Which attributes are needed for Directory Synchronization to mailbox-enable an object (4254827)

Which attributes are needed for Directory Synchronization to mailbox-enable an object

In some migration projects it is necessary to skip as many attributes from synchronization as possible, so in the Migration Manager user interface all or most of the selectable attributes are skipped.  As a result Directory synchronization is not mailbox-enabling the target objects.  One of the possible indications of an issue is not limited to, but possibly the following error found in DSA log file:

"Error 0xe1000010. Attribute msExchMasterAccountSid not found in object."

There are some attributes necessary for the mailbox-enabling, that absolutely need to be allowed to sync.  Even though some of them cannot be synchronized because of specific project requirements, for example objectSID, objectgGUID or legacyExchangeDN, they should not be skipped in the QMM user interface.  When they are included in the sync, it doesn't mean they will be copied from source to the target.  For example homeMDB attribute value cannot be copied to the target user because the mailbox store names are unique (environment-specific).  The exclude list however, affects internal DSA operation, the way it works is

1) object is read from the source environment, all of its attributes are stored in memory of DSA machine
2) all skipped attributes are erased from this stub temporary object in memory
3) various conversions and modifications are performed on the temporary object
4) the results  are applied to the target

So, for example, if legacyExchangeDN is allowed to sync, it will be disregarded during step 3 above and a new legacyExchangeDN will be generated properly for the target objects (depending on the source user's primary smtp prefix and the store selected in "specify exchange options" tab in the synchronization properties).  However, if this attribute is skipped, its content will not be available during step 3 and some other DSA components using this information may fail, for example the one that keeps repliability between environments and adds source legacyExchangeDN to the target x500 address.

In addition to the above, the source mailbox must be fully initialized and logged into by the user that owns it prior to migration. If the source user mailbox has never been logged into by the user account, it may not be properly mail enabled or synced to the target thereafter.

Most of the attributes listed below will not actually be synchronized when allowed to sync.  However they are required to be available during the time when DSA is working on temporary object in memory before applying it to the target environment:

• cn
• groupType
• homeMDB
• homeMTA
• legacyExchangeDN
• mail
• mailNickname
• msExchHomeServerName
• msExchMailboxGuid
• msExchMailboxSecurityDescriptor
• msExchMasterAccountSid
• msExchPoliciesExcluded
• msExchPoliciesIncluded
• msExchUserAccountControl
• name
• objectClass
• objectGUID
• objectSid
• proxyAddresses
• sAMAccountName
• targetAddress
• textEncodedOrAddress
• userAccountControl
• whenChanged

If all target objects exist prior to synchronization, it is possible to also skip "samAccountName" and name attributes.

Please see the following solutions related to skipping attributes. SOL31860 - Script to skip all attributes in the QMM for Exchange migration scenarios. - https://support.quest.com/Search/SolutionDetail.aspx? SOL31860 SOL9898 https://support.quest.com/Search/SolutionDetail.aspx? SOL9898 - Is it possible to simply match source accounts to target accounts, without synchronizing attributes? https://support.quest.com/Search/SolutionDetail.aspx?id=SOL9898