 36

Expert Comment

by:Mahesh
ID: 40014728
Under Ad sites and services you will find stale server object without referencing to anybody

You need to delete that as well.

Also  you can ignore warning and go ahead
0
 
LVL 1

Author Comment

by:Harold
ID: 40014767
Can't remove this here Ad sites and services.....following error
print01-DC-warning-2.png
0
 
LVL 1

Author Comment

by:Harold
ID: 40014775
I got it. Had to remove each object one at a time.
0
 
LVL 36

Expert Comment

by:Mahesh
ID: 40014806
If you receive a message that states the server is a container that contains other objects, verify that the appropriate decommissioning of services has completed before continuing.

If you receive a message that states the DSA object cannot be deleted, you may be attempting to delete an active domain controller.
http://support.microsoft.com/kb/216364

Just ensure 1st that Dc in the message is not on network and active.

Open adsiedit.msc, add default naming context there and check what else objects are dependent on that DC

if your DC is really already remove from network, use ntdsutil to cleanup metadata from active directory 1st as mentioned in KB article in earlier comment
http://support.microsoft.com/kb/216498

Mahesh
0
 
LVL 1

Author Comment

by:Harold
ID: 40014813
Now I'm at this screen..not sure what to do here.
print01-DC-warning-3.png
0
 
LVL 36

Expert Comment

by:Mahesh
ID: 40014835
just type ? and hit enter, you will find all options

You need to select site, domain and dc name lastly one by one

if you don't find DC name in question, probably you don't have that one in metadata

if not, in that case i think you can simply delete that DC from adsiedit.msc
0
 
LVL 1

Author Comment

by:Harold
ID: 40014849
The DC was not listed in ntdsutil nor adsiedit.msc. Is this normal and am I done? Do I need to restart anything?
0
 
LVL 36

Expert Comment

by:Mahesh
ID: 40014894
So I think DC object is listed in AD sites and services some where, please check that
In order to remove that connect to configuration partition through adsiedit.msc and delete the DC in error from there

Also check if DC in error is configured some where in MS Exchange as configuration DC, if found just delete from there and your problem should get resolved
http://social.technet.microsoft.com/Forums/exchange/en-US/924f0b55-5819-4d44-8606-554e05769ac5/changing-dc-used-by-exchange-2010?forum=exchange2010

http://forums.msexchange.org/m_1800480281/tm.htm
0
 
LVL 1

Author Comment

by:Harold
ID: 40014928
It was here but was removed......

Also see nothing in exchange, except use default controller.
print01-DC-warning-4.png
0
 
LVL 36

Expert Comment

by:Mahesh
ID: 40014949
So are you stll facing issue with Exchange while creating object
0
 
LVL 1

Author Comment

by:Harold
ID: 40015305
WooHOOO!!!  You da man Mahesh!!  Thank you sir!
0
 
LVL 1

Author Closing Comment

by:Harold
ID: 40015311
Great working with you....thanks Mahesh!
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to resolve IMCEAEX NDRs in Exchange or Exchange Online related to invalid X500 addresses.
A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question