Hybrid Wizard Error: Unable to reserve domain "<FQDN>" for Application Identifier "<ID>".

[Mark van Eijken]

Using the Exchange Hybrid Configuration Wizard the following error is recorded in the eventlog during the validation of the "Domain Ownership" reporting status "Adding Federated Domain...". The process hangs from that point.

 The Exchange Hybrid Configuration Wizard logging has recorded the following error:

PowerShell Error Record: {CategoryInfo={Activity=Set-FederatedOrganizationIdentifier,Category=InvalidResult,Reason=UnableToReserveDomainException,TargetName=,TargetType=},ErrorDetails=,Exception=Unable to reserve domain "FYDIBOHF25SPDLT.DedicatedISPOC.Desktopplatform.nl" for Application Identifier "000000004404D013".  Detailed information: "A Windows Live ID error occurred. Detailed information: "PassportError: Passport error.".".

In the Windows Eventlog the following error is recorded:

Log Name:      MSExchange Management
Source:        MSExchange CmdletLogs
Date:          22-8-2017 14:49:33
Event ID:      6
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      <Server>
Description:
Cmdlet failed. Cmdlet Set-FederatedOrganizationIdentifier, parameters -AccountNamespace "<Domain>" -DelegationFederationTrust "Microsoft Federation Gateway" -Enabled "True" -DefaultDomain $null.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchange CmdletLogs" />
    <EventID Qualifiers="49152">6</EventID>
    <Level>2</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2017-08-22T12:49:33.254214500Z" />
    <EventRecordID>2553</EventRecordID>
    <Channel>MSExchange Management</Channel>
    <Computer><Server></Computer>
    <Security />
  </System>
  <EventData>
    <Data>Set-FederatedOrganizationIdentifier</Data>
    <Data>-AccountNamespace "<Domain>" -DelegationFederationTrust "Microsoft Federation Gateway" -Enabled "True" -DefaultDomain $null</Data>
    <Data><ADDomain>/Administrators/<admin></Data>
    <Data><SID></Data>
    <Data><SID></Data>
    <Data>Remote-PowerShell-Unknown</Data>
    <Data>12040 w3wp#MSExchangePowerShellAppPool</Data>
    <Data>
    </Data>
    <Data>76</Data>
    <Data>00:00:02.3317721</Data>
    <Data>View Entire Forest: 'False', Default Scope: '<ADDomain>', Configuration Domain Controller: '<DC>.<ADDomain>', Preferred Global Catalog: '<DC>.<ADDomain>', Preferred Domain Controllers: '{ <DC>.<ADDomain> }'</Data>
    <Data>Microsoft.Exchange.Management.SystemConfigurationTasks.UnableToReserveDomainException: Unable to reserve domain "<Hostname>.<Domain>" for Application Identifier "<ID>".  Detailed information: "A Windows Live ID error occurred. Detailed information: "PassportError: Passport error.".". ---&gt; Microsoft.Exchange.Management.FederationProvisioning.LiveDomainServicesException: A Windows Live ID error occurred. Detailed information: "PassportError: Passport error.". ---&gt; System.Web.Services.Protocols.SoapException: PassportError: Passport error.
   at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Microsoft.Exchange.Management.FederationProvisioning.ManageDelegationClient.ExecuteAndRetry(String description, WebMethodDelegate webMethod)
   at Microsoft.Exchange.Management.FederationProvisioning.ManageDelegationClient.ExecuteAndHandleError(String description, WebMethodDelegate webMethod)
   --- End of inner exception stack trace ---
   at Microsoft.Exchange.Management.FederationProvisioning.ManageDelegationClient.ExecuteAndHandleError(String description, WebMethodDelegate webMethod)
   at Microsoft.Exchange.Management.FederationProvisioning.ManageDelegation2Client.ReserveDomain(String applicationId, String domain, String programId)
   at Microsoft.Exchange.Management.SystemConfigurationTasks.LiveFederationProvision.ReserveDomain(String domain, String applicationIdentifier, ManageDelegationClient client, LocalizedString errorProofDomainOwnership, GetDomainStateDelegate getDomainState)
   --- End of inner exception stack trace ---
   at Microsoft.Exchange.Configuration.Tasks.Task.ThrowError(Exception exception, ErrorCategory errorCategory, Object target, String helpUrl)
   at Microsoft.Exchange.Configuration.Tasks.Task.WriteError(Exception exception, ErrorCategory category, Object target)
   at Microsoft.Exchange.Management.SystemConfigurationTasks.SetFederatedOrganizationIdentifier.ProvisionSTS()
   at Microsoft.Exchange.Management.SystemConfigurationTasks.SetFederatedOrganizationIdentifier.InternalProcessRecord()
   at Microsoft.Exchange.Configuration.Tasks.Task.&lt;ProcessRecord&gt;b__b()
   at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed)</Data>
    <Data>8</Data>
    <Data>Microsoft.Exchange.Management.FederationProvisioning.LiveDomainServicesException: A Windows Live ID error occurred. Detailed information: "PassportError: Passport error.". ---&gt; System.Web.Services.Protocols.SoapException: PassportError: Passport error.
   at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at Microsoft.Exchange.Management.FederationProvisioning.ManageDelegationClient.ExecuteAndRetry(String description, WebMethodDelegate webMethod)
   at Microsoft.Exchange.Management.FederationProvisioning.ManageDelegationClient.ExecuteAndHandleError(String description, WebMethodDelegate webMethod)
   --- End of inner exception stack trace ---
   at Microsoft.Exchange.Management.FederationProvisioning.ManageDelegationClient.ExecuteAndHandleError(String description, WebMethodDelegate webMethod)
   at Microsoft.Exchange.Management.FederationProvisioning.ManageDelegation2Client.ReserveDomain(String applicationId, String domain, String programId)
   at Microsoft.Exchange.Management.SystemConfigurationTasks.LiveFederationProvision.ReserveDomain(String domain, String applicationIdentifier, ManageDelegationClient client, LocalizedString errorProofDomainOwnership, GetDomainStateDelegate getDomainState)</Data>
    <Data>Ex703205</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>False</Data>
    <Data>
    </Data>
    <Data>0 objects execution has been proxied to remote server.</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>ActivityId: 4654ba68-a13f-4bed-9d9b-e8710f7b97f4</Data>
    <Data>ServicePlan:;IsAdmin:True;</Data>
    <Data>
    </Data>
    <Data>en-US</Data>
  </EventData>
</Event>

Anyone tips to solve this issue?

[#2]

Three tips for you.

1. Was the domain in question ever registered as a custom domain for LiveIDs back ten or so years ago? If so open a support call with Microsoft to get it removed from that system

2. Do you have full unfiltered access from the machine running the hybrid wizard to the internet? Make sure you allow all the URL and ports required by the hybrid wizard. The wizard checks the URL domains.live.com or something like that. I have see n customers decide that as it’s is live.com they remove it from the list of domains that are reachable from the LAN, except it’s not live.com, it’s domains.live.com (this FQDN is from memory, check the actual list from Microsoft)

3. Register the domain using Exchange directly on the organisation tab in EMS and not in the hybrid wizard. Once the domain is registered for federation the wizard will skip this step.

[#3]

Hi Brian, 

Thanks for replying (and reminding me of the post ;-)). It's solved, it had something to do with the timezone settings on both the Exchange server and the domaincontroller. Somehow the wizard breaks when it's not configured to GMT. I would expect it would work independent of timezones, but it doesn't.

Regards,

Mark