Directory Synchronization Agent (DSA) error: "Common Error 0xe1000010. Attribute extensionAttribu (4259784)

Directory Synchronization Agent (DSA) error: "Common Error 0xe1000010. Attribute extensionAttribu

Directory synchronization is not progressing and upon reviewing the dsa.log the are re-occurring errors similar to the following:

"Common Error 0xe1000010. Attribute extensionAttribute15 not found in object."
 

This error can be caused by either skipping the matching attribute in the domain pair properties or duplicating the already synchronized account together with the matching attribute that is already populated.

Please see the following quotes from Migration Manager release notes:

* The following attributes should not be skipped from directory synchronization: DSA service attributes (extensionAttribute15, extensionAttribute14, adminDescription, AdminDisplayName), objectClass, objectGUID, userAccountControl, objectCategory, objectSID, msExchMasterAccountSid, msExchMailboxSecurityDescriptor. Otherwise, you may experience problems during directory synchronization.

* If a new user is created on the source or target using an existing user as a template, its extensionAttribute15, which contains information about matching, is copied from the template as well. If the directory synchronization is running, this will result in incorrect object matching. The workaround is to clean the extensionAttribute15 for the incorrectly matched user.
Please note: for the one way DSA sync the matching attributes are populated on the target and that is where the conflict needs to be examined. In a two-way sync, the attributes are populated on both source and target.

In order to resolve the problem, please perform the following:

1) Make sure that matching attribute is not skipped (Domain pair properties | Object matching | Attributes to skip).
2) Stop the directory synchronization.
3) Export the target directory information and look for duplicate values in the matching attribute.
4) Clear the value from matching attribute for all objects where duplicates were found.
5) Start the directory synchronization and monitor the log file for additional errors.

To avoid similar issues, please do not use the already synchronized objects as a template for creating new objects/mailboxes; otherwise the mismatch problem will re-occur.

It is possible to select which attributes are specifically copied by default from the user that is being used as a template. By unchecking service attributes that are being matched, one can avoid this situation when using copy user from synced Active Directory accounts. For more information, please see the Notes section of this Microsoft article: http://technet.microsoft.com/en-us/library/cc779681(v=ws.10).aspx There is also more information on service attributes referenced in the QMM User Guide which explains what the most recommended settings for these attributes are.