Exchange 2019 cross-forest permission issue, msExchVersion strange behaviour.

Question

Exchange 2019 cross-forest permission issue, msExchVersion strange behaviour.

Yaroslav Z 1

Hi there!

We have 2 forests (2-way trust), one forest has Exchange 2019 (CU11) and the other Exchange 2019 (CU10).

FIM GALSync is syncing Address Books between organization. So we have cross-forest contacts created with the attribute set required for cross-forest sharing ability.

FIM has been setup a while ago when both Exchange orgs were on 2013 version, and all the cross-forest contacts have msExchVersion attribute value set to '88218628259840', which refers to Exchange 2013.

When I try to add cross-forest permissions with msExchVersion=88218628259840 I got an exception:

Add-MailboxPermission domain1\john.smith -user domain2\michael.brown -AccessRights fullaccess -AutoMapping:$False -InheritanceType all

WARNING: An unexpected error has occurred and a Watson dump is being generated: Unable to cast object of type 'Microsoft.Exchange.Data.Directory.Recipient.ADContact' to type
 'Microsoft.Exchange.Data.Directory.Recipient.IADSecurityPrincipal'.
Unable to cast object of type 'Microsoft.Exchange.Data.Directory.Recipient.ADContact' to type 'Microsoft.Exchange.Data.Directory.Recipient.IADSecurityPrincipal'.
    + CategoryInfo          : NotSpecified: (:) [Add-MailboxPermission], InvalidCastException
    + FullyQualifiedErrorId : System.InvalidCastException,Microsoft.Exchange.Management.RecipientTasks.AddMailboxPermission

Although, I can add cross-forest permissions to the calendar:

Add-MailboxfolderPermission "******@domain1.com:\Calendar" -user ******@domain2.com -AccessRights PublishingEditor
FolderName           User                 AccessRights
----------           ----                 ------------

Calendar michael.brown {PublishingEditor}

Then I set msExchVersion=1125899906842624 to the cross-forest contact, which is actually 2016, but I'm not able to find any reference to 2019.

Now I'm able to successfully add cross-forest permissions:

Add-MailboxPermission domain1\john.smith -user domain2\michael.brown -AccessRights fullaccess -AutoMapping:$False -InheritanceType all

Identity             User                 AccessRights      IsInherited Deny
--------             ----                 ------------                                                                                                      ----------- ----
domain1.local\jo...  domain2\michael.b... {FullAccess}      False       False

At the same time I got 'Add-MailboxfolderPermission' broken:

Add-MailboxfolderPermission "******@domain1.com:\Calendar" -user ******@domain2.com -AccessRights PublishingEditor

The user "******@domain2.com" is either not valid SMTP address, or there is no matching information.
    + CategoryInfo          : NotSpecified: (:) [Add-MailboxFolderPermission], InvalidExternalUserIdException
    + FullyQualifiedErrorId : [Server=ServerName,RequestId=29d1bcf9-52f8-4bf9-90a7-570a392490c7,TimeStamp=22.11.2021 10:16:00] [FailureCategory=Cmdlet-InvalidExternalUse
   rIdException] 78747CAA,Microsoft.Exchange.Management.StoreTasks.AddMailboxFolderPermission

I have never managed to get these things work together. We have not had any issues with sharing on Exchange 2013.

We have no option to open a case in MS Support, so any input would be appreciated.

Kai Yao 37,791 Reputation points Moderator

2021-11-26T09:21:18.377+00:00

Hi @Yaroslav Z

I tested in my lab (two Exchange 2016 servers cross-forest, which don't have Exchange 2013 servers before).
Instead of using FIM,I manually created cross-forest contacts according to this link: Exchange Server 2010 Cross Forest Delegation

The msExchVersion value is 88218628259840 and I was able to run the Add-MailboxPermission command to assign perssmission.
So I suppose this value may not be the cause in this case.

In EAC on Exchange in domain1:

assign permission on Exchange in domain2:

However, the Add-MailboxfolderPermission command returns the same error message (The user is either not valid SMTP address, or there is no matching information.), I suppose it does not work for cross-forest mail contacts and you may need to specify a mail user in the local forest.
Yaroslav Z 1 Reputation point

2021-11-26T09:52:17.883+00:00

Could you please try to change contact's msExchVersion value to 1125899906842624 and then try both
Add-MailboxFolderPermission and Add-MailboxPermission

Thanks.
Kai Yao 37,791 Reputation points Moderator

2021-11-29T06:26:20.61+00:00

Please check the following screenshots.

Cross-Forest contact ******@domain2.com msExchVersion: 1125899906842624

Add-MailboxPermission:

Add-MailboxFolderPermission:
Yaroslav Z 1 Reputation point

2021-11-29T07:45:21.737+00:00

Could you please wait for 15 minutes and try again?
Kai Yao 37,791 Reputation points Moderator

2021-11-29T08:43:11.937+00:00

Hi,
I tested it again and the result is same.
Not sure if it has something to do with the version of Exchange server since I am using Exchange 2016.
Yaroslav Z 1 Reputation point

2021-11-29T08:47:24.173+00:00

Could you please paste the output of:

Get-adobject "DN of contact" -Properties * | fl msexch

Thanks.
Kai Yao 37,791 Reputation points Moderator

2021-11-29T09:04:19.077+00:00

Sure.
Below is the result:
Kai Yao 37,791 Reputation points Moderator

2021-12-02T09:08:24.573+00:00

Hi @Yaroslav Z

I am writing here to confirm with you how thing going now?
Please let us know if you would like further assistance.
Yaroslav Z 1 Reputation point

2021-12-02T09:48:11.777+00:00

Hi

I still facing the issue.
Cannot manage to make Add-MailboxFolderPermission and Add-MailboxPermission working together.
Kai Yao 37,791 Reputation points Moderator

2021-12-03T01:45:00.283+00:00

Thanks for your update.

Would it actually work after the Add-MailboxFolderPermission and Add-MailboxPermission command is successfully run?
For example, if you successfully run Add-MailboxFolderPermission, can you add and access the shared folder in Outlook?
Yaroslav Z 1 Reputation point

2021-12-18T21:59:48.48+00:00
Hi @Kai Yao , sorry for the late response.

Would it actually work after the Add-MailboxFolderPermission and Add-MailboxPermission command is successfully run?
For example, if you successfully run Add-MailboxFolderPermission, can you add and access the shared folder in Outlook?

No, it's not working in Outlook with the cross-forest contacts in Exchange 2019 environment. I guess something has changed.
i can run successfully the command:

Add-MailboxPermission domain1\john.smith -user domain2\michael.brown -AccessRights fullaccess -AutoMapping:$False -InheritanceType all

Nevertheless, I'm not able to open mailbox 'john.smith' in michael.brown's Outlook. I use fiddler to check what's going on under the hood, Outlook goes to autodiscover.domain1.com and gets HTTP 500 from the web-server.

After many tries, I have managed to get cross-forest delegation working.
Instead of creating a cross-forest contact, I created a mailuser 'john.smith' in the domain2.com, and fill in the attibutes:

proxyAddresses (copied everything from domain1\john.smith).

msExchMasterAccountSid (SID value of domain1\john.smith)

msExchOriginatingForest (domain1.com)

targetaddress (smtp:******@domain1.com)

After that, I was able to open mailbox 'john.smith' in michael.brown's Outlook. Fiddler showes that Outlook goes to autodiscover.domain1.com and gets HTTP 200 from the web-server, and then goes to mail.domain.com/mapi and also gets HTTP 200.

See next message -->
Yaroslav Z 1 Reputation point

2021-12-18T22:00:15.887+00:00
Need to mention that I haven't managed to get add-mailboxfolderpermission working with mail user, so I have only FullAccess feature.

It's interesting that a mailuser has default msExchVersion value = 44220983382016, and I didn't change it.

Considering the above, I have 2 questions:

Is 'cross-forest contacts scheme' is supported scenario for cross-forest Exchange on-premise delegation (full-access). It was on Exchange 2013, but stopped working on 2019.

Could you please test Outlook malibox sharing in your lab with cross-forest contacts and mailuser?

Thanks.

Your answer

Kai Yao 37,791 Reputation points Moderator

2021-11-26T09:21:18.377+00:00

Hi @Yaroslav Z

I tested in my lab (two Exchange 2016 servers cross-forest, which don't have Exchange 2013 servers before).
Instead of using FIM,I manually created cross-forest contacts according to this link: Exchange Server 2010 Cross Forest Delegation

The msExchVersion value is 88218628259840 and I was able to run the Add-MailboxPermission command to assign perssmission.
So I suppose this value may not be the cause in this case.

In EAC on Exchange in domain1:

assign permission on Exchange in domain2:

However, the Add-MailboxfolderPermission command returns the same error message (The user is either not valid SMTP address, or there is no matching information.), I suppose it does not work for cross-forest mail contacts and you may need to specify a mail user in the local forest.
Yaroslav Z 1 Reputation point

2021-11-26T09:52:17.883+00:00

Could you please try to change contact's msExchVersion value to 1125899906842624 and then try both
Add-MailboxFolderPermission and Add-MailboxPermission

Thanks.
Kai Yao 37,791 Reputation points Moderator

2021-11-29T06:26:20.61+00:00

Please check the following screenshots.

Cross-Forest contact ******@domain2.com msExchVersion: 1125899906842624

Add-MailboxPermission:

Add-MailboxFolderPermission:
Yaroslav Z 1 Reputation point

2021-11-29T07:45:21.737+00:00

Could you please wait for 15 minutes and try again?
Kai Yao 37,791 Reputation points Moderator

2021-11-29T08:43:11.937+00:00

Hi,
I tested it again and the result is same.
Not sure if it has something to do with the version of Exchange server since I am using Exchange 2016.
Yaroslav Z 1 Reputation point

2021-11-29T08:47:24.173+00:00

Could you please paste the output of:

Get-adobject "DN of contact" -Properties * | fl msexch

Thanks.
Kai Yao 37,791 Reputation points Moderator

2021-11-29T09:04:19.077+00:00

Sure.
Below is the result:
Kai Yao 37,791 Reputation points Moderator

2021-12-02T09:08:24.573+00:00

Hi @Yaroslav Z

I am writing here to confirm with you how thing going now?
Please let us know if you would like further assistance.
Yaroslav Z 1 Reputation point

2021-12-02T09:48:11.777+00:00

Hi

I still facing the issue.
Cannot manage to make Add-MailboxFolderPermission and Add-MailboxPermission working together.
Kai Yao 37,791 Reputation points Moderator

2021-12-03T01:45:00.283+00:00

Thanks for your update.

Would it actually work after the Add-MailboxFolderPermission and Add-MailboxPermission command is successfully run?
For example, if you successfully run Add-MailboxFolderPermission, can you add and access the shared folder in Outlook?
Yaroslav Z 1 Reputation point

2021-12-18T21:59:48.48+00:00

Hi @Kai Yao , sorry for the late response.

Would it actually work after the Add-MailboxFolderPermission and Add-MailboxPermission command is successfully run?
For example, if you successfully run Add-MailboxFolderPermission, can you add and access the shared folder in Outlook?

No, it's not working in Outlook with the cross-forest contacts in Exchange 2019 environment. I guess something has changed.
i can run successfully the command:

Add-MailboxPermission domain1\john.smith -user domain2\michael.brown -AccessRights fullaccess -AutoMapping:$False -InheritanceType all

Nevertheless, I'm not able to open mailbox 'john.smith' in michael.brown's Outlook. I use fiddler to check what's going on under the hood, Outlook goes to autodiscover.domain1.com and gets HTTP 500 from the web-server.

After many tries, I have managed to get cross-forest delegation working.
Instead of creating a cross-forest contact, I created a mailuser 'john.smith' in the domain2.com, and fill in the attibutes:

proxyAddresses (copied everything from domain1\john.smith).

msExchMasterAccountSid (SID value of domain1\john.smith)

msExchOriginatingForest (domain1.com)

targetaddress (smtp:******@domain1.com)

After that, I was able to open mailbox 'john.smith' in michael.brown's Outlook. Fiddler showes that Outlook goes to autodiscover.domain1.com and gets HTTP 200 from the web-server, and then goes to mail.domain.com/mapi and also gets HTTP 200.

See next message -->
Yaroslav Z 1 Reputation point

2021-12-18T22:00:15.887+00:00

Need to mention that I haven't managed to get add-mailboxfolderpermission working with mail user, so I have only FullAccess feature.

It's interesting that a mailuser has default msExchVersion value = 44220983382016, and I didn't change it.

Considering the above, I have 2 questions:

Is 'cross-forest contacts scheme' is supported scenario for cross-forest Exchange on-premise delegation (full-access). It was on Exchange 2013, but stopped working on 2019.

Could you please test Outlook malibox sharing in your lab with cross-forest contacts and mailuser?

Thanks.