Why logon to the System Attendant?

Quest Migration Manager for Exchange uses the System Attendant Mailbox and requires access to this mailbox during the synchronization of data. To have access denied to this mailbox can be fairly common. Typical errors which can be displayed within the logs files of Quest Agent’s are:

11/9/2007 11:27:19 AM    CSession::Logon    TraceMsg    4800    Logging on to the mailbox ‘/o=ORG/ou=First Administrative Group/cn=Configuration/cn=Servers/cn=SERVER/cn=Microsoft System Attendant’ (Server: ‘SERVER’, user: ‘domain\account’).

11/9/2007 11:27:19 AM    CSession::Logon Error   -2147221231     The information store could not be opened. - MAPI_E_LOGON_FAILED (MAPI 1.0)  Low level error: 0×0 File: ‘aeWrapHelpers.h’ Line: ‘279′

11/9/2007 11:27:19 AM    CSession::Logon    Error    -2147221219    The attempt to log on to the Microsoft Exchange Server computer has failed. - MAPI_E_FAILONEPROVIDER (Microsoft Exchange Server Information Store)  Low level error: 0×0 File: ‘aeWrapHelpers.h’ Line: ‘264′

11/9/2007 11:27:19 AM    CSession::Logon    Error    -2147221219    The attempt to log on to the Microsoft Exchange Server computer has failed. - MAPI_E_LOGON_FAILED (Microsoft Exchange Server Information Store)  Low level error: 0×0 File: ‘aeWrapHelpers.h’ Line: ‘257′ 

Where is the System Attendant Mailbox?

There is a System Attendant mailbox for every mail store on every Exchange server. It can be viewed from the Exchange server as shown below. If this mailbox cannot be viewed, you should run clean-up agent and refresh the view in order to display the mailbox.

The mailbox is secondary visible via the Microsoft Exchange System object OU of Active Directory, as shown below. The Quest Service account requires Full Control over this entire OU. It is only visible by selecting advanced features from the View menu option.

How do I logon to the System Attendant Mailbox?

 Logon to Windows

 First logon to a machine,that has Outlook installed, as the Quest Service account credentials, and in domain of either source or target depending on where the error is being received. With Quest Mail Source (MSA) Agent, you should use the source domain, for the mail Target Agent (MTA) you should use the respective target domain. In this scenario we will use the Target domain to troubleshoot an error in the Mail Target Agent.

Obtain the LegacyExchangeDN (LEDN) of the System Attendant Mailbox

 To obtain the LEDN of the System Attendant Mailbox by using ADSIEDIT, see below

We can see above that the LEDN value is the following:

 /o=TARGET/ou=First Administrative Group/cn=Configuration/cn=Servers/cn=2KDC2/cn=Microsoft System Attendant

 Open Outlook to create a new profile

 Run Outlook and create a new profile for the System Attendant Mailbox

 On the Email Accounts screen, specify the target Exchange server and for the System Attendant mailbox and for the user name, enter the LEDN obtained from using ADSIEDIT

You should now receive confirmation of this profile creation

After which outlook will load. If you have permissions, this will load correctly, as shown below.

Download MFCMAPI

 MFCMAPI can be downloaded from the following location:

 http://www.microsoft.com/downloads/details.aspx?FamilyID=55FDFFD7-1878-4637-9808-1E21ABB3AE37&displaylang=en

 Run MFCMAPI

Select Logon and Display Store Table

 Select the profile you previously created

The stores should now be displayed, without any errors or notifications. Double click on the Mailbox store.

This should now display the mail store fully.

You may think why have we just not used MFCMAPI, and why have we run Outlook then run MFCMAPI. The reason for this is because MFCMAPI cannot resolve the LEDN of the System Attendant Mailbox. So the profile must be created within Outlook, then by loading MFCMAPI the mailbox is then viewable.

Exchange Dump

This is a command line utilty that collects and dumps information about Exchange. Downloadable from:

http://www.microsoft.com/downloads/details.aspx?familyid=d88b807d-964e-4bf8-9344-754892e9f637&displaylang=en

JetStress

Disk performance testing. Downloadable from: 32-bit http://www.microsoft.com/downloads/details.aspx?familyid=94b9810b-670e-433a-b5ef-b47054595e9c&displaylang=en 64-bit http://www.microsoft.com/downloads/details.aspx?FamilyID=73dfe056-0900-4dbb-b14a-0932338cecac&DisplayLang=en

MFCMAPI

Basic MAPI logon the the IS. Good for basic permissions troubleshooting letting you view the MAPI proptags. DOwnloadable from: http://www.microsoft.com/downloads/details.aspx?FamilyID=55FDFFD7-1878-4637-9808-1E21ABB3AE37&displaylang=en

The following takes the input variables of ‘$_’ reference and passes them through to the associated AD attribute via the -attributename command. This is for the -room object, you can also use the -mailbox object and others, just be aware of the requirements per object type.
Import-CSV C:\test\room.csv | foreach {new-mailbox -alias $_.alias -organizationalunit $_.ou -name $_.name -database $_.database -samaccountname $_.samaccountname -UserPrincipalName $_.upn -room}

For the input file, please download the following: Room CSV (This hsould be renamed back to .csv, I named it .xls because of some security risk aparently csv poses!)

Please see the following document on how to troubleshoot permission based errors that are returned through Quest products. Namely Migration Manager for Exchange and other tool which require full mailbox access and/or no denies on accounts:

Troubleshooting Exchange Permissions