Search WWW Search

Tuesday, January 18, 2011

Cannot create mail enabled user because an existing object with type already has the same proxy addresses/MasterAccountSid.

When provisioning an MEU using the Prepare-MoveRequest.Ps1 script you receive the following error:

[PS] C:\Program Files\Microsoft\Exchange Server\V14\Scripts>.\Prepare-MoveRequest.Ps1 -Identity "CN=mbperm1,OU=office,D
=ipcfcdom,DC=inphonic,DC=com" -RemoteForestDomainController "" -RemoteForestCredential $R
mote -LocalForestDomainController "eqdcp01.corp.dom" -LocalForestCredential $Local -TargetMailUserOU "OU=office,DC=corp
DC=dom" -uselocalobject -overwritelocalobject
The operation couldn't be performed because object 'corp.dom/Office/mbperm1' couldn't be found on 'EQDCP01.corp.dom'.
+ CategoryInfo : NotSpecified: (:) [Get-Recipient], ManagementObjectNotFoundException
+ FullyQualifiedErrorId : 4A3D86A8,Microsoft.Exchange.Management.RecipientTasks.GetRecipient

C:\Program Files\Microsoft\Exchange Server\V14\Scripts\Prepare-MoveRequest.ps1 : Cannot create mail enabled user becaus
e an existing object with type already has the same proxy addresses/MasterAccountSid.
At line:1 char:26
+ .\Prepare-MoveRequest.Ps1 <<<< -Identity "CN=mbperm1,OU=office,DC=ipcfcdom,DC=inphonic,DC=com" -RemoteForestDomainCo
ntroller "" -RemoteForestCredential $Remote -LocalForestDomainController "
m" -LocalForestCredential $Local -TargetMailUserOU "OU=office,DC=corp,DC=dom" -uselocalobject -overwritelocalobject
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Prepare-MoveRequest.ps1

The reason is you used ADMT and didn't exclude the necessary exchange attributes. Therefore prepare-moverequest fails to merge to the existing object brought over by ADMT. The provisioning script must match 3 attributes: Proxyaddresses, mail and mailnickname. You must have all 3 attributes set in order for the script to match and merge the MEU then excluse all other Exchange attributes.

You must script the move to stop the exclusion of some core exchange attributes. The link below shows a sample script. You would then need to append the following lines.

Create a new notepad file and name it ADMTexclusion.vbs and enter the lines below.
Set objMig = CreateObject("ADMT.Migration")

objMig.SystemPropertiesToExclude = "homeMDB, homeMTA, showInAddressBook, msExchHomeServerName, msExchRecipientTypeDetails, msexchrecipientdisplaytype msExchMailboxSecurityDescriptor, msExchMDBRulesQuota, msExchPoliciesIncluded, msExchUserAccountControl, msExchVersion, mdbusedefaults"

Then run the file on your ADMT server:

C:\Windows\SysWOW64>cscript c:\admin\scripts\admtexclusion.vbs

Migrating All User Accounts

Another option is to use ADMT to bulk move\seed them without any attributes, then use either powershell or old friend ADModify to bulk update the proxyaddresses, mail and mailnickname. Typically you would use %'samaccount'% as the variable to fill in these attributes.

Finally you can just provision the account using Prepare-MoveRequest.ps1 first then use ADMT.

James Chong
Security+, Project+, ITIL


Blogger Liran Zamir said...

I started up by performing ADMT without this script and the result was the creation of a disabled account which mean it did not merge properly.
Later on I used the script you provided, and as a result when running new-moverequest I got "The critical preperty 'LegacyExchangeDN' is missing in the MailUser". I saw that you also talk about it in a different post, however I find it irresponsible of you to originally post the exclude script as it causes more issues than helping.
Can you provide an additional script to roll back this change ?

5:14 AM  
Anonymous Anonymous said...

@ Liran Zamir:
Woah strong choice of words. If you knew what to do you would not be on this site. Additionally, there is an implied risk of running untested scripts.

7:41 AM  
Anonymous Klaus Thorn said...

Dear James Chong, thank you very much, your advice helped me out of a dead end.

Sad that the script does not come with documentation or error messages which highlight these crucial details. Even the documentation for the script that Microsoft provides online is not helpful in preventing this pitfall.

6:11 AM  
Blogger chenyingying9539 9539 said...

nike air max
jrodan retro
burberry outlet
chanel bags
true religion jeans
jordan 8s
oakley vault
dior handbags
gucci outlet
michael kors outlet
polo ralph lauren
toms outlet
louis vuitton outlet
cheap jordans
oakley sunglasses
hermes birkin bag
sac longchamp pas cher
michael kors outlet
mulberry handbags
chanel bags
louis vuitton outlet
coach outlet
coach factorty outlet
ray ban uk
hollister clothing store
hollister clothing store
louis vuitton handbags
ralph lauren outlet
michael kors

7:39 PM  

Post a Comment

<< Home

xml:lang="en" lang="en"> MS Exchange Tips: Cannot create mail enabled user because an existing object with type already has the same proxy addresses/MasterAccountSid.