locked
IMCEAEX-ADCDisabledMail errors in 2010 Transport application logs RRS feed

  • Question

  • We're getting loads of these errors filling up the application log on our transport servers:

     Log Name:      Application
    Source:        MSExchangeTransport
    Date:          01/02/2011 15:07:13
    Event ID:      9217
    Task Category: Categorizer
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      majorite
    Description:
    More than one Active Directory object is configured with the recipient address IMCEAEX-ADCDisabledMail@domain.org. Messages to this recipient will be deferred until the configuration is corrected in Active Directory.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="MSExchangeTransport" />
        <EventID Qualifiers="49156">9217</EventID>
        <Level>2</Level>
        <Task>9</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2011-02-01T15:07:13.000000000Z" />
        <EventRecordID>26108</EventRecordID>
        <Channel>Application</Channel>
        <Computer>majorite</Computer>
        <Security />
      </System>
      <EventData>
        <Data>IMCEAEX-ADCDisabledMail@domain.org</Data>
      </EventData>
    </Event>

    The only references to this I can find are related to Exchange 5.5 - 2003, so am not sure how to resolve this in 2010. Is there a way to search for all recipients that apply, as I've been unable to figure out how so far? 

    Wednesday, February 2, 2011 10:13 AM

Answers

  • On Wed, 2 Feb 2011 10:13:24 +0000, afcben wrote:
     
    >
    >
    >We're getting loads of these errors filling up the application log on our transport servers:
    >
    > Log Name: Application Source: MSExchangeTransport Date: 01/02/2011 15:07:13 Event ID: 9217 Task Category: Categorizer Level: Error Keywords: Classic User: N/A Computer: majorite Description: More than one Active Directory object is configured with the recipient address IMCEAEX-ADCDisabledMail@domain.org. Messages to this recipient will be deferred until the configuration is corrected in Active Directory. Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="MSExchangeTransport" /> <EventID Qualifiers="49156">9217</EventID> <Level>2</Level> <Task>9</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2011-02-01T15:07:13.000000000Z" /> <EventRecordID>26108</EventRecordID> <Channel>Application</Channel> <Computer>majorite</Computer> <Security /> </System> <EventData> <Data>IMCEAEX-ADCDisabledMail@domain.org</Data>
    ></EventData> </Event>
    >
    >The only references to this I can find are related to Exchange 5.5 - 2003, so am not sure how to resolve this in 2010. Is there a way to search for all recipients that apply, as I've been unable to figure out how so far?
     
    Use LDP.exe (or CSVDE) and the LDAP query
    "proxyaddresses=smtp:IMCEAEX-ADCDisabledMail@domain.org"
     
     
    If you want to use poweshell, something like this should work:
     
    Get-Recipient -resultsize unlimited | foreach {foreach ($adr in
    $_.emailaddresses) {if ($adr.smtpaddress -eq
    'IMCEAEX-ADCDisabledMail@domain.org'){write-host $_.name}}}
     
    ---
    Rich Matheisen
    MCSE+I, Exchange MVP
     

    --- Rich Matheisen MCSE+I, Exchange MVP
    • Marked as answer by emma.yoyo Wednesday, February 9, 2011 1:43 AM
    Wednesday, February 2, 2011 9:39 PM
  • Possibly this object has more than one address, in this case you may use:

    Get-Mailbox | where {$_.EmailAddresses -like "*IMCEAEX-ADCDisabledMail*"}
    or
    Get-Recipient | where {$_.EmailAddresses -like "*IMCEAEX-ADCDisabledMail*"}

    Hope that helps.

    Regards
    Pano


    Pano Boschung, PageUp AG
    • Marked as answer by emma.yoyo Wednesday, February 9, 2011 1:43 AM
    Sunday, February 6, 2011 11:04 AM

All replies

  • On Wed, 2 Feb 2011 10:13:24 +0000, afcben wrote:
     
    >
    >
    >We're getting loads of these errors filling up the application log on our transport servers:
    >
    > Log Name: Application Source: MSExchangeTransport Date: 01/02/2011 15:07:13 Event ID: 9217 Task Category: Categorizer Level: Error Keywords: Classic User: N/A Computer: majorite Description: More than one Active Directory object is configured with the recipient address IMCEAEX-ADCDisabledMail@domain.org. Messages to this recipient will be deferred until the configuration is corrected in Active Directory. Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="MSExchangeTransport" /> <EventID Qualifiers="49156">9217</EventID> <Level>2</Level> <Task>9</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2011-02-01T15:07:13.000000000Z" /> <EventRecordID>26108</EventRecordID> <Channel>Application</Channel> <Computer>majorite</Computer> <Security /> </System> <EventData> <Data>IMCEAEX-ADCDisabledMail@domain.org</Data>
    ></EventData> </Event>
    >
    >The only references to this I can find are related to Exchange 5.5 - 2003, so am not sure how to resolve this in 2010. Is there a way to search for all recipients that apply, as I've been unable to figure out how so far?
     
    Use LDP.exe (or CSVDE) and the LDAP query
    "proxyaddresses=smtp:IMCEAEX-ADCDisabledMail@domain.org"
     
     
    If you want to use poweshell, something like this should work:
     
    Get-Recipient -resultsize unlimited | foreach {foreach ($adr in
    $_.emailaddresses) {if ($adr.smtpaddress -eq
    'IMCEAEX-ADCDisabledMail@domain.org'){write-host $_.name}}}
     
    ---
    Rich Matheisen
    MCSE+I, Exchange MVP
     

    --- Rich Matheisen MCSE+I, Exchange MVP
    • Marked as answer by emma.yoyo Wednesday, February 9, 2011 1:43 AM
    Wednesday, February 2, 2011 9:39 PM
  • Possibly this object has more than one address, in this case you may use:

    Get-Mailbox | where {$_.EmailAddresses -like "*IMCEAEX-ADCDisabledMail*"}
    or
    Get-Recipient | where {$_.EmailAddresses -like "*IMCEAEX-ADCDisabledMail*"}

    Hope that helps.

    Regards
    Pano


    Pano Boschung, PageUp AG
    • Marked as answer by emma.yoyo Wednesday, February 9, 2011 1:43 AM
    Sunday, February 6, 2011 11:04 AM
  • Hi afcban,

    Any updates on your issue?

    Frank Wang

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com  

     


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Monday, February 7, 2011 7:04 AM
  • Hello,

    I've now tried all of the above commands and they do appear to go away and do something, however nothing is returned in the Powershell console.

    Any ideas on getting some kind of output to appear?

    Thanks,

    Ben

    Friday, February 11, 2011 1:00 PM
  • I've now managed to capture one of these e-mails in the Submission queue and it looks like the following. In fact, the ones that I captured all seem to have exactly the same subject, so there could be something odd going on!

    I'm going to try and track messages with this subject, but any other ideas would be helpful.

    Thanks.

     Identity: majakite\Submission\894360
    Subject: RE: old booklet query
    Internet Message ID: <C0F9BFBCE440AB49B71A4EB6FCB9C3250C29F6@MADOCITE.domain.org>
    From Address: user@domain.org.uk
    Status: Retry
    Size (KB): 56
    Message Source Name: FromLocal
    Source IP: 255.255.255.255
    SCL: -1
    Date Received: 10/02/2011 10:14:52
    Expiration Time: 12/02/2011 10:14:52
    Last Error: 420 4.2.0 RESOLVER.ADR.Ambiguous; ambiguous address
    Queue ID: majakite\Submission
    Recipients:  IMCEAEX-ADCDisabledMail@domain.org

    Friday, February 11, 2011 4:50 PM
  • On Fri, 11 Feb 2011 16:50:26 +0000, afcben wrote:
     
    >
    >
    >I've now managed to capture one of these e-mails in the Submission queue and it looks like the following. In fact, the ones that I captured all seem to have exactly the same subject, so there could be something odd going on!
    >
    >I'm going to try and track messages with this subject, but any other ideas would be helpful.
    >
    >Thanks.
    >
    > Identity: majakite\Submission\894360 Subject: RE: old booklet query Internet Message ID: <C0F9BFBCE440AB49B71A4EB6FCB9C3250C29F6@MADOCITE.domain.org> From Address: user@domain.org.uk Status: Retry Size (KB): 56 Message Source Name: FromLocal Source IP: 255.255.255.255 SCL: -1 Date Received: 10/02/2011 10:14:52 Expiration Time: 12/02/2011 10:14:52 Last Error: 420 4.2.0 RESOLVER.ADR.Ambiguous; ambiguous address Queue ID: majakite\Submission Recipients: IMCEAEX-ADCDisabledMail@domain.org
     
    Why are you sending e-mail to a mail-disabled users (i.e. ones that
    used to have a mailbox)? I'm going to guess that you have some users
    in the AD that, at one time, had a mailbox and that the mailbox was
    removed BUT the 'mail' attribute was never removed (bad Microsoft!).
    The legacyExchangeDN contains the ADCDisabledMail value so when an
    e-mail is sent to the SMTP address in the 'mail' attribute the
    legacyExchangeDN if used to locate the mailbox -- only you have more
    than one mailbox in this state so the address is ambiguous.
     
    Run the Exange Best Practices Analyzer and see if it spits out the
    users that are casuing problems:
     
    http://technet.microsoft.com/en-us/library/aa997413(EXCHG.80).aspx
     
    ---
    Rich Matheisen
    MCSE+I, Exchange MVP
     

    --- Rich Matheisen MCSE+I, Exchange MVP
    Friday, February 11, 2011 10:30 PM
  • Hi Rich,

    My thoughts exactly! These accounts shouldn't even show up anywhere for users. We've got a lot of disabled accounts in AD, which have had their mailboxes removed and shouldn't show up in the GAL. It's more than likely that some of these haven't had the mail attribute removed. I'll see what the BPA turns up. 

    Thanks,

    Ben

    Saturday, February 12, 2011 8:48 AM
  • I think someone tries to reply to an old email, or tries to send to an address that comes from the outlook cache (.n2k).

    Regards
    Pano


    Pano Boschung, PageUp AG
    Saturday, February 12, 2011 8:56 AM
  • I seem to be encountering the same issue.  I figured out where they are coming from from here http://social.technet.microsoft.com/Forums/en/exchange2010/thread/6a647d41-1941-4a4a-a38c-0d239ffbefe0. The culprits seem to be the SystemAttendant and one of the Public information stores fro my mailbox servers.

    My Environment is 

    4CAS/HT & 2MBX servers, 2 AD Sites, 2 Public Folder stores, and transition from Exchange 2003 to Exchange 2010.

    For some reason i'm unable to replicate my public folders from my primary sites 2010 public folders to my secondary site 2010 public folders. i do see the event listed above in my mailbox servers. I'm wondering if it has anything to do with my Public folder replication issue.

    i found this http://technet.microsoft.com/en-us/library/dd421844(EXCHG.80).aspx in regards to changing the e-mail address for the System Attendant. To me at least it doesnt  seem very clear on how to change it or where else it should be changed. -- Can someone shine some light on the subject?

    I was also unable to find anything about how to change an e-mail address for the public information store.

    It seems i have two issues

    1) Event ID 9217, MSExchangeTransport. More than one Active Directory object is configured with the recipient address _5@domain.com. Messages to this recipient will be deferred until the configuration is corrected in Active Directory. 

    2) Exchange Exchange 2003 and 2010 Public Folders will not replicate to other Exchange 2010 Public Folder DB.

    I think resolving Issue 1 and 2 are related for some reason.

    can someone shine some light?

    Thanks in Advance,

    Jason

     

     

    Saturday, June 25, 2011 9:45 PM
  • On Sat, 25 Jun 2011 21:45:30 +0000, jaylpz wrote:
     
    >
    >
    >I seem to be encountering the same issue. I figured out where they are coming from from here http://social.technet.microsoft.com/Forums/en/exchange2010/thread/6a647d41-1941-4a4a-a38c-0d239ffbefe0. The culprits seem to be the SystemAttendant and one of the Public information stores fro my mailbox servers.
     
    The usual source for those is the Active Directory Connector. If you
    still have one running, stop it!
     
    This describes how to find and remove the ADSDisabledMail
    legacyExchangeDNs that cause the problem:
    http://restartis.wordpress.com/2009/05/14/multiple-users-with-legacyexchangedn-set-to-adcdisabledmail/
     
    >My Environment is
    >
    >4CAS/HT & 2MBX servers, 2 AD Sites, 2 Public Folder stores, and transition from Exchange 2003 to Exchange 2010.
    >
    >For some reason i'm unable to replicate my public folders from my primary sites 2010 public folders to my secondary site 2010 public folders. i do see the event listed above in my mailbox servers. I'm wondering if it has anything to do with my Public folder replication issue.
    >
    >i found this http://technet.microsoft.com/en-us/library/dd421844(EXCHG.80).aspx in regards to changing the e-mail address for the System Attendant. To me at least it doesnt seem very clear on how to change it or where else it should be changed. -- Can someone shine some light on the subject?
    >
    >I was also unable to find anything about how to change an e-mail address for the public information store.
    >
    >It seems i have two issues
    >
    >1) Event ID 9217, MSExchangeTransport. More than one Active Directory object is configured with the recipient address _5@domain.com. Messages to this recipient will be deferred until the configuration is corrected in Active Directory.
     
    Find the objects with that proxy address and fix the ones that should
    have a different address. This sort of thing usually happens when
    using LDIFDE or some other software that directly modifies the
    proxyAddresses property (and also check the 'mail' and 'targetAddress'
    properties).
     
    This LDAP query will find the ones in the 'proxyAddresses' attribute:
    proxyaddresses=smtp:_5@domain.com
     
    This will find them in the 'mail' attribute:
    mail=_5@domain.com
     
    And this will find them in the 'targetAddress' property:
    targetaddress=smtp:_5@domain.com
     
    >2) Exchange Exchange 2003 and 2010 Public Folders will not replicate to other Exchange 2010 Public Folder DB.
     
    It would be unusual for a public folder database to have an
    ADCDisabledMail legacyExchangeDN.
     
    ---
    Rich Matheisen
    MCSE+I, Exchange MVP
     

    --- Rich Matheisen MCSE+I, Exchange MVP
    Sunday, June 26, 2011 12:51 AM
  • You can do this in powershell (Active Directory Module for Windows Powershell):

    Get-ADObject -LDAPFilter "(&(objectClass=user)(objectCategory=person)(legacyExchangeDN=ADCDisabledMail))" -Properties LegacyExchangeDN | Set-ADObject -Clear LegacyExchangeDN

    • Proposed as answer by zhelr1 Thursday, March 29, 2012 2:39 PM
    • Unproposed as answer by zhelr1 Thursday, March 29, 2012 2:40 PM
    • Proposed as answer by zhelr1 Thursday, March 29, 2012 2:41 PM
    Tuesday, February 28, 2012 11:55 AM