A universal group cannot have a local group as a member.

Issue: Unable to convert Mail Enabled Groups from EMC in Exchange 2010.

-------------------------------------------------------- Microsoft Exchange Error -------------------------------------------------------- Action 'Convert to Universal Group' could not be performed on object 'IT Managers'. IT Managers Failed Error: Active Directory operation failed on dc1.ZtekZone.com. This error is not retriable. Additional information: A universal group cannot have a local group as a member. Active directory response: 00002146: SvcErr: DSID-031A120C, problem 5003 (WILL_NOT_PERFORM), data 0 The server cannot handle directory requests.

Exchange 2010 and Group Scope

• To refresh your knowledge here is Active Directory Group Scope and Group Types

Group Scope	Group Type
Domain Local	Security
Global	Distribution
Universal

Exchange 2007 and Exchange 2010 wants all mail enabled groups Scope to be “Universal” regardless of the Group type. This is almost the other way around in Exchange 2003 world, as Exchange 2003 did not care about this much.

Lets take a look at our problem Group and try to understand the issue.

This Group Type is “Domain local” it is a Distribution Group, Exchange 2010 is not happy with this group scope type,  as you can see from the picture even Icon for this group is faded out (-:

How to solve this problem? We could perfectly locate this group with ADUC and change .the Group Scope to “Universal” and click apply.

Now we go back to EMC and take a look at same Group, to see if  Exchange is happy with new Group Type “ Universal” , the answer is yes.As you can see the Icon is changed.

Why Exchange forces Mail enabled group Types to be “Universal” ONLY!!!?

Here is the reason Universal group membership is replicated to all Global Catalogs , ALL DC/GC Servers, unlike Global and Domain local Scope type. The Universal groups replication boundaries and expansion capabilities FOREST Wide, thus Exchange 2007 and 2010 wants mail enabled groups and their Group Scope only to be “Universal” This is the case when it comes to Exchange and unfortunately Exchange does not care even you have single Label Domain name space.

Please note that there is no other reason or limitations any other functions goes. So if you are in the middle of the migration and finding this out do not freak out , This is fairly simple to deal with and it has no other side effects to existing functioning Distribution groups goes, since changing Group scope Type does not make any changes on the group membership, ACL’s permissions and etc.

One thing is to remember it could increase the network traffic when it wants to expand if it has forest wide members, but this ensures all members gets the e-mail (-: so give and take thing (-:

Now if you have many of these how to convert them?

Get-DistributionGroup | where { $_.Grouptype -Like "Global*" } | Set-Group -Universal

Now

Get-DistributionGroup | where { $_.Grouptype -Like "Domain*" } | Set-Group -Universal

*Note you might be getting errors when you run this script , if a mail enabled group has another mail enabled group as its member, and both Group Scope are not Universal , if you persistently keep running these scripts, you will be able to take care of them and  and when Exchange server is happy you get all these nice futures with the mail enabled groups

Oz Casey, Dedeal

( Exchange Server North America MVP)

MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

Exchange 2010, An Active Manager operation failed, content index catalog files in the following state: 'Failed'.

Running “Move-ActiveMailboxDatabase  fails with fallowing errors”

$Sname1 = E1 $Sname1 = E2 Get-mailboxdatabase -server $Sname1 -status | where {$_.mounted -eq $true} | Move-ActiveMailboxDatabase -ActivateOnServer $Sname2 -Confirm:$False

 

An Active Manager operation failed. Error The database action failed. Error: An error occurred while trying to validate the specified database copy for possible activat on. Error: Database copy 'db01' on server 'E1.ZtekZone.com' has content index catalog files in the following state: 'Failed'.. [Database: db01, Server: E1.ZtekZone.com]     + CategoryInfo          : InvalidOperation: (db01:ADObjectId) [Move-ActiveMailboxDatabase], AmDbActionWrapperException     + FullyQualifiedErrorId : 52C54005,Microsoft.Exchange.Management.SystemConfigurationTasks.MoveActiveMailboxDatabase

 

Solution

Get-MailboxDatabaseCopyStatus | fl name, ContentIndexState

Or

$DBstatus = Get-MailboxDatabaseCopyStatus $DBstatus | fl name,*Content*

Now if we are dealing with single Database this would work

Update-MailboxDatabaseCopy "db60ssc\E1" -CatalogOnly

Now if we have many Databases

Get-MailboxDatabaseCopyStatus * | where {$_.ContentIndexState -eq "Failed"}

To fix all

$DBstatus = Get-MailboxDatabaseCopyStatus $DBstatus | where {$_.ContentIndexState -eq "Failed"}

Now we will use Fallowing Command and append it to above command to fix content index issues

Update-MailboxDatabaseCopy –CatalogOnly

To Update all

Get-MailboxDatabaseCopyStatus * | where {$_.ContentIndexState -eq "Failed"} | Update-MailboxDatabaseCopy –CatalogOnly

 

Reseed the Search Catalog
http://technet.microsoft.com/en-us/library/ee633475.aspx

Enjoy !!

Respectfully,

Oz Casey, Dedeal

( Exchange Server North America MVP)

MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

PST Export & Import Exchange 2010

Our task is to allow PST Import and Export functions in Exchange 2010 to replace XMerge functions which used to be the tool in Exchange 2003 days.

Xmerge concept does not exist in Exchange 2010 and using simple PS cmdlet New-MailboxExportRequest will do the job and you will love using it.

• Create a new Role Group
• Assign “Mailbox Import Export” role to it.
• Add Desired Users to Role Group
• Create Network Share ( Exchange Trusted Subsystem group has read/write permission to NTFS Permissions)
• Run PS New-MailboxExportRequest
• Monitor New-MailboxExportRequest
• Verify PST File has been created on the network Share

Task#1

Create a new Role Group and assign role “ Mailbox Import Export” to it

I called the RoleGorup “PST Import Export” you can call it anything you like but remember you have to assign “Mailbox Import Export” role to this group like shown below

New-RoleGroup “PST Import Export” -Roles “Mailbox Import Export”

Once this is successful done we can see the Role Group

Task#2

Add Desired Users to Role Group

Add-RoleGroupMember “PST Import Export” -Member Administrator

Verify the work

Get-RoleGroup *export* | Get-RoleGroupMember

Task#3

Create Network Share assign Exchange Trusted Subsystem group has read/write permission Shared Folder &  NTFS Permissions

Administrator account ( or Account you like to use)  also has Full Shared Permissions

Task#4

Execute the PS to get the work done

New-MailboxExportRequest -Name MBExport -Mailbox "Casey.Dedeal" -FilePath \\E1\pst$\Dedeal.pst

Task#5

Monitor the Move Request

Get-moverequest|get-moverequeststatistics

Get-moverequest|get-moverequeststatistics  |export-csv c:\reports\Move_Report.csv

Enjoy !!

Respectfully,

Oz Casey, Dedeal

( Exchange Server North America MVP)

MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

Bulk User Mailbox Creation Exchange Server 2010

This script will help you to create bulk mailbox. You can create 10 or 1000 mailbox, it is up to you, just fallow the simple steps and provide input after executing the script.

This script is great and handy if you are looking for populating users for your LAB etc..

Download the script from here

Step One execute the script from your Exchange server

Create_Bulk_MailBoxUsers.ps1

Just provide the input for the script , that is all you have to do

Script will take your inputs it will create mailboxes, you can create 10 or 1000 mailbox with simple clicks..

Enjoy !!

Respectfully,

MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)