Exchange 2000 Active Directory Connector Does Not Successfully Replicate Changes to Group Membership in Windows Server 2003 Active Directory in Forest Functional Levels 1 or 2 (825916)


The information in this article applies to:

  • Microsoft Exchange 2000 Server

SYMPTOMS

When you use the Microsoft Exchange 2000 Server Active Directory Connector (ADC) to replicate group membership updates in the Microsoft Windows Server 2003 Active Directory directory service, and the replication operation occurs in forest functional level 1 or in forest functional level 2, the ADC may not replicate the updates successfully.

CAUSE

This problem occurs because the Exchange 2000 ADC does not accurately detect group membership changes when the changes to the group occur on a domain controller that is part of Windows Server 2003 Active Directory in forest functional level 1 or in forest functional level 2. For additional information about forest functional levels, click the following article number to view the article in the Microsoft Knowledge Base:

322692 HOW TO: Raise Domain and Forest Functional Levels in Windows Server 2003



Windows Server 2003 Active Directory has a new feature that is named Linked Value Replication. This feature permits individual values of a multivalued attribute to be replicated separately. In Microsoft Windows 2000, when a change is made to a member of a group or when a new group member is added, the whole group membership value has to be replicated. When Linked Value Replication is enabled in Windows Server 2003, and you add a new member to the group, only the new member entry is replicated. The whole group membership is not replicated. An update sequence number for an object is updated when a linked attribute (such as group membership) changes, but the metadata for these particular attributes does not change. Exchange Server searches for metadata changes to particular attributes to decide whether the ADC must update an object. This metadata does not change when the forest functional level is set to enable Linked Value Replication; therefore, the ADC does not replicate the object.

When Linked Value Replication is enabled in an Active Directory forest, group membership changes do not replicate between a Windows Server 2003 Active Directory server (in forest functional level 1 or in forest functional level 2) and a Microsoft Exchange Server 5.5 computer when that group membership change originates in Active Directory.

For example, assume that you have a universal distribution group in Active Directory that is named UDG1. UDG1 is linked through the ADC to a distribution list in Exchange 5.5. This distribution group is also named UDG1. UDG1 has two members: David Daniels and Shu Ito. When David Daniels is deleted from the group membership in Active Directory, the ADC does not detect that an update occurred to the member attribute of the group. As a result, the change to the group (the removal of David Daniels) does not replicate from Active Directory to Exchange 5.5. David Daniels can continue to access resources that are available to the group in Exchange 5.5 and can continue to receive e-mail messages that are sent to the group from users in Exchange 5.5. At this point, the problem is that the group membership of UDG1 in Active Directory does not accurately reflect the group membership of UDG1 in Exchange 5.5. Additionally, David Daniels can be re-added to the group in Active Directory even though he was deleted in the previous step. This behavior may occur when a new user, Begoņa Hurtado, is added to UDG1 in Exchange 5.5. The ADC detects the group membership change in Exchange 5.5 and replicates the whole group membership back to Active Directory. As a result, David Daniels is added to the membership again, and the final group membership state of UDG1 in Active Directory includes three members: David Daniels, Shu Ito, and Begoņa Hurtado.

WORKAROUND

To work around this problem, use one of the following methods:
  • Do not switch the forest functional level to 1 or 2 until the Exchange 2003 version of the ADC is installed.
  • Update all versions of the Exchange 2000 ADC to the Exchange 2003 version of the ADC.

    Note As part of the update process for installing the Exchange 2003 version of ADC, the Active Directory Schema is extended (if it has not already been extended) to include the full set of Exchange attributes that Exchange 2003 requires. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

    822589 How the Exchange 2003 Active Directory Connector Setup Process Updates the Schema

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section of this article.
Modification Type:MinorLast Reviewed:12/1/2003
Keywords:kbnofix kbprb KB825916 kbAudITPRO
Š2003 Microsoft Corporation. All rights reserved.