Microsoft Active Directory Connector

Active Directory Connector

Microsoft® Active Directory TM Connector (ADC) replicates a hierarchy of directory objects between the Microsoft® Exchange Server version 5.5 directory and the Microsoft® Windows 2000 Server Active Directory.

  • For help with specific tasks, see How To...
  • For general background information, see Concepts.
  • For problem-solving instructions and preventive maintenance information, see Maintenance and Troubleshooting.


How To...

This section covers procedures for installing and setting up ADC.

  • Install Active Directory Connector
  • Set up a Connection Agreement
  • Set Advanced Options
  • Set up a Replication Schedule


Install Active Directory Connector (ADC)

Install Active Directory Connector

Perform the following steps to install Microsoft Active Directory Connector:

  1. Start the ADC Installation Wizard
  2. Choose an Installation Type
  3. Select Components
  4. Specify the Installation Directory
  5. Specify the Service Account


Start the ADC Installation Wizard

Before starting the ADC Installation Wizard, close any applications you are running to avoid damaging system files or shared files.

  1. Insert the Windows 2000 Server CD into your CD-ROM drive.
  2. In the Windows 2000 CD ROM window, click Browse This CD.
  3. Open the Valueadd folder, open the MSFT folder, open the Mgmt folder, open the ADC folder, and then double-click Setup.exe. If your computer has Autoload turned off, go to My Computer to browse the CD to locate your CD drive.

Note

If this is a new ADC installation, the wizard skips the Add/Remove/Reinstall screen and displays the Component Selection screen.


Choose an Installation Type

There are three choices for installation:

  • To add new ADC components or remove installed ADC components, click Add/Remove. Select this option to display the Component Selection dialog box.
  • To repeat the last installation and restore missing files and settings,click Reinstall.
  • To remove all previously installed ADC components, click Remove All.

    Important

    Clicking Remove All deletes the Connection Agreements hosted on this server. Rehost the Connection Agreements on another server with ADC if you want to preserve them.

Note

During this step, if the ADC Installation Wizard detects a previous installation of any ADC component, the ADC Installation Wizard adds, removes, or reinstalls those components.


Select Components

ADC contains the Active Directory Connector Sites and Services and the Active Directory Connector Management components. You should install only a single instance of the Active Directory Connector Sites and Services on the computer running Windows 2000 Server. However, you can install as many instances of the Active Directory Connector Management snap-in as are necessary to provide adequate management.

  1. Select the Microsoft Active Directory Connector Service component check box to install the ADC Service, or click to clear the check box to remove it.
  2. Select the Microsoft Active Directory Connector Management components check box to install the ADC Management components, or click to clear the check box to remove them.


Specify the Installation Directory

  • In the Install Location screen, specify a directory in which to install ADC. The default path is %SystemDrive%\Program Files\MSADC.

Note
Setup calculates the amount of space required to install ADC and the amount of space available on the current drive. If sufficient space is not available, ADC cannot be installed.


Specify the Service Account

Note

ADC requires a valid Windows 2000 Server account name and password.

  1. In Account name, type the domain name and account name in the form <Domain>\<Name>, or click Browse to select an account name from the list of accounts available on the domain controller for this computer.
  2. In Account password, type the password.


Set up a Connection Agreement

Before directory replication can be performed, you must configure a connection agreement to define the type of connection, authentication, and server names. Use Microsoft Management Console to configure connection agreements.
  1. On the Start menu, point to Programs, point to Administrative Tools, and then click Active Directory Connector Management.
  2. In the console tree, click Active Directory Connector
    3. .
  3. On the Action menu, point to New, and then click Connection Agreement to display the Properties dialog box.
  4. On the General tab, in Name, type a name for the Connection Agreement. If you use the symbols /,\,+,<,>,&,^,|,[, ] to create a Connection Agreement, they will not appear if you view the names of your connection agreements from Windows Explorer. For example, a Connection Agreement called CA+[Test] will appear as CA Test in Windows Explorer because + and [] are illegal characters.
  5. Under Replication direction, click one of the following replication directions:
    • To perform a two-way replication, click Two-way. During a two-way replication, the Windows directory is first updated with Exchange directory information.
    • To update the Windows directory, click From Exchange to Windows.
    • To update the Exchange directory, click From Windows to Exchange.

    Note To have the option to add Exchange mailboxes when creating new users in Active Directory Users and Computers, you must configure a two-way Connection Agreement or a one-way Connection Agreement from Windows to Exchange. A one-way Connection Agreement from Exchange to Windows will not provide the option to add a mailbox for the user because one already exists.

  6. Under Active Directory Connector service, click the service to run the Connection Agreement. Only services that are compatible with the Connection Agreement you are creating or editing are shown.
  7. On the Connections tab, type the Windows 2000 Server name and the Exchange server name in Server. The specified server must be the domain controller containing the schema. Click an authentication option in Authentication. The authentication options are:
    • Windows Challenge/Response
      Enable authentication using Windows network security.
    • Windows Challenge/Response using Secure Sockets Layer (SSL)
      Enable authentication using Windows network security through an SSL-encrypted channel.
    • Basic (Clear Text) using SSL
      Enable authentication using clear text through an SSL-encrypted channel. Legacy Connection Agreements must use this type of authentication.

    Note

    In a two-way replication, the specified Exchange and Windows authentication type and credentials must be able to write to and read from both the Exchange directory and the Windows 2000 Server Active Directory. In a one-way replication, the authentication type and credentials must have read access to the export directory where the information is replicated from, and write access to the import directory where the information is replicated to.
  8. To specify the account name to be used for this replication, click Modify to display the Connect as dialog box. In Connect as, type the account name in the form appropriate for the type of authentication you specified. The appropriate formats are shown in the following table. Then, in Password, type the password. Click OK.
    9. Authentication Type | Account Name Form
Windows Challenge/Response | <domain name>\<account name> for example: Redmond\gladysl
Basic (Clear Text) | CN=<account name>,OU=<organizational unit>, DC=<domain> for example: CN=gladysl,OU=Admin,OU=Exchange,DC=Microsoft,DC=Com
    Note When replicating from Exchange you must include the domain name regardless of the authentication type.
  9. On the Connections tab, under Port, you can type an alternative Lightweight Directory Access Protocol (LDAP) port number for the Exchange directory.

    10. Note To verify the port number currently being used by the Exchange directory, use the Exchange Server Administrator program to check the Port number setting on the General tab of the LDAP (Directory) Settings object. It is located in the organization name/site name/Configuration/Servers/server name/Protocols container.

  10. On the Deletion tab, click a method for deleting items during replication.

    When you replicate deletions from a Windows 2000 Server Active Directory to an Exchange directory, select one of the following:

    • Delete the Exchange mailbox
      Click this option to delete from the Exchange directory any user account deleted in the Windows directory.
    • Keep the Exchange mailbox and store the deletion list in the temporary CSV file
      Click this option to store the list of deleted items in a common comma-separated value (CSV) formatted file. Information is appended to this file as replication occurs. The log file is located in %SystemRoot%\Program Files\MSADC\MSADC\<Connection Agreement name>\ex55.csv. No checking or maintenance is performed on the LocalToRemote directory, therefore you must ensure that adequate disk space is available for the file. If the file is no longer needed, you can remove it to increase the amount of space available on the disk.

    When you replicate deletions from an Exchange directory to the Windows 2000 Server Active Directory, select one of the following:

    • Delete the Windows account
      Click this option to delete from the Windows directory any user account deleted in the Exchange directory.
    • Keep the Windows account and store the deletion list in the temporary LDF file
      Click this option to store the deletions performed in Exchange as a list of deletions in an LDF formatted file. Information will be appended to this file as replication occurs. The log file is located in %SystemRoot%\Program Files\MSADC\MSADC\<Connection Agreement name>\Win2000.ldf. No checking or maintenance is performed on the <Connection Agreement name> directory, therefore you must ensure that adequate disk space is available for the file. If the file is no longer needed, you can remove it to increase the amount of space available on the disk.
    Note
    To review the deletions list, open the log file in Notepad, or, for .csv applications you can use a spreadsheet application.

    To update the Windows 2000 Service Active Directory with the deletions recorded in the log file, use the LDIF Directory Synchronization Bulk Import/Export tool (Ldifde.exe) found in the &SystemRoot%\WINNT\System32 directory.

Before you can specify the Exchange recipient containers to use when updating the Windows 2000 Server Active Directory, you must configure your connection agreement to replicate from Exchange to Windows. For help configuring your connection agreement, see Replicating from Exchange to Windows.

Before you can specify the Windows 2000 Server Active Directory organizational units to use when updating the Exchange directory, you must configure your connection agreement to replicate from Windows to Exchange. For help configuring your connection agreement, see Replicating from Windows to Exchange.

To set up a replication schedule to perform automatic replication at regular intervals, see Set up a Replication Schedule.

Related Topics

Understanding Secure Authentication

Replicate from Exchange to Windows

Replicate from Windows to Exchange

Set a Default Policy for Replication

Set Advanced Options

Set up a Replication Schedule


Set a Default Policy for Replication

When replicating directory information using a Connection Agreement, you can set the default attributes that will be replicated using a Policy. A Policy allows you to set configuration options that are shared across multiple Connection Agreements.
  1. In the console tree, right-click Active Directory Connector Management, and then click Properties on the shortcut menu.
  2. Click either the From Exchange tab or the From Windows tab depending on the direction you plan to replicate. If you are going to perform a two-way replication, select attributes in both places.
  3. From the list of attributes, select the ones you want to be replicated by default for your Connection Agreement.

Note Attributes you select affect all Connection Agreements. If you clear attributes on Exchange, also clear the same attributes in Windows 2000.

Related Topics

Set Up a Connection Agreement

Log Replication Events


Replicate from Exchange to Windows

Before configuring replication you must Set Up a Connection Agreement.
  1. On the Start menu, point to Programs, point to Administrative Tools, and then click Active Directory Connector Management
    2. .
  2. In the details pane, double-click the Connection Agreement for which you want to configure replication.
  3. On the From Exchange tab, click Add.
  4. In the Choose a container dialog box, click the export container in the Exchange directory that you want to replicate. Click OK.
  5. To specify where the Exchange container will replicate to, click Modify, and then click the appropriate Windows 2000 Server Active Directory container. If the container you selected contains multiple objects, select the objects you want replicated to Windows list.
  6. To verify that replication was successful, view the entire Active Directory in Active Directory Users and Computers.
To set up diagnostic logging to configure which replication events are displayed in the Windows Event Viewer, see Log Replications Events.

Note

Two replication cycles may be required before all information, such as attributes, will appear on the Exchange property pages of a replicated Windows object.


Replicate from Windows to Exchange

Before configuring replication, you must Set Up a Connection Agreement.
  1. On the Start menu, point to Programs, point to Administrative Tools, and then click Active Directory Connector Management
    2. .
  2. In the details pane, double-click the Connection Agreement for which you want to configure replication.
  3. On the From Windows tab, under Windows organizational units, click Add.
  4. In the Choose a container dialog box, click the export container in the Windows 2000 Server Active Directory that you want to replicate. Click OK.
  5. To specify where the Windows organizational unit will replicate to, click Modify, and then click the appropriate Exchange directory container. If the organizational unit you select contains multiple objects, select the objects you want to replicate to Windows.
  6. Verify in the Exchange Administrator program that replication was successful.
To set up diagnostic logging to configure which replication events are displayed in the Windows Event Viewer, see Log Replications Events.

Note

Two replication cycles may be required before all information, such as attributes, will appear on the Exchange property pages of a replicated Windows object.


Set Advanced Options

Use the following procedures to set advanced options:

  • Specify Synchronization Page Sizes
  • Designate a Primary Connection Agreement
  • Replicate a Mailbox that Doesn't Have a Primary Windows Account in the Domain


 Specify Synchronization Page Sizes

Paging provides a method to improve synchronization performance by grouping objects to be synchronized before each request for synchronization service. More entries per page cause fewer requests but require more memory.

  1. In the details pane, double-click the Connection Agreement for which you want to specify synchronization page sizes.
  2. On the Advanced tab under Paged results, type the number of entries per page you want to use during synchronization in Exchange Server entries per page.

Important

The page size for Exchange should not exceed the LDAP search results setting on your Exchange server. If you set the page size to zero paging will not occur.


 Designate a Primary Connection Agreement

  1. In the details pane, double-click the Connection Agreement for which you want to specify synchronization page sizes.
  2. On the Advanced tab, select either This is a Primary Connection Agreement for the connected Exchange organization or This is a Primary Connection Agreement for the connected Windows domain to designate a Primary Connection Agreement.

A Primary Connection Agreement replicates existing directory objects. It also creates and replicates new directory objects in the destination directory for other directory objects being replicated. A non-primary Connection Agreement only replicates information to pre-existing objects.

Important If you are using more than one Connection Agreement to replicate Windows user accounts to a single Exchange organization, it is important that only one of the Connection Agreements is designated as a primary Connection Agreement. Multiple primary Connection Agreements replicating to the same Exchange organization will result in duplicate recipient objects in the Exchange organization. The check boxes are selected by default regardless of whether a Connection Agreement already exists in the organization.


 Replicate a Mailbox that Doesn't Have a Primary Windows Account in the Domain

  • On the Advanced tab, in When replicating a Mailbox whose Primary Windows Account does not exist in the Domain, click one of the following options:
      • Create a Windows Contact A pointer to a foreign address or a recipient outside the organization.
      Create a disabled Windows User Account A user account that does not permit logons.
      Create a new Windows User A record that consists of all the information that defines a user to Windows 2000. It creates a new user account in the Windows 2000 directory that includes the membership groups and the rights and permissions for the user.


Set up a Replication Schedule

  1. In the details pane, double-click the Connection Agreement for which you want to schedule replication.
  2. On the Schedule tab, click Never, Always, or Selected times.
    • Click Never to disable the Connection Agreement.
    • Click Always to enable automatic replication whenever the source directory changes.
    • Click Selected times to configure replication times. Click the boxes in the schedule that correspond to the time(s) and date(s) you want to synchronize the directories.

    For example, to schedule replication for every Wednesday at 6:00 P.M., click Selected times, and then click the schedule grid in the box that corresponds to 6:00 P.M. vertically, and Wednesday horizontally.

  3. Under Detail view, click 1 hour to display the schedule in 1-hour intervals, or 15 Minute to display the schedule in 15-minute intervals.
  4. To only replicate changes to the directory, click to clear the Replicate the entire directory the next time the agreement is run check box. If you want to replicate the entire directory, select this option. The first time replication occurs, the entire directory is replicated by default.

Related Topics

Planning a Replication Schedule

Initiate an Unscheduled Replication


Initiate an Unscheduled Replication

  1. In the details pane, right-click the Connection Agreement for which you want to initiate replication.
  2. On the shortcut menu, point to All Tasks, and then click Replicate Now.
Note Replication speed varies depending on the complexity of the domains and numbers of servers. It may take a few minutes before results are visible.

Related Topics

Planning a Replication Schedule

Set up a Replication Schedule


Concepts

This section provides general background information about Active Directory Connector (ADC):
  • Active Directory Connector Overview
  • Understanding Connection Agreements
  • Understanding Default Policies
  • Understanding Secure Authentication
  • Planning a Replication Schedule
  • Configuring Replication Objects
  • Mail-Enabled Objects
  • Mailbox-Enabled Objects


Introduction to Active Directory Connector Replication

Active Directory Connector Overview

Active Directory Connector (ADC) provides a method for replicating a Microsoft Exchange Server version 5.5 directory with the Microsoft Windows 2000 Server Active Directory. You can perform replication from either direction, depending on how you configure the connection agreement.

Use ADC to:

  • Replicate selected containers in the Windows 2000 Active Directory to equivalent containers in the Exchange Server directory.
  • Replicate selected Exchange directory containers into equivalent Windows 2000 Server Active Directory containers.

Microsoft Windows 2000 Server Active Directory Users and Computers

The Windows Administrator manages users, groups, and contacts within Windows 2000 Server Active Directory Users and Computers. When you perform directory replication from Windows to Exchange, the selected Windows 2000 Server Active Directory objects are added to the Exchange directory.

Microsoft Exchange Server Administrator Program

The Exchange Administrator program manages mailboxes, custom recipients, and distribution lists within the Exchange directory. When you perform directory replication from Exchange to Windows, the selected Exchange objects are added to the Windows 2000 Server Active Directory.


Understanding Connection Agreements

A connection agreement acts as a control mechanism for directory replication between the Microsoft Exchange Server version 5.5 directory and the Microsoft Windows 2000 Server Active Directory. The connection agreement defines the following:
  • Directory, or directories, to be replicated
  • Exchange replication objects
  • Windows replication objects
  • Replication direction
  • Schedule
  • Deletion method
  • Advanced options
Although only one instance of the ADC can be installed on a single computer running Windows 2000 Server, multiple Connection Agreements can be established. Each Connection Agreement can be configured to perform unique replication tasks. For example, one Connection Agreement can continuously update the Windows 2000 Server Active Directory, while another Connection Agreement can update the Windows contacts to the Exchange directory daily at 6:00 P.M.

Note To have the option to Exchange mailboxes when creating new users in Active Directory Users and Computers, you must configure a two-way Connection Agreement or a one-way Connection Agreement from Windows to Exchange. A one-way Connection Agreement from Exchange to Windows will not provide the option to add a mailbox for the user because one already exists.

You can also establish Primary Connection Agreement. A Primary Connection Agreement creates new objects, while all other Connection Agreements only replicate information to existing objects.

Related Topics

Set Up a Connection Agreement


Understanding Default Policies

When you replicate directory information using a Connection Agreement, you can set the default attributes that will be replicated using a Policy. A Policy allows you to set configuration options attributes that are shared across all Connection Agreements.


Understanding Secure Authentication

ADC offers two types of password authentication and the option of using Secure Sockets Layer (SSL) encryption. The two types of password authentication offered are:

  • Basic (Clear Text) sends the password and the message over the network unencrypted.
  • Windows Challenge/Response does not transfer the password over the network during authentication, and other authentication information is transferred unencrypted.

Applying SSL encryption to either type of authentication determines if the entire transaction session is encrypted. If you are replicating to a server that is located outside of your organization, you should use SSL encryption. If you choose Basic (Clear Text) authentication with SSL, all authentication information transferred over the network is encrypted. Choosing Windows Challenge\Response with SSL encrypts authentication information that is transferred over the network.

Note

Data replicated using SSL encryption must be encrypted before being sent and then unencrypted by the receiving server before it can be added to the destination directory. These additional operations slow replication performance somewhat.


Basic (Clear Text) Authentication

When you connect to Windows 2000 Server, the Connect as user account is specified as an object in the Windows 2000 Server Active Directory. The account name must be in the following format:

    CN=<account name>,OU=<organizational unit>, DC=<domain>

    for example:

    CN=gladysl,OU=Admin,OU=Exchange,DC=Microsoft,DC=Com
or:
    CN=<account name>,OU=<container>,DC=<domain>,DC=<domain>

    for example:

    CN=gladysl,CN=Users,DC=Microsoft,DC=Com

When you connect to Exchange, the Connect as user account is specified as an account in the Windows domain. Objects in the Users container are under CN=Users. The account name must be in the following format:

    CN=<account name>,DC=<NT domain name>

    for example:

    CN=gladysl,DC=Redmond


Windows Challenge/Response Authentication

When you connect to either Windows 2000 Server or Exchange, the Connect as user account is in the following format:
    <NT domain name>\<account name>

    for example:

    Redmond\gladysl


Planning a Replication Schedule

You can set up individual connection agreements to perform replication on a defined schedule. You must determine the most appropriate times for each replication process. A network with a large number of users may require more frequent replication than a smaller network. Also, some networks may require specific objects to be replicated more frequently than other objects.

These are some of the situations you must consider when planning a replication schedule:

  • Will you be replicating more than 500 users or mailboxes? If so, you can improve performance by setting up multiple connection agreements to replicate different objects at different times.
  • If you make daily changes to either directory and do not need the changes to appear in the other directory until the next day, you should schedule replication nightly.
  • If there are times during the day when other replication occurs on either computer involved in the connection agreement, schedule the connection agreement around these times.
  • If directory manipulation is commonly done at a specific time or times of the week, customize the replication to occur soon after the changes are made and only after the changes are made.
Use the connection agreement Schedule tab to establish a replication schedule for each connection agreement. For more information on setting up a replication schedule, see Set up a Replication Schedule.


Configuring Replication Objects

In Active Directory, you can use organizational units to group information. Organizational units are logical containers in which to categorize objects such as users, groups, and computers. For maximum scalability and reduced administration, you can organize your Exchange objects, such as mailboxes and distribution lists, into recipient containers that mirror the organizational unit structure you create in Windows.

For example, in Windows you would configure four organizational units: internal users, guests, groups, and computers. Then in Exchange, you would create only three recipient containers: internal users, guests, and groups, intentionally not creating a recipient container to correspond with the Windows computers organizational unit. Next, place all of your regular internal corporate users in the internal users container. Finally, place your custom recipients in the guests containers and your distribution lists in the groups container.

With this infrastructure in place, you can set up three connection agreements between the corresponding Windows and Exchange organizational units. If you configure your connection agreement to replicate from Windows to Exchange, new internal users created in Windows would automatically be replicated to the correct Exchange recipient container.

Note Windows 2000 has many group membership restrictions, for example domain local groups cannot be members of global groups. If you do not respect the Windows 2000 limitations in Exchange 5.5, then the membership can not replicate to Windows 2000.

Related Topics

Set up a Connection Agreement


Mail-Enabled Objects

A mail-enabled object has an e-mail address associated with it but no Exchange mailbox, and thus it can receive e-mail from Exchange users, but would have to connect to a third-party application to send e-mail, for example, Hotmail. You can use the Windows 2000 Server Active Directory Users and Computers to enable a user, group, or contact's e-mail capabilities.


Mailbox-Enabled Objects

A mailbox-enabled object is an object that has an Exchange mailbox associated with it, and thus it can both send and receive e-mail. Only Windows user accounts can be mailbox-enabled. You can use the Windows 2000 Server Active Directory Users and Computers to enable a mailbox capabilities for a Windows 2000 user account.


Maintenance and Troubleshooting

When running ADC, you should monitor the activities of each connection agreement to ensure that proper directory replication is accomplished. Monitoring should be a part of regularly scheduled maintenance. Regular maintenance helps you keep directory replication performing optimally, and can help you keep failures and errors to a minimum.

You perform maintenance by setting up the ADC diagnostic logging and monitoring in the Windows event log. You perform troubleshooting by reading and interpreting the ADC-related events written in the event log to determine appropriate repair activities.

Related Topics

Log Replication Events

None Logging Level

Minimum Logging Level

Medium Logging Level

Maximum Logging Level


Log Replication Events

Use the Diagnostics Logging tab on the Active Directory Connector Properties dialog box to change logging levels and select logging categories for the Active Directory Connector service. Each logging category provides informational, warning, and error message types. Use the following procedure to configure diagnostic logging:
  1. On the Start menu, point to Programs, point to Adminstrative Tools, and and then click Active Directory Connector Management, to start Microsoft Management Console.
  2. In the left pane highligh Active Directory Connector.
  3. On the Action menu, click Properties to view the Active Directory Connector Properties dialog box.
  4. On the Diagnostics Logging tab, select the logging category you want to configure, and then choose the appropriate logging level from the Category Logging Levels list.
The following table describes each of the logging categories:
Category | Description
Replication | Messages indicating events that occurred during replication
Account Management | Messages indicating events that occurred while attempting to write or delete a Windows object during replication.
Attribute Mapping | Messages indicating events that occurred while mapping attributes between Windows 2000 Server Active Directory and the Exchange directory.
Service Controller | Messages indicating events that occurred when the service starts and stops.
LDAP Operations | Messages indicating events that occurred while accessing the directory using LDAP.

The logging levels available are None, Minimum, Medium, and Maximum. These levels are described in the following table:

Level | Description
None | This is the default logging level. Logs only critical events and error events, including starting and stopping the service and component installation.
Minimum | Logs events including the success or failure of adding or removing a user account, errors encountered when establishing Light Directory Access Protocol (LDAP) sessions, and errors updating the directory.
Medium | Logs events including those associated with the existence of specific objects in the directory and proxy error warnings.
Maximum | Logs all events and provides a complete record of the operation of the ADC service and the status of replication. Unless you are troubleshooting a problem, avoid using the Maximum logging level because it logs a large amount of information and can affect server performance.

Related Topics

None Logging Level

Minimum Logging Level

Medium Logging Level

Maximum Logging Level


None Logging Level

Logging Level -- None

Message | Component | Source | Event ID | Explanation | User Action
The service was started. | Active Directory Connector | MSADC | 8001 | Notification message. The initialization process has completed successfully. | No user action required.
The service was stopped. | Active Directory Connector | MSADC | 8002 | The Service Control Manager has returned this request. The service was shutdown successfully. | This message requires no action and is informational only. If the service was shutdown unexpectedly due to errors, start the service manually. If the service will not start, check the event log with Event Viewer for more details about related errors.
LDAP Add on directory <directory name> for entry '<entry name>' was unsuccessful with error:[0x<error code>] <error code> | Active Directory Connector | MSADC | 8021 | If the accompanying LDAP message refers to LDAP_OTHER, the directory service may be out of disk space. | Check network connectivity. Verify the user name, password, and port address are correct, and try again. If the problem persists, verify that the remote Exchange server is configured to support LDAP.
Could not open LDAP session to directory '<server name>' using local service credentials. Cannot access Connection Agreement configuration information. Make sure the server '<server name>' is running. | Active Directory Connector | MSADC | 8062 | ADC could not gain access to Windows 2000 domain controller. | Make sure ADC's service account has permissions to read its configuration information from the Active Directory.
Could not read the root entry on directory '<directory name>'. Cannot access configuration information. | Active Directory Connector | MSADC | 8063 | Unable to read the directory's root entry or its attributes. | Verify network connectivity. Attempt to read attributes on the directory.
Could not read entry '<entry name>' on directory <directory name>. Cannot access Connection Agreement information. Make sure that ADC was installed properly. | Active Directory Connector | MSADC | 8064 | ADC could not find its service object. | Make sure ADC's service account has permissions to read its configuration information from the Active Directory.
Could not search under entry '<entry name>' on directory <directory name>. Cannot access Connection Agreement information. | Active Directory Connector | MSADC | 8065 | ADC could not find the Connection Agreements Container or does not have permissions to read the container. | Make sure ADC's service account has permissions to read its configuration information from the Active Directory.
Could not load mapping table. | Active Directory Connector | MSADC | 8084 |  | Verify that the ADC account has permission to read the Connection Agreements and all of their attributes. If so, restart your computer and try again. If you still get this message, create a new Connection Agreement.
The service could not be initialized because the necessary file <file name> could not be found. Make sure that the operating system was installed properly. | Active Directory Connector | MSADC | 8113 | Could not find the file, or the DllMain entry point returned an error upon loading the DLL. | Check the file version and verify that its location is in your executable path.
The service could not be initialized because the necessary entry point '<value>' could not be found in the file <file name>. Make sure that the operating system was installed properly. | Active Directory Connector | MSADC | 8114 | Could not find the file or the entry point within the file to initialize this service. | Check the file version and verify that its location is in your executable path.
The Win32 API call '<Procedure number>' returned an error. The service could not be initialized. Make sure that the operating system was installed properly. | Active Directory Connector | MSADC | 8115 | This is an operating system level error. | Follow the advice given in the message.
Could not locate the import container <value>. Make sure that the configured container exists, or that the account in the Connection Agreement has permissions to access the container. Replication stopped for this Connection Agreement. | Active Directory Connector | MSADC | 8117 |  | Follow the advice given in the message.
Could not locate the export container <value>. Make sure that the configured container exists, or that the account in the Connection Agreement has permissions to access the container. Replication stopped for this Connection Agreement. | Active Directory Connector | MSADC | 8118 |  | Follow the advice given in the message.
Processing of the Connection Agreement '<value>' has been stopped due to an invalid configuration. Check the event log for more information. | Active Directory Connector | MSADC | 8124 | This message follows a previous, related message. That message will usually indicate a missing import or export container, or that the Connection Agreement was created or modified by a different version of ADC. | Correct the information on the Connection Agreement.
The operating system has run out of resources. The Connection Agreement will shut down and then restart. If this problem persists, try restarting ADC or the server. | Active Directory Connector | MSADC | 8141 | Other applications running on the system share resources. This is a Windows level error that indicates a shortage of resources for all applications. | Follow the advice given in the error message. Reduce the load on resources by restricting any other unnecessary applications from running on the server.
ADC threw an unexpected exception. | Active Directory Connector | MSADC | 8142 |  | Restart the service. Verify that there is enough disk space and memory.
ADC threw an out of memory exception. | Active Directory Connector | MSADC | 8143 |  | Increase the swap file size, close some other applications, or restart the service.
Exception <value> was raised at address <value>. | Active Directory Connector | MSADC | 8144 |  | Restart the service. Verify that there is enough disk space and memory.

Related Topics

Log Replications Events


Minimum Logging Level

Logging Level -- Minimum

Message | Component | Source | Event ID | Explanation | User Action
The service is starting. | Active Directory Connector | MSADC | 8003 | Informational message only. | No user action required.
The service is stopping. | Active Directory Connector | MSADC | 8004 | Informational message only. | No user action required.
The service received an unsupported request. | Active Directory Connector | MSADC | 8005 | The Service Control Manager has returned an invalid request. | If the problem persists, create a new Connection Agreement.
LDAP Search of directory <directory name> at base '<value>' using filter '<value>' was unsuccessful. Directory returned the LDAP error:[0x<error code>] <error code> | Active Directory Connector | MSADC | 8020 | If the accompanying LDAP message refers to LDAP_OTHER, the directory service may be out of disk space. | Check network connectivity. Verify the user name, password, and port address are correct, and try again. If the problem persists, verify that the remote Exchange server is configured to support LDAP.
LDAP Modify on directory <directory name> for entry '<entry name>' was unsuccessfull with error:[0x<error code>] <error code> | Active Directory Connector | MSADC | 8022 | If the accompanying LDAP message refers to LDAP_OTHER, the directory service may be out of disk space. | Check network connectivity. Verify the user name, password, and port address are correct, and try again. If the problem persists, verify that the remote Exchange server is configured to support LDAP.
LDAP Delete on directory <directory name> for entry '<entry name>' was unsuccessful with error:[0x<error code>] <error code> | Active Directory Connector | MSADC | 8023 |  | Check network connectivity. Verify the user name, password, and port address are correct, and try again. If the problem persists, verify that the remote Exchange server is configured to support LDAP.
LDAP Search Initial Page on directory <directory name> at base '<value>' with filter '<value>' was unsuccessful. Directory returned the LDAP error:[0x<error code>] <error code> | Active Directory Connector | MSADC | 8024 |  | Check network connectivity. Verify the user name, password, and port address are correct, and try again. If the problem persists, verify that the remote Exchange server is configured to support LDAP.
LDAP Get Next Page call on directory <directory name> for pagesize <value>, was unsuccessful with error:[0x<error code>] <error code> | Active Directory Connector | MSADC | 8025 |  | Check network connectivity. Verify the user name, password, and port address are correct, and try again. If the problem persists, verify that the remote Exchange server is configured to support LDAP.
LDAP Bind was unsuccessful on directory <directory name> for distinguished name '<value>'. Directory returned error:[0x<error code>] <error code>. <Connection Agreement> | Active Directory Connector | MSADC | 8026 | Lightweight Directory Access Protocol (LDAP) allows you to query and manage directory information using a TCP/IP connection. | Check network connectivity. Verify the user name, password, and port address are correct, and try again. If the problem persists, verify that the remote Exchange server is configured to support LDAP.
The LDAP Bind to the global catalog on <server name> for distinguished name '<recipient name>' was unsuccessful. The Directory returned error:[0x<value>] <value> The Active Directory Server that the ADC binds to must be a global catalog. Please, correct the configuration, or promote the Active Directory Server to be a global catalog. | Active Directory Connector | MSADC | 8027 |  | Either promote the Active Directory Server that the Connection Agreement points to, to a global catalog, or modify the Connection Agreement to point to a global catalog.
LDAP ModifyRDN on directory <directory name> for entry '<entry name>' was unsuccessful with error:[0x<error code>] <error code> | Active Directory Connector | MSADC | 8028 | If the accompanying LDAP message refers to LDAP_OTHER, the directory service may be out of disk space. | Check network connectivity. Verify the user name, password, and port address are correct, and try again. If the problem persists, verify that the remote Exchange server is configured to support LDAP.
LDAP Extended result on directory <directory name> for entry '<entry name>' was unsuccessful with error:[0x<error code>] <error code> | Active Directory Connector | MSADC | 8030 | Informational message only. | No user action required.
Unable to open LDAP session on directory '<directory name>' using port number <value>. Directory returned the LDAP error:[0x<error code>] <error code> | Active Directory Connector | MSADC | 8031 | Lightweight Directory Access Protocol (LDAP) allows you to query and manage directory information using a TCP/IP connection. | Check network connectivity. Verify the user name, password, and port address are correct, and try again. If the problem persists, verify that the remote Exchange server is configured to support LDAP.
LDAP search result on directory <directory name> for entry '<entry name>' was unsuccessful with error:[0x<error code>] <error code> | Active Directory Connector | MSADC | 8033 | If the accompanying LDAP message refers to LDAP_OTHER, the directory service may be out of disk space. | Check network connectivity. Verify the user name, password, and port address are correct, and try again. If the problem persists, verify that the remote Exchange server is configured to support LDAP.
Successfully modified entry '<entry name>' on directory <directory name>. | Active Directory Connector | MSADC | 8035 | Informational message only. | No user action required.
Successfully added new entry '<entry name>' on directory '<directory name>'. | Active Directory Connector | MSADC | 8038 | Informational message only. | No user action required.
LDAP Unbind on directory <directory name> was unsuccessful. Directory returned error:[0x<error code>] <error code> | Active Directory Connector | MSADC | 8054 | If the accompanying LDAP message refers to LDAP_OTHER, the directory service may be out of disk space. | Check network connectivity. Verify the user name, password, and port address are correct, and try again. If the problem persists, verify that the remote Exchange server is configured to support LDAP.
Stopped replication for Connection Agreement '<connection agreement>'. | Active Directory Connector | MSADC | 8058 | Synchronization was canceled | No user action required.
The Connection Agreement '<value>' on directory <directory name> could not be loaded due to an error. Make sure that the Connection Agreement is configured properly. | Active Directory Connector | MSADC | 8070 | There may be a network problem, or you may not have the appropriate permissions to perform this operation. | Check network connectivity. If you do not have the appropriate permissions, ask someone with administrative permissions to modify them. If the error persists, restart the Exchange server.
Object has no attributes, object is: <object name>, destination object is: <object name> | Active Directory Connector | MSADC | 8095 | The attribute tree is empty or all attributes in the attribute map are turned off. | If all attributes in the attribute map are turned off, turn them on.
The authentication package value (<value>) is not supported on server <server name>. Check the Connections tab on the Connection Agreement. | Active Directory Connector | MSADC | 8112 | The type of authentication being used is not supported on the specified server. The credentials can not be processed. | On the Connections tab of the Connection Agreement, modify the authentication options for logging onto the Windows 2000 server. Then try again. Verify the directory service on the remote server is running. Possible options are: Basic using SSL, NTLM, and NTLM using SSL. Check the port number.
The Connection Agreement '<value>' has been signaled to start replication immediately. | Active Directory Connector | MSADC | 8116 | Informational message only. | No user action required.
The entry with distinguished name '<value>' will not be written to the directory because it is missing the following mandatory attributes: '<attributes>' | Active Directory Connector | MSADC | 8121 |  | Add the required attributes, and make sure the attributes are enabled in the schema map.
The entry with distinguished name '<value>' will not be written to the directory because it has invalid attributes: '<attributes>' | Active Directory Connector | MSADC | 8122 | ADC could not write the proposed attributes to the directory. | Disable the invalid attributes in the schema map.
The entry with distinguished name '<value>' will not be written to the directory because it is trying to delete the mandatory attributes: '<attributes>' | Active Directory Connector | MSADC | 8123 | ADC cannot remove the attribute specified because it is required to exist by the target directory. | No user action required.
This version of ADC cannot run the Connection Agreement '<value>'. Either upgrade ADC on this server, or change the ADC service on the General tab to a different server. | Active Directory Connector | MSADC | 8137 |  | Make sure that the Connection Agreement was created using the Windows 2000 version of ADC. ADC cannot run Connection Agreements created by other versions ADC.
The server '<server name>' is not available. Check for network problems and make sure that the server is running. All directory updates to or from the server can not be replicated unless the server is available. | Active Directory Connector | MSADC | 8138 |  | Follow the advice given in the message.
An operation on server '<server name>' returned [0x<error code>] <error code>. The Connection Agreement <connection agreement> stopped. | Active Directory Connector | MSADC | 8145 |  | Restart the service. Check for sufficient disk space and memory. Check that the target directory and source directories are running.
Synchronization summary for connection agreement '<value>' --- %n [Destination Server: <server name>] %n [Start Time: <value>] %n [End Time: <value>] %n [Number of entries processed successfully: <value>] %n [Number of adds: <value>, Number of modifications: <value>] %n [Number of entries failed: <value>] | Active Directory Connector | MSADC | 8147 | Informational message only. | No user action required.
The directory schema on server '<service name>' is missing the following attribute types required for Connection Agreement '<connection agreement name>' to work properly: '<connection agreement name>'. Make sure that the directory service on '<server name>' was restarted after the Connection Agreement was created. If it was, either the Connection Agreement is not configured properly or the directory service on the server was re-installed after the Connection Agreement was setup. Please re-create the Connection Agreement. | Active Directory Connector | MSADC | 8148 |  | Follow the advice given in the error message.
Unable to create or open the transaction file '<file name>' for writing a deleted entry. If the file exists, make sure that it's writable by the ADC service, else make sure that the parent directory is writable and that the disk is not full. | Active Directory Connector | MSADC | 8149 |  | The transaction file is in the same directory that ADC is installed in. User account and passwords are shown on the Connection tab in the Connection Agreement Properties dialog box. Make sure that these credentials allow writing, the file is writable, and the disk is not full.
The Connection Agreement '<value>' has paused the replication after <number> seconds. The replication will resume in <number> seconds. | Active Directory Connector | MSADC | 8150 | Informational message only. | No user action required.
The Connection Agreement '<value>' is resuming its replication. | Active Directory Connector | MSADC | 8151 | Informational message only. | No user action required.

Related Topics

Log Replications Events


Medium Logging Level

Logging Level -- Medium

Message | Component | Source | Event ID | Explanation | User Action
Opening LDAP session to directory <directory name> on port <value>. | Active Directory Connector | MSADC | 8006 | Informational message only. | No user action required.
Closing LDAP session to directory <directory name>. | Active Directory Connector | MSADC | 8007 | Informational message only. | No user action required.
Binding to directory <directory name> as user '<user name>'. | Active Directory Connector | MSADC | 8008 | Informational message only. | No user action required.
Binding to directory <directory name> as service account. | Active Directory Connector | MSADC | 8009 | Informational message only. | No user action required.
Searching directory <directory name> at base '<value>' using filter '<value>'. | Active Directory Connector | MSADC | 8010 | Informational message only. | No user action required.
Search of directory <directory name> at base '<value>' returned <value> objects. | Active Directory Connector | MSADC | 8012 | Informational message only. | No user action required.
Adding entry '<entry name>' to directory <directory name>. | Active Directory Connector | MSADC | 8013 | Informational message only. | No user action required.
Modifying entry '<entry name>' on directory <directory name>. | Active Directory Connector | MSADC | 8015 | Informational message only. | No user action required.
Server '<server name>' could not generate e-mail addresses for entry '<entry name>'. Was unsuccessful with error:[0x<error code>] <error code> | Active Directory Connector | MSADC | 8040 | The ADC could not contact the System Attendant service on the Exchange Server. | Make sure that the domain that the Exchange server is running in has trust with the domain that the Windows 2000 computer is running in, and that the Exchange server's service account is in the same domain as the Windows 2000 computer.
Server '<server name>' could not generate some e-mail addresses for entry '<entry name>'. Was unsuccessful for type(s): <address type name> | Active Directory Connector | MSADC | 8041 | A unique e-mail address could not be generated based on the entry name. The Exchange server service account may be in a different domain than the Windows 2000 machine. | In the Add-ins or E-Mail Address Generator container, select the connector or address generator being accessed. On the General tab, verify that the specified .dll file is not corrupted and exists in \Exchsrvr\Add-ins or \Exchsrvr\Address in the proper directory on the server.
Found new or changed Connection Agreement '<value>' on directory <directory name>. | Active Directory Connector | MSADC | 8068 | Informational message only. | No user action required.
Connection Agreement '<value>' was deleted or had its owning service changed on directory <directory name>. Shutting down thread for this Connection Agreement. | Active Directory Connector | MSADC | 8069 | Informational message only. | No user action required.
The target object '<object name>' was modified after the source object '<object name>' Consequently, the full set of updates will not be applied to the target object. If this warning persists, make sure that the time is set correctly on both the source and target servers. | Active Directory Connector | MSADC | 8139 | The service will not replicate changes from the source object to the target object if the target object has been modified more recently than the source object. | Make sure that the source and target servers clocks are in sync.
Delayed processing of group/distribution list: '<value>' | Active Directory Connector | MSADC | 8140 | To replicate objects as quickly as possible, distribution lists and groups are delayed until after users, mailboxes, custom recipients and contacts have been replicated. | No user action required.
Changing the relative distinguished name of entry '<entry name>' to '<text>' on directory <directory name>. (Connection Agreement'<Connection Agreement>) | Active Directory Connector | MSADC | 8146 | Informational message only. | No user action required.
ADC was unable to add the link '<entry name>' to the group '<object name>'. This is because the target group is a global group, and global groups are not allowed to have universal, or domain local groups as members. | Active Directory Connector | MSADC | 8152 | By default ADC creates universal groups. Universal groups can have any object as a member. However, the Windows 2000 administrator can choose to create a global group. Global groups cannot have universal groups or domain local groups as members. Exchange does not have this restriction. So, if the Windows 2000 global group is to replicate to Exchange, and the Exchange administrator adds a unversal group to the global group, then the change cannot replicate back to Windows 2000. | Consider alternative architectures where this grouping is not necessary.

Related Topics

Log Replications Events


Maximum Logging Level

Logging Level -- Maximum

Message | Component | Source | Event ID | Explanation | User Action
Searching directory <directory name> at base '<value>' using filter '<value>' and requesting attributes <attributes>. | Active Directory Connector | MSADC | 8011 | Informational message only. | No user action required.
Adding entry '<entry name>' to directory <directory name>. Attributes are <attributes>. | Active Directory Connector | MSADC | 8014 | Informational message only. | No user action required.
Modifying entry '<entry name>' on directory <directory name>. Modifications are <text>. | Active Directory Connector | MSADC | 8016 | Informational message only. | No user action required.
Abandoning request '<value>' on directory <directory name>. | Active Directory Connector | MSADC | 8018 | Informational message only. | No user action required.
Requesting LDAP notification for base '<value>' on directory <directory name>. | Active Directory Connector | MSADC | 8019 | Informational message only. | No user action required.
Successfully deleted entry '<entry name>' on directory '<directory name>'. | Active Directory Connector | MSADC | 8037 | Informational message only. | No user action required.
Attribute values for entry '<entry name>' <attribute values> | Active Directory Connector | MSADC | 8039 | Summary of attributes values for this entry. | No user action required.
Starting replication for Connection Agreement '<connection agreement>'. | Active Directory Connector | MSADC | 8056 | Informational message only. | No user action required.
Finished replication for Connection Agreement '<connection agreement>'. | Active Directory Connector | MSADC | 8057 | Informational message only. | No user action required.
MSADC object '<object name>' on directory <directory name> has no Connection Agreements defined. | Active Directory Connector | MSADC | 8066 | Informational message only. | No user action required.
MSADC object '<object name>' on directory <directory name> has the following Connection Agreements defined: <text> | Active Directory Connector | MSADC | 8067 | Informational message only. | No user action required.
Started attribute mapping agent. | Active Directory Connector | MSADC | 8085 | As a part of the replication process, a mapping table is generated. | No user action required.
Stopped attribute mapping agent. | Active Directory Connector | MSADC | 8086 | Notification message. | No user action required.
Cannot find object class, remote tree is empty. | Active Directory Connector | MSADC | 8101 | Notification message. | If the problem persists, create a new Connection Agreement.
The schema map in the connection agreement '<value>' contains an invalid attribute: <attribute name> | Active Directory Connector | MSADC | 8119 | This message occurs when running ADC against Exchange Server 5.5 for userSMIME Certificate. | No user action required.
Syntax conversion from syntax type <value> to syntax type <value> is not allowed. | Active Directory Connector | MSADC | 8120 | The syntax of an attribute cannot be converted. | Modify the original attribute syntax.

Related Topics

Log Replications Events


Run a Full Replication

  1. On the Start menu, point to Programs, point to Administrative Tools, and then click Active Directory Management.
  2. In the console tree, click Active Directory Connector.
  3. In the details pane, right-click the Connection Agreement for which you want to initiate a full replicaton.
  4. On the Schedule tab, select Replicate the entire directory the next time the agreement is run. Click OK.
  5. Right-click the Connection Agreement you want to replicate. On the shortcut menu, point to All tasks, and then click Replicate now.
Note Replication speed varies depending on the complexity of the domains and numbers of servers. It may take a few minutes before results are visible.

Related Topics

Planning a Replication Schedule

Set up a Replication Schedule


 Specify an Alternative LDAP Port Number

  1. From Microsoft Management Console select the connection agreement for which you want to specify synchronization page sizes.
  2. Under Port numbers, type an alternative Lightweight Directory Access Protocol (LDAP) port number for the Exchange directory in Exchange Server LDAP port number.


 Configure Returned Search Results

Configure either of these adjustments:

  • On the Active Directory Connection Agreement Advanced tab under Paged results, change the Exchange Server entries per page value to a number that is less than the Maximum number of search results returned setting on the Exchange LDAP protocol.

    • Or

  • On the Exchange 5.5 Administrator Protocols container LDAP (Directory) site defaults Search tab, type a value in Maximum number of search results returned equal to or greater than the number of entries in the Exchange directory.

The Active Directory Connector cannot replicate any entries from Exchange version 5.5 to Windows 2000 Server Active Directory when the Lightweight Directory Access Protocol (LDAP) "Maximum number of search results returned" value is smaller than the number of entries in the Exchange directory.


Legal Information

Microsoft Documentation

Information in this document is subject to change without notice. The example companies, organizations, products, people, and events depicted herein are fictitious. No association with any real company, organization, product, person, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, with out the express written permission of Microsoft Corporation. If, however, your only means of access is electronic, permission to print one copy is hereby granted.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

Copyright © 1999 Microsoft Corporation. All rights reserved.

Microsoft, MS-DOS, MS, Windows, Windows NT, ActiveX, JScript, Microsoft Press, Visual Basic, Visual C++, Visual J++, Win32, and Win32s are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or other countries.

Java is a trademark of Sun Microsystems, Inc.

Alpha AXP is a trademark of Digital Equipment Corporation.

Pentium is a registered trademark of Intel Corporation.

Macintosh and QuickTime are registered trademarks of Apple Computer, Inc.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.


Using Active Directory Connector

Microsoft (R) Active Directory Connector (ADC) replicates a hierarchy of directory objects between the Microsoft Exchange Server version 5.5 directory and the Microsoft Windows NT(R) version 5.0 Active Directory.

  • For help with specific tasks, see How To...
  • For general background information, see Concepts.
  • For problem-solving instructions and preventive maintenance information, see Maintenance and Troubleshooting.