4

I moved my Microsoft AD Connect install from one server to another today. I installed AD Connect on the new server in staging mode, turned on staging mode on the old server, turned it off on the new server and let it run. All seemed fine, I checked back about 20 mins later in my Office 365 Admin portal and all objects were still in sync with AD, great.

However, about an hour later one of my users tries to forward or reply to an email to another internal user in Outlook and receives this message, name removed:

Your message to IMCEAEX-_o=First+20Organization_ou=Exchange+20Administrative+20Group+20+28FYDIBOHF23SPDLT+29_cn=Recipients_cn=FIRSTNAME+20LASTNAMEb6f@namprd10.prod.outlook.com couldn't be delivered.

I've since heard that 3 other users started getting this message since I made the change. Luckily it's Friday and they're out of the office now, but I can't help but feel the two are related.

I didn't save the config on the old server before I uninstalled it, but the one think I've noticed, when comparing it to other AD Connect installs that I have is that those ones default to Source Anchor: ObjectGUID. However, when I look at this one, the Source Anchor is: ms-DS-ConsistencyGuid. I opened a ticket with Microsoft and they assured me this wouldn't be an issue, but it's the only thing I can see different between the two.

We did an office 365 migration and made sure to port over the X500 records from the previous on-site Exchange server, that was several months ago and there's been no issues.

Has anyone encountered anything like this? I did notice on the new AD Connect server, on the first Full Import to the Office 365 tenant it had about 150+ adds for new CNs, seems related.

Any input would be greatly appreciated.

Ben
  • 51
  • 3
  • 5
    Microsoft changed the Source Anchor at some point in the product lifecycle of Azure AD Connect from ObjectGuid to ms-DS-ConsistencyGuid. They state in the Azure AD Connect documentation that the Source Anchor cannot be changed after an object has been synced to Azure AD and that Azure AD Connect will generate errors in such a scenario. Do you see any errors in the Azure AD Connect Synchronization Service Manager console? What are the details of the 150+ adds? – joeqwerty Jan 19 '19 at 02:51
  • No errors, Office 365 looked at it with me and said everything looks healthy with the sync and service. I did a password reset on one user and it synced up just fine. The adds were 150+ CNs – Ben Jan 19 '19 at 19:58
  • This sure looks like a LegacyExchangeDN issue. Have you verified that the previously created/imported X500 addresses still exist? – joeqwerty Jan 21 '19 at 16:37

0 Answers0