hkong

How to fix “Failed to get group accounts sids of a user” when connecting to EXO remote PowerShell.

hkongcharlotte — Tue, 28 Mar 2017 14:50:58 GMT

In an Exchange Hybrid environment where user accounts are on-premises and mailboxes are in Office 365. You have confirmed that you do have administrator rights and was able to connect to EXO remote PowerShell before. Problem: You are getting an error message “Failed to get group accounts sids of a user…” when trying to connect to Exchange Online Remote PowerShell. While remote PowerShell connection to MSOL service is working correctly. Some other Exchange Online administrators might also have the same issue since they belong to similar groups. If you provision a new admin in Office 365 with (UPN: admin@contoso.onmicrosoft.com), the new admin can successfully connect to EXO remote PowerShell. If you provision a new synced admin account in Office 365 (on-premises user with Office 365 mailbox) and the newly created admin can successfully connect to EXO remote PowerShell. Causes: If you belong to many groups, one of the groups you belong to prevents you from being able to successfully connect to EXO remote PowerShell. The sample screenshot below will show all the groups you are a member of. To confirm one of the groups is causing this issue, you can add all the groups you are a member of to the new synced admin account you created earlier. Then force a delta sync to Office 365. If you try to connect to EXO remote PowerShell with the new synced admin account, you should receive the similar error message. Solution: To fix the issue above, please remove all groups you are a member of except “Domain Admins” or “Domain Users” and then force a delta sync with Office 365. You should now be able to connect to EXO remote PowerShell successfully. You can try adding all the groups back to your account (one at a time and then force a delta sync and then connect to EXO remote PowerShell) until you are able to find a problematic group you are a member of. You may choose to re-create a new group or further investigate to see if the problematic group contains many other nested groups that might cause the issue.

How to fix Attribute Value Must Be Unique “AttributeValueMustBeUnique” error message when trying to sync an object from on-premises Active Directory to Office 365.

hkongcharlotte — Thu, 23 Mar 2017 14:55:28 GMT

You received a synchronization error report email from MSOnlineServicesTeam@MicrosoftOnline.com similar to the following: Hello admin@constoso.com, You can troubleshoot this issue by running the Directory Synchronization troubleshooter on the server that has Azure Active Directory identity synchronization tools installed. The Identity synchronization tool batch run was completed on Thursday, 23 March 2017 12:54:13 GMT for directory Contoso.onmicrosoft.com [Contoso.onmicrosoft.com]. The following errors occurred during synchronization:

Identity	Error Description	sourceAnchor
user1@contoso.com	Unable to update this object because the following attributes associated with this object have values that may already be associated with another object in your local directory services: [ProxyAddresses SMTP:user1@contoso.com;]. Correct or remove the duplicate values in your local directory. Please refer to https://support.microsoft.com/kb/2647098 for more information on identifying objects with duplicate attribute values.	#######3VHk6gBGejEZfwww==

We've recently introduced a new feature to help you resolve errors like this more easily. Click here to learn more. Tracking ID: ########-cc64-44db-a2d2-0833a8e958e9 Thank you, The Azure Active Directory Team Do not reply to this message. It was sent from an unmonitored email account. When you open Azure AD Connect Synchronization Service, you notice the error message below: To identify and fix the issue, please do the following: Click on the error message “AttributeValueMustBeUnique” You will be presented with the screen below: Click on “Detail…” “ObjectId” "82538ebe-1cf7-4c89-9497-############" – is the object you trying to sync to O365. "ObjectIdInConflict": “6f2fcfcd-23f8-4504-bbe6-############" – is the object already exists in O365 with duplicated SMTP address. You will need these “ObjectId” values to identify the syncing object and existing object via O365 remote PowerShell. Connect to O365 remote PowerSheell - https://technet.microsoft.com/en-us/library/dn975125.aspx and run the remote PowerShell commands below: [9:58:15 AM][Cloud] Get-MsolUser -ObjectId 82538ebe-1cf7-4c89-9497-############# | FL Proxyaddresses, OverallProvisioningStatus, LastDirSyncTime, ValidationStatus ProxyAddresses : {smtp:user17609@contoso.onmicrosoft.com, smtp:user1@contoso.mail.onmicrosoft.com, SMTP:user1@contoso.com} OverallProvisioningStatus : Error LastDirSyncTime : 3/23/2017 1:54:17 PM ValidationStatus : Error [9:58:41 AM][Cloud] Get-MsolUser -ObjectId 6f2fcfcd-23f8-4504-bbe6-############# | FL Proxyaddresses, OverallProvisioningStatus, LastDirSyncTime, ValidationStatus ProxyAddresses : {smtp:user1@contoso.com, SMTP:user1@contoso.onmicrosoft.com} OverallProvisioningStatus : Success LastDirSyncTime : ValidationStatus : Healthy To remove the existing (duplicate) MSOL user object so that we can successfully sync an object from on-premises Active Directory: You may back up any data from the existing object and then permanently remove it using the remote PowerShell commands below: If the command Get-MsolUser does not return the duplicate object you are looking for, the duplicate object in Office 365 might be a contact. In that case, please run the commands below to find and delete that contact object. If Get-MsolContact does not return the duplicate object, the object might be a MSOL group. Go to your Azure AD Connect server and force a delta sync. You should now be able sync the object in conflict successfully to Office 365.

How to delete corrupted, hidden inbox rules from a mailbox using MFCMAPI

hkongcharlotte — Fri, 27 Feb 2015 12:28:00 GMT

This is useful when you receive duplicate messages or any of the inbox rules are corrupted or not working as expected. I have included related KB article below for reference.

https://support.microsoft.com/en-us/kb/924297

1. Export all rules from you Outlook so that you may import them back after deleting all rules via MFCMAPI.

On your Outlook client, go to “File”> “ManageRules & Alerts”.

2. Under E-mail Rules > go to “Options” > Export Rules > “Ok”.

3. Download the latest version of MFCMAPI from the link below

(Please make sure you download the correct release for your Outlook client e.g. 32bit or 64bit version).

https://mfcmapi.codeplex.com/

4. Start MFCMAPI.EXE as Administrator.

5. Go to “Tools” > “Options”.

6. Make sure that “Use the MDB_ONLINE flag when calling OpenMsgStore”

And “Use the MAPI_NO_CACHE flag when calling OpenEntry” are checked. Click “OK”.

7. Click on “Session” > “Logon”.

8. Choose the Outlook profile contains the rules you want to delete > “OK”.

9. Double click the profile with rules you want to delete.

10. Expand “Root Container” > Scroll down > Expand “Top Information Store”.

Then right click “Inbox” > “Open associated contents table”.

11. Locate and click the items that have the IPM.Rule.Version2.Message as a “Message Class”

Select all messages you want to delete > Right click > “Delete message”.

12. Choose “Permanent delete passing DELETE_HARD_DELETE (unrecoverable)" > “Ok”.

13. Once all rules have been deleted, you may import the inbox rules back or create new ones.