KRB_AP_ERR_MODIFIED - Event 4 - SBS11

Today I'm seeing several Security-Kerberos event id 4 messages on an SBS 2011 stand-alone server:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server COMPUTER1$. The target name used was RPCSS/COMPUTER2.mydomain.local. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server. This error can also happen when the target service is using a different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the service on the server and the KDC are both updated to use the current password. If the server name is not fully qualified, and the target domain (MYDOMAIN.LOCAL) is different from the client domain (MYDOMAIN.LOCAL), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

It would appear that the IP address for COMPUTER1$ in the DNS, is actually being used by COMPUTER2...  so try to find the IP address for COMPUTER2...

Open Administrator Tools -> DNS
Navigate to DNS->servername->Forward Lookup Zones->mydomain.local
Order by the Data column... which may contain mostly IP addresses
Look down the Data column for duplicated IP addresses.  In my case COMPUTER1 and COMPUTER2 had the IP address 192.168.0.15

Run a CMD window (Windows Key+R->type 'cmd'->OK) and type: ping -a 192.168.0.15 (or whatever the duplicate IP address.  Also you can run nbtstat -A 192.168.0.15 ... this resolved to COMPUTER2...

In the DNS Forward Lookup Zones for mydomain.local, I deleted anything with an IP address of 192.168.0.15 that was not COMPUTER2 - one of them was COMPUTER1.

That should prevent this error message appearing again.

For each of these computers I was also seeing a DistributedCOM Event Id 10009

DCOM was unable to communicate with the computer COMPUTER1.mydomain.local using any of the configured protocols.

These appear every 30 minutes since the last reboot.  But not in the last 90 minutes since I deleted duplicate forward lookup entries... Problem solved?   Now to figure out why the server locked us all out earlier today... WSUS overgrowth on C drive is the first contender... the SSDB is 22 GB....

Orphaned Mailboxes and Users after migration from SBS 2003 to SBS 2011

I got a call today from a colleague doing a migration from SBS2003 to SBS2011 ... Exchange 2003 to 2010.

Mailboxes had been copied and he had decommissioned the old server to find that the mailboxes were not there... they were not showing up in the new server... had deleting them removed them from both servers?

At that stage you will have disconnected the connector between the two servers...

First .. go to the disk and check the size of the Exchange Store on the disk... The new store should be the same number of Gb as the old one...

Second.. open the Exchange Mgmt Console and type

• Get-MailboxStatistics -Server servername

This should list all the mailboxes on the server.  You need to add a little bit to get more details... 

• Get-MailboxStatistics -Server servername | select DisplayName, DisconnectReason, LegacyDN, ItemCount, MailboxGuid, Database

Moved mailboxes all had a LegacyDN that contains 'first adminstrative group' - this is normal and there's no need to spend hours, as I did, thinking it was an error and trying to correct it... Apparently that doesn't matter...

What really mattered was time... wait...  The mailboxes we had transferred over were large - around 2-4GB... they were neither disabled nor anything... the new server simply had not finished processing them.  I came back to the problem about 12 hours later and they were showing up... perhaps it took less time, but they eventually showed up... in the meantime, I had created some problems for myself...

Users were showing up in AD Users and Computers, but not showing up in SBS Console - I tried remedying that using the 'Change User Roles' trick   But that just created a second mailbox that started collecting emails ... and didn't connect to the old mailbox...  Worry about users not showing up in SBS Console AFTER the mailboxes show up.  When all your users are connected to their mailboxes then run the 'Change User Role' trick.

If you have created a duplicate mailbox, the ItemCount has increased and you really don't want to lose a single email, try connecting via OWA - you might be able to hook up the 'Archive' function and archive those emails out for later retrieval...  The mailboxes I created only picked up 1 or 2 emails and so I disabled the mailbox and used the Get-DisconnectedMailbox username | Remove-DisconnectedMailbox code from Mike Pfeiffer to get rid of the newly created mailbox.

Soon.. all mailboxes were showing up - they appeared in Disconnected Mailboxes in Exchange Manager.  So I selected the mailbox and tried to connect them to a user... but the user was not showing up... The mailbox name was correct - but Exchange could not see the users in Active Directory.. strange...

• Get-User

Very simple... it produces a list of users and their RecipientType.  The users that Exchange could not see had a type of 'User' but those Exchange can see have a type 'UserMailbox'....  how to enable them?

• Get-User | where-object{$_.Name -eq "User's Name"}   - this should list one user (just to check before changing anything...)  if ok, run this:
• Get-MailboxDatabase -Server servername     - this gets the name of the database to use in this:
• Get-User | where-object($_.Name -eq "user's name") | Enable-Mailbox -Database "database name"

Now run Get-User and check the user has changed RecipientType to UserMailbox.

Now you can go back to Disconnected Mailboxes in Exchange Manager and run Connect to connect them to their mailbox... (if it didn't do it for you when you ran Enable-Mailbox).

Once you have connected all your users up.. go to SBS Console -> Users and Groups -> Users... and run the 'Change User Roles' task - select 'Standard User' in the roles and below select 'Add Role to Users' (NOT 'Replace' - then you are not changing anything).  On the next page you click the checkbox at the bottom 'Show all users from AD' and select all the users (one to start with to test) who you don't see in SBS Console...  run it all through and refresh the view.. all the users should now show up.

One last thing I forgot... and perhaps a trick to get around this issue too... when you run the 'Change User Roles' task each user is given an email address based on the current 'Email Address Policy' ... this is in Exchange Manager.. under Organization Configuration -> Hub Transport -> E-mail Address Policies -> Windows SBS Email Address Policy ... unfortunately 'First Name Only' is NOT an option.. duh!  But we can get around that...

1. Start -> Run -> adsiedit.msc  <- take care with this... if you get this far you probably are fine...
2. right-click on AdsiEdit -> Connect To... -> Select a Well-known Naming Context -> Configuration
3. Select Configuration in the console left panel -> then Configuration -> Services -> Microsoft Exchange ->  servername -> Recipient Policies
4. In the right-hand panel for Recipient Policies - right-click Windows SBS Email Address Policy select Properties
5. Click the Filter button and choose to show only attributes that have values
6. gatewayProxy has a value of SMTP:%m@mydomain.com chang
7. Click gatewayProxy and Edit - change to SMTP:%g@mydomain.com - %g is FirstName
8. click ok and exit out of AdsiEdit.msc

And finally .. a warning if you have Blackberry Enterprise Server running... I think I read somewhere there was a knowledgebase article from RIM about what to do in the migration.. .. it was for Exchange 2003 to 2007.. but best to take heed of any advice before attempting to migrate...

http://www.enowconsulting.com/ese/2009/04/bes-co-existence-during-exchange-2003.html