You receive the "Exported-change-not-reimported" error message when you configure a newly created user as a disabled user in Microsoft Identity Integration Server 2003 (823781)

SYMPTOMS

When you export a new user account to the Active Directory directory service by using the Active Directory Management Agent (ADMA), and then you import changes to the Microsoft Identity Integration Server 2003 metaverse, you may receive the following status information:

Completed-warnings

Additionally, information that is similar to the following appears:

Exported-change-not-reimported	1 Error(s)
CN=`firstname lastname`,OU=`organizational unit`,DC=`example`,DC=`com`	userAccountControl: exported: 512 imported: 546

CAUSE

This issue may occur when you configure a newly created user as a disabled user by setting the constant value 514 in the userAccountControl attribute of the user account. This issue occurs because the user account object is waiting for confirmation that the constant value was set correctly in Active Directory. The object expects to import the same value that the object sent to Active Directory. However, because the value that is returned is 546 instead of 514, you receive the "Exported-change-not-reimported" error message.

MORE INFORMATION

The userAccountControl attribute is a special attribute. Active Directory assigns certain default values to this attribute when a new user is created. The values that are assigned depend on the user configuration that is created. By default, Active Directory disables a new user account unless a password is set for that account. In the scenario that is described in the "Symptoms" section of this article, you create a typical user account by assigning the following constant value to the userAccountControl attribute of that user account:

Constant	Hexadecimal value	Decimal value
ADS_UF_NORMAL_ACCOUNT	0x200	512

If you set this account to be a disabled user account, Active Directory automatically adds the "No password is required" ADS_PASSWD_NOTREQD constant to the userAccountControl attribute of this user account. The resultant value is 546 decimal, as illustrated by the entries in the following table:

Constant	Hexadecimal value	Decimal value
ADS_UF_NORMAL_ACCOUNT	0x200	512
ADS_UF_ACCOUNTDISABLE	0x0002	2
ADS_PASSWD_NOTREQD	0x0020	32

To avoid this issue, Microsoft recommends that you set the constant value to 546 instead of to 514 for a disabled account. Both values disable the user account. If you use the 546 value, you do not receive the "Exported-change-not-reimported" error message because the imported value and the exported value match.

REFERENCES

For additional information about the userAccountControl attribute, see the "Enabling or Disabling a User Account in Active Directory" topic in the Microsoft Identity Integration Server 2003 Developer Reference.

For additional information about the user account control constants, visit the following Microsoft Web site, and then search for the topic "ADS_USER_FLAG_ENUM":

http://msdn.microsoft.com/library