Event ID 8270, 1171, and 8146 error messages from Active Directory Connector and Site Replication Service

On an Exchange 2000 server that has joined an Exchange Server 5.5 site, after you install or upgrade to the Active Directory Connector (ADC) for Exchange 2000 Server Service Pack 1 (SP1), the following error messages may be logged in the Exchange 2000 server's Application event log: The event ID 8146 error message indicates that the configuration Connection Agreement (Config_CA) stopped because of a protocol error. After the configuration Connection Agreement stops, the ADC restarts the configuration Connection Agreement.

IMPORTANT: Even though the preceding event ID 8270, 1171, and 8146 error messages are logged in the Exchange 2000 server Application event log, no incorrect data is entered in Active Directory. No data is lost or corrupted. The only symptom that occurs is the logging of the event ID 8270, 1171, and 8146 error messages in the Exchange 2000 server Application event log.

The issue is that the ADC is trying to add an empty attribute to the Public Folder object. This causes LDAP to fail. This problem can occur when all three of the following conditions exist:

• Certain users or distribution lists (DLs) are explicitly allowed to create top-level public folders or are not allowed to create top-level public folders on the Exchange Server computer.
• There is no user Connection Agreement that replicates the mailboxes and DLs from Exchange Server 5.5 to Active Directory.
• The ADC from Exchange 2000 SP1 has been installed.

You can resolve this problem three ways:

• Create a user Connection Agreement to replicate the Exchange Server 5.5 mailboxes and DLs to Active Directory as accounts. This recipient Connection Agreement must be at least a one-way Connection Agreement from Exchange Server 5.5 to the Microsoft Windows 2000 Active Directory.
• Create a two-way user Connection Agreement between Exchange Server 5.5 and Active Directory. For more information, click the following article number about creating a two-way connection agreement to view the article about creating a two-way connection agreement in the Microsoft Knowledge Base:
  296260  (http://support.microsoft.com/kb/296260/ ) How to configure a two-way user Connection Agreement for Exchange Server 5.5 users
• Install the Exchange 2000 SP3 Active Directory Connector (ADC).

Microsoft has confirmed that this is a problem in Microsoft Exchange 2000 Server.

The ADC logs the error messages in the "Symptoms" section of this article because the ADC cannot accurately replicate public folder hierarchy information from the Exchange Server 5.5 Information Store Site Configuration object to the Active Directory Public Folders object. The attributes that specify who can and cannot create top-level public folders cannot be mapped to Active Directory accounts unless a user Connection Agreement has created those accounts in Active Directory. The ADC tries to add an empty attribute to the Public Folders object. Because of this, Lightweight Directory Access Protocol (LDAP) does not work, and the error messages in the "Symptoms" section are logged.

NOTE: The Exchange 2000 SP1 version of the ADC logs error messages more aggressively than the Exchange 2000 ADC. The underlying problem (adding an empty attribute to the Public Folders object when there is no recipient Connection Agreement) exists in the initial release (RTM) of the Exchange 2000 ADC, but an error message is not logged.

To view the mailboxes and DLs that are explicitly allowed to create top-level public folders or explicitly not allowed to create top-level public folders on the Exchange Server 5.5 computer:

1. Start the Exchange Server 5.5 Exchange Server Administrator program.
2. If necessary, click to expand the Organization container, expand the site container (the site that is being migrated), and expand the Configuration container.
3. Click the Information Store Site Configuration object.
4. Click the Top Level Folder Creation tab.
5. View the mailboxes and DLs that are listed under Allowed to create top level folders and Not Allowed to create top level folders.

By default, Allowed to create top level folders is set to All, and Not allowed to create top level folders is set to None. For more information about specifying who can create top-level folders in Exchange Server 5.0 and Exchange Server 5.5, click the following article number to view the article in the Microsoft Knowledge Base: For a mixed mode administrative group, Microsoft recommends that you create a user Connection Agreement and allowing that Connection Agreement to replicate fully before you install Exchange 2000. For additional information about Exchange 2000 deployment, refer to the following Microsoft Web site: