Problem accessing Active Directory for Exchange 2007 OWA users

Recently I posted about one cause of Outlook Web Access errors that users may experience after their mailbox is migrated from Exchange 2003 to Exchange 2007.  Users are presented with a browser error containing the message:

Exception type: Microsoft.Exchange.Data.Storage.StoragePermanentException
Exception message: There was a problem accessing Active Directory.

In addition to that common cause I outlined previously there is another cause of this issue that can arise.  This usually occurs if an administrator uses the legacy Exchange System Manager tools (eg as part of the Active Directory Users & Computers new account wizard) to create a user mailbox on an Exchange 2007 mailbox server.  The legacy tools assign an incorrect attribute to the user account, which is explained further in this Microsoft support article:

This issue occurs when the msExchVersion attribute is not set correctly on the user object in the Active Directory.

Exchange 2007 uses the msExchVersion attribute to determine the version of Exchange that user objects are associated with. If the version value is less than 0.1, Exchange 2007 considers the object “read-only” and cannot write changes to the object.

Note The msExchVersion attribute may not set correctly if you created the user’s mailbox by using the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in instead of by using the Exchange 2007 Management Console.

To resolve the issue you can use the following Exchange Management Shell cmdlet:

Set-Mailbox User_Name -ApplyMandatoryProperties

To check a user for the correct attribute use the Get-Mailbox cmdlet.  In my example here you can see both the correct and incorrect attributes displayed.

[PS] C:\>get-mailbox User1 | fl ExchangeVersion

ExchangeVersion : 0.1 (8.0.535.0)

[PS] C:\>get-mailbox User2 | fl ExchangeVersion

ExchangeVersion : 0.0 (6.5.6500.0)

If you have several mailboxes affected by this issue you can find them with this command:

[PS] C:\>get-mailbox | where {$_.ExchangeVersion -like "0.0*" -and $_.ServerName
 -eq "exchange2007"}

Name                      Alias                ServerName       ProhibitSendQuota
----                      -----                ----------       ---------------
User2                     User2                exchange2007     unlimited

Similarly you can use this command to correct multiple mailboxes at once:

[PS] C:\>get-mailbox | where {$_.ExchangeVersion -like "0.0*" -and $_.ServerName
 -eq "exchange2007"} | Set-Mailbox -ApplyMandatoryProperties

Links:

• Error message when users try to log on to Outlook Web Access in Exchange 2007: “A problem occurred while trying to use your mailbox”