XADM: ADC Creates Duplicate Accounts in Exchange Server 5.5 and Active Directory

The Active Directory Connector (ADC) creates disabled user accounts in Active Directory even though all Microsoft Exchange Server 5.5 mailboxes have been assigned a valid primary Windows NT account in the Windows 2000 forest. In some situations, the disabled accounts may have the same display name as other accounts in the Active Directory or they may have a "-1" appended to the account name. The ADC may also create custom recipients in the Exchange Server 5.5 directory whose display names or proxy addresses (or both) match an existing Exchange Server 5.5 mailbox. This behavior causes non-delivery reports (NDRs) to be generated if mail is delivered to the Exchange Server 5.5 mailboxes that have custom recipients with the same proxy addresses.

This behavior may occur if you manually type the Simple Mail Transfer Protocol (SMTP) e-mail address of the Active Directory user account before the recipient Connection Agreement is initially replicated. When the ADC replicates, it tries to match an existing Exchange Server 5.5 mailbox to its primary Windows NT account in Active Directory, and it tries make this Active Directory user account mail-enabled so that it is stamped with the same proxy addresses as the Exchange Server 5.5 mailbox. If the Active Directory user account already has an e-mail address assigned to it, the ADC assumes that this Active Directory user account is already mail-enabled and it assumes that one of the following conditions is true:

• This user account has been matched to another object in the Exchange Server 5.5 directory.
  
  -or-
• The Active Directory user account has an Exchange 2000 mailbox.

If an Active Directory user account is already mail-enabled or mailbox-enabled, the ADC cannot match an Exchange Server 5.5 mailbox to this account. Because the Exchange Server 5.5 mailbox must have a corresponding user account in the Active Directory domain, the ADC creates an additional user account (the default setting is a disabled user account) in Active Directory. The new account inherits the display name of the Exchange Server 5.5 mailbox. If the account is being created in the same Active Directory container where the primary Windows NT account for the Exchange Server 5.5 mailbox resides, the name for the new account that is created may have a "-1" appended to it. If the Connection Agreement is a two-way Connection Agreement, the ADC creates a custom recipient in the Exchange Server 5.5 directory whose proxy addresses matches that of the Exchange Server 5.5 mailbox. This behavior causes non-delivery reports to be generated if mail is delivered to the Exchange Server 5.5 mailboxes that now have custom recipients with the same proxy addresses.

Microsoft recommends that you do not manually add an e-mail address to an Active Directory user account that is not currently mail-enabled.

This behavior is by design.

For additional information, click the article numbers below to view the articles in the Microsoft Knowledge Base: