Exchange Hybrid Mailbox Move - Corruption Due To Missing Security Principals (ACL issues) - TooManyBadItemsPermanentException

By -
UPDATE 14 Jan 2020
---------------------
Microsoft have introduced DCS (Data Consistency Scoring) which is planned to supersede the Bad Item Limit count you declare on a migration.

 There are four grades of DCS; Perfect, Good, Investigate and Poor.  You can complete the migration for all grades, except Poor.

 Importantly, this now means they can now properly differentiate between a corruption in mailbox data and missing permissions or security principal which couldn't be set on the target mailbox. Previously you had to raise the Bad Item Limit to compensate for security principals and genuine corruption combined; this should no longer be the case.

 For now, DCS will be used by default where you don't set a Bad Item Count. If you do specify a Bad Item Count, DCS will not be used
See the below links for more details:

 https://techcommunity.microsoft.com/t5/exchange-team-blog/improving-migrations-using-data-consistency-scoring/ba-p/1105920

 https://docs.microsoft.com/en-us/exchange/mailbox-migration/track-prevent-data-loss-dcs

 ---------------------

About midway through 2016, a change was introduced to Exchange Online whereby if a security principal could not be successfully validated/mapped to an Exchange Online object, it would be marked as a bad item. Previously, the behaviour was that invalid permissions would simply be ignored, and administrators were then left to wonder why some permissions no longer worked after the migration. With this new behaviour, corrupt/invalid permissions are now logged so that administrators will know that there are problems with permissions.  The following article covers this in more detail: https://blogs.technet.microsoft.com/exchange/2017/05/30/toomanybaditemspermanentexception-error-when-migrating-to-exchange-online/?replytocom=310635#respond  
The result is that users who were granted mailbox permissions but have since left the organisation and had their AD user account deleted will show as a corrupt item when that mailbox is migrated to Exchange Online.  These errors were previously hidden from the log, but they're not marked as corruptions which means you need to raise that corruption level for your mailbox move/s.
In order to decipher which corruptions are genuine are which are related to ACL issues, you can run the following script.  The script can be run against a migration batch in PowerShell for Exchange Online to determine and output which mailbox migrations have genuine corruptions and require investigation, and which do not.
3 files will be output to directory specified with a subfolder with a timestamp prepended.
  1.     A summary CSV output including the mailboxes queried along with the details in the table above.
  2.     An output of all corrupt bad items found, including ACL security principals, should they need to be queried.
  3.     A migrations XML output for each mailbox migration - this can imported into any PowerShell session at a later date and queried; this allows you to remove the migration job but keep a logged record.


 Here is an example of what is output to screen:



https://github.com/benjaminjamesowens/ReportExchangeMailboxMigrationACLExceptions/blob/main/ReportExchangeMailboxMigrationACLExceptions.ps1






















































Comments









  1. Mitch16 August 2017 at 15:17
    This is exceptional work and super useful.  Thanks very much for the effort you've made to produce this.
    ReplyDelete
  2. Resonate12 December 2017 at 09:18
    Any way to check an individual mailbox if you have a large batch?
    ReplyDelete
  3. Meg17 June 2020 at 17:57
    Thank you so much for making my job a whole heck of a lot easier. This script rocks.
    ReplyDelete











Post a Comment



















Popular posts from this blog









Assigning Windows 10/11 Enterprise Subscription Activation Licences to Hybrid Azure AD Joined Devices







By







-














Image







Introduction Starting with Windows 10, version 1703, Windows 10 Pro supports the Subscription Activation feature, enabling users to “step-up” from Windows 10 Pro to Windows 10 Enterprise automatically if they are subscribed to Windows 10 Enterprise E3 or E5. The Subscription Activation feature eliminates the need to manually deploy Windows 10 Enterprise or Education images on each target device, then later standing up on-prem key management services such as KMS or MAK based activation, entering GVLKs, and subsequently rebooting client devices. It’s important to note that the Windows 10 Enterprise subscription activation is designed to “step-up” a device from Windows 10 Pro to Windows 10 Enterprise. Therefore, your device is required to have a Windows 10 Pro license activated as a baseline. For Windows 10 Enterprise Subscription Activation to function, there a several prerequisites which need to be in place. This blog is aimed for organisations which have Active Directory on premises an








Read more










Autopilot Hybrid Azure AD Join with Customised First Login Status







By







-














Image







Introduction This is my flavour of deploying a customised HAADJ progress status, building on work by Joymalya Basu Roy's detailed article - https://joymalya.com/autopilot-hybrid-azure-ad-join-reworked-with-joy/ . The differences in my version are: Not using Active Setup to run the HAADJ retry process or Splash Screen as I found this didn't work as expected and I didn't want to add a registry item to affect all future logins with a reboot from the HAADJ process. Running the processes under the context of the SYSTEM account, but displaying status to the interactive user. Avoid the HAADJ process running again after the initial success. This provides a customised first login status which prevents the user from using the devices until Hybrid Azure AD Join from the Autopilot process. It's use is primarily for when the User ESP is configured to be skipped. Files This is my version of customised HAADJ which is built on work and guidance in blogs/articles from Michael Niehaus, S








Read more










Upgrade Samsung Galaxy Ace 2 (I8160) to Android Jelly Bean







By







-














Image







There has been talk of Samsung working on an Android build of Jelly Bean for the Samsung Galaxy Ace 2 (I8160) for quite some time.   A couple of leaked versions of the build have been available since the end of February and during March, but these contained various bugs as you might expect.   On April 2nd, an official release was available on www.sammobile.com  and available for install using KIES or OTA, but only for Portuguese customers on the TMN network.  This was curious as this network didn't actually sell the phone.  It could be a way of getting the early adopters to test this version before the big operators like Telefonica and Vodafone build and release a version themselves.   There are many online guides on how to manually download the firmware and apply it to your device, but if you make the direct jump from Gingerbread (2.3) to Jelly Bean (4.1.2) you will likely have RAM issues.   The gingerbread versions only allocated around 500MB for RAM whereas Jelly Bean needs more








Read more