MachPanel Knowledgebase

Solution to Active Directory Constraint Violation error

zohaib.shaikh — Thu, 14 Apr 2022 09:06:55 GMT

Summary

This article will provide you the solution for the issue of Active Directory Constraint Violation error

Applies to

All Exchange Versions

Error Message

Error: b: Create Global Address List: An Active Directory Constraint Violation error occurred on Dc01.Provider.local. Additional information: The name reference is invalid. This may be caused by replication latency between Active Directory domain controllers. Active directory response: 000020B5: AtrErr: DSID-03153468, #1: 0: 000020B5: DSID-03153468, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 907ff (globalAddressList2) IP= X.X.X.X

Cause

There is a corrupted GAL on Active Directory.

Solution

Issue the following Powershell script on the Active Directory server

$ad = [ADSI]"LDAP://rootDSE";

$domain = $ad.rootDomainNamingContext;

$obj = New-Object System.DirectoryServices.DirectoryEntry("LDAP://CN=Microsoft Exchange,CN=Services,CN=Configuration,$domain");

$count = 0;

$Gals1= $obj.GlobalAddressList;

foreach($g in $Gals1)

{

$g= $g.ToString().ToLower();

if($g.Contains("cn=deleted objects"))

{

Write-Host $g;

$count= $count +1;

}

Write-Host "$Count corrupted GAL entries found in property GlobalAddressList";

$count = 0;

$Gals2= $obj.GlobalAddressList2;

foreach($g in $Gals2)

{

$g= $g.ToString().ToLower();

if($g.Contains("cn=deleted objects"))

{

Write-Host $g;

$count= $count +1;

}

Write-Host "$Count corrupted GAL entries found in property GlobalAddressList2";

the output will be like below:

PS C:\> .\check.ps1

cn=test.com gal\0adel:1b6f6184-3e84-44a9-8905-54dd55a7407a,cn=deleted objects,cn=configuration,dc=provider,dc=local

1 corrupted GAL entries found in property GlobalAddressList

0 corrupted GAL entries found in property GlobalAddressList2

PS C:\>

Remove corrupted GALs from script output (highlighted in example above as cn=test.com gal\0adel:1b6f6184-3e84-44a9-8905-54dd55a7407a,cn=deleted objects,cn=configuration,dc=provider,dc=local) in : ADSI edit utility > Configuration > Services > CN=Microsoft Exchange > Properties > GlobalAddressList
- If there will be corrupted GALs in GlobalAddressList2 - remove them as well.
Re-run the task

To Hide Default Security Group from GAL / Address Book

rehan_waseem — Fri, 23 Jan 2015 00:05:23 GMT

Summary

You see a security group as <OrganizationName> Exchange SG in your Global Address List and want to hide it and not show in Address Book.

Applies To

MachPanel 5.1.12 HF1 and above.
Hosted Exchange Extension (HEE)
MachPanel Remote Server

Cause

This Security Group is created via MachPanel and poses no harm/threat whatsoever to your Exchange setup. For Exchange 2013 this is not in use for now for anything but will be used in future for further advanced implementations. With older exchange versions (earlier than 2013) it was used to handle some aspects of Multi-Tenancy.

Pr-Requisites

Update Control and Remote server to latest build 5.1.12 and apply hotfix below by replacing Control and Remote Server files from following link and execute script:

http://kb.machsol.com/Knowledgebase/Article/53469

Note: Ensure to take backup of Control and Remote server files and MachPanel_Db before applying update.

If you are already running Build 5.1.12 HF1 or higher, then adding the registry values as shown below will do the trick for you.

Solution

For New Organizations:

Please follow the below mentioned steps to hide the security group from Address Book for organizations that will be provisioned after this registry key is added. The registry key needs to be added on ALL exchange servers managed by MachPanel.

Add a new Key in all Remote Exchange servers registry:
SOFTWARE\MachSol\MachPanel\

New String Key value pair:

Key: HideOSGFromAL

Value: True

1. Now when you provision new Organizations, the <OrganizationName> Exchange SG created will have HiddenFromAddressListsEnabled = True.

For Existing Organizations:

In order to set HiddenFromAddressList = True for existing Security Groups created by MachPanel, execute following script in EMS (Exchange Management Shell) Power Shell on Exchange Server:

Get-DistributionGroup "* Exchange SG" | Set-DistributionGroup -HiddenFromAddressListsEnabled:$True -Confirm:$False

Microsoft Exchange 2007 Multi-Tenant Hosting - Hide Email In Global Address List - GAL

fawad.khan — Wed, 19 Nov 2008 06:04:47 GMT

Summary
Multiple hosted exchange organizations on single Exchange server is called multi-tenant Exchange hosting. In multi-tenant exchange hosting the address books and organizations should be separated and hidden from each other. The article discusses how to achieve this.

Following areas are covered in this article.

Address List Segregation in multi-tenant exchange hosting environment
Securing Address list - Hiding the email addresses from the GAL
Multi Tenant Hosting in Microsoft Exchange Server 2007

Applies To
MachPanel all versions
Microsoft Exchange 2007 SP1

Solution
Machpanel only facilitates hosted email service provisioning and management on Microsoft Exchange 2007. There is separate service preparation procedure to prepare your active directory and Exchange server to host multiple organizations. The following Microsoft whitepaper describes shared hosting scenario where multiple companies are shared using the same Active Directory domain and can interoperate with each other. We recommend that you read and follow this white paper to properly secure your hosted exchange service:

http://technet.microsoft.com/en-us/exchange/bb936719.aspx

Note:
The above solution may not be valid for HMC 4.0/MPS deployment. For more information about the Microsoft HMC solution, see: Microsoft Solution for Hosted Messaging and Collaboration version 4.0.