-
Title
Microsoft.Exchange.WebServices.Data.ServiceResponseException: Active Directory is unavailable. -
Description
When trying to synchronize mailboxes to Exchange 2013 using the MAgE (Migration Agent for Exchange) the following message is displayed for all the mailboxes in the collection.
Microsoft.Exchange.WebServices.Data.ServiceResponseException: Active Directory is unavailable. Try again later.
Review of the Application log on the event server showed Event ID 2112 was present.Details Product: Exchange Event ID: 2112 Source: MSExchangeADAccess Version: 8.0 Symbolic Name: DSC_EVENT_NO_SACL Message: Process %1 (PID=%2). The Exchange computer %3 does not have Audit Security Privilege on the domain controller %4. This domain controller will not be used by Exchange Active Directory Provider. Explanation This Warning event indicates that the Exchange server specified in the event description does not have the Audit Security Privilege on the domain controller specified in the event description. DSAccess will not use the domain controller specified in the event description until this warning is fixed. The possible causes of this event include the following:
A recent permissions change removed the rights required for the Exchange Security Group to enable DSAccess to communicate with the Active Directory® directory service.
Exchange groups such as Exchange Servers and Exchange Enterprise Servers were moved out of default Users container.
-
Cause
The MAgE uses EWS (Exchange Web Services) to inject mail into the target mailbox. When the MAgE connects via autodiscover the message returned by EWS is ErrorADUnavailable. This error occurs when Active Directory is unavailable. Try your request again later. -
Resolution
This can be caused by a number of different issues such as the Exchange Server not being able to contact Active Directory.
In this scenario the Exchange Server was new and didn't correctly add itself to the "Exchange Domain Servers" built-in group as it should have during installation. Once the server was added to the group the event errors were gone and the MAgE agent was functioning normally.
User Action To resolve this warning, do one of more of the following:
Run the policytest.exe utility. This utility is located in the \i386\Server\Setup\ServerRoles\Common folder on the Microsoft® Exchange Server CD. The policytest.exe utility produces a list of domain controllers and reports the presence or absence of the required privilege on these domain controllers.
If policytest.exe reports that the required privileges are found on all domain controllers, review the System log on the domain controller to try to determine the root cause of this problem.
If the policytest.exe indicates that the required privileges are not present, do the following:
Open the Default Domain Controllers Security Settings snap-in on the domain controller specified in the event description.
In the console tree, under Security Settings, expand Local Policies, and then click User Rights Assignments.
In the results pane, double-click Manage auditing and security log. Verify that both the Exchange Servers group and the Exchange Enterprise Servers group are listed.
Make sure that the Exchange server is still a member of the Exchange Domain Servers group. Also, make sure that the Exchange Domain Servers group is a member of Exchange Enterprise Servers group.
Make sure that the group permissions are inherited by the Microsoft Exchange computer account.