EMC takes a long time to return results when you manage full access permissions in an Exchange Server 2010 organization that has many users

Applies to: Exchange Server 2010 EnterpriseExchange Server 2010 Standard


Consider the following scenario:
  • A Microsoft Exchange Server 2010 organization has many users.
  • You use the Exchange Management Console (EMC) to run the Manage Full Access Permission wizard.
  • You click Add in the wizard to manage full access permissions for a mailbox.
In this scenario, the list of all the users in the organization appears after a long delay.

For example, a multiple-hour delay occurs in an organization that has more than 100,000 users.

Additionally, EMC stops responding while you wait for the list to appear. If you search for a user after the list appears, EMC also stops responding for more than 10 minutes until the result is returned.


This issue occurs because EMC does not use a correct filter or limitation when it creates the Get-SecurityPrincipal cmdlet. Therefore, Active Directory Domain Services (AD DS) sends a list that has all the users in the organization through network..


Cumulative update information

To resolve this issue, install the following update rollup:

2645995 Description of Update Rollup 1 for Exchange Server 2010 Service Pack 2

Hotfix information

To resolve this problem immediately, contact Microsoft Customer Support Services to obtain the fix.
For a complete list of Microsoft Customer Support Services telephone numbers and information about support costs, visit the following Microsoft website: Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The typical support costs will apply to additional support questions and issues that do not qualify for the specific update in question.


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

More Information

For more information about the Get-SecurityPrincipal cmdlet, visit the following Microsoft website: