Warning - validation error

%3CLINGO-SUB%20id%3D%22lingo-sub-1641037%22%20slang%3D%22en-US%22%3EWarning%20-%20validation%20error%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1641037%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3EFor%20a%20while%20now%20I%20have%20been%20getting%20a%20warning%20every%20time%20I%20open%20a%20distribution%20group%20or%20mail-enabled%20security%20group%20in%20the%20on-prem%20admin%20center.%26nbsp%3B%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Capture.PNG%22%20style%3D%22width%3A%20407px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F216874iB4BBA1EE088D5513%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Capture.PNG%22%20alt%3D%22Capture.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%22The%20object%20%3CEM%3Eremoved%3C%2FEM%3E%20has%20been%20corrupted%20or%20isn't%20compatible%20with%20Microsoft%20support%20requirements%2C%20and%20it's%20in%20an%20inconsistent%20state.%20The%20following%20validation%20errors%20happened%3A%3CBR%20%2F%3EThe%20access%20control%20entry%20defines%20the%20ObjectType%20'a8df73ef-c5ea-11d1-bbcb-0080c76670c0'%20that%20can't%20be%20resolved..%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20far%20as%20I%20can%20figure%20'a8df73ef-c5ea-11d1-bbcb-0080c76670c0'%20referrs%20to%20the%20'Employee%20Number'%20LDAP%20attribute%2C%20which%20a%20group%20object%20does%20not%20have%3F%26nbsp%3B%3CBR%20%2F%3EIt%20doesn't%20appear%20to%20cause%20any%20issues%2C%20but%20I%20would%20still%20like%20to%20fix%20the%20problem.%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EAnyone%20got%20any%20ideas%20to%20what%20might%20be%20causing%20this%20error%3F%20We%20are%20running%20Exchange%202016%20CU16%20in%20a%20hybrid%20environment.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1641037%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Ehybrid%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1641121%22%20slang%3D%22en-US%22%3ERe%3A%20Warning%20-%20validation%20error%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1641121%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F246600%22%20target%3D%22_blank%22%3E%40Gitte_Lysell%3C%2FA%3E%26nbsp%3BHi%2C%20see%20if%20this%20can%20help%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fwww.admin-enclave.com%2Fen%2Farticles%2Fexchange%2F253-resolved-how-to-fix-damaged-or-corrupt-health-mailbox-on-exchange-2016.html%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.admin-enclave.com%2Fen%2Farticles%2Fexchange%2F253-resolved-how-to-fix-damaged-or-corrupt-health-mailbox-on-exchange-2016.html%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1641268%22%20slang%3D%22en-US%22%3ERe%3A%20Warning%20-%20validation%20error%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1641268%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F551905%22%20target%3D%22_blank%22%3E%40bec064%3C%2FA%3E%26nbsp%3B%3CBR%20%2F%3EThank%20you%20for%20the%20suggestion.%3CBR%20%2F%3EI%20ran%20%22Get-Mailbox%20-monitoring%22%20but%20found%20no%20errors%20there.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1641288%22%20slang%3D%22en-US%22%3ERe%3A%20Warning%20-%20validation%20error%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1641288%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F246600%22%20target%3D%22_blank%22%3E%40Gitte_Lysell%3C%2FA%3E%26nbsp%3BHey%2C%20try%20this%20then%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fsocial.technet.microsoft.com%2FForums%2Fen-US%2F213afa53-0b61-4dd6-a807-a0262aa16474%2Fthe-access-control-entry-defines-the-objecttype-9b026da60d3c465c8bee5199d7165cba-that%3Fforum%3DExch2016Adm%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsocial.technet.microsoft.com%2FForums%2Fen-US%2F213afa53-0b61-4dd6-a807-a0262aa16474%2Fthe-access-control-entry-defines-the-objecttype-9b026da60d3c465c8bee5199d7165cba-that%3Fforum%3DExch2016Adm%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20I%20want%20to%20highlight%20is%20this.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3E1.%20Run%20the%20IISReset%20on%20all%20Exchange%20server.%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3E2.%20If%20reset%20IIS%20does%20work%2C%20reboot%20all%20Exchange%20server%20and%20check%20the%20result.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1641348%22%20slang%3D%22en-US%22%3ERe%3A%20Warning%20-%20validation%20error%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1641348%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F551905%22%20target%3D%22_blank%22%3E%40bec064%3C%2FA%3E%26nbsp%3B%3CBR%20%2F%3EI%20have%20tried%20this%20earlier%2C%20both%20iis%20reset%20and%20reboot.%20I%20have%20also%20tried%20recycling%20the%26nbsp%3B%3CSPAN%3E%22MSExchangeECPAppPool%22%20as%20suggested%20in%20the%20post.%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Hello,

For a while now I have been getting a warning every time I open a distribution group or mail-enabled security group in the on-prem admin center. 
Capture.PNG

"The object removed has been corrupted or isn't compatible with Microsoft support requirements, and it's in an inconsistent state. The following validation errors happened:
The access control entry defines the ObjectType 'a8df73ef-c5ea-11d1-bbcb-0080c76670c0' that can't be resolved.."

 

As far as I can figure 'a8df73ef-c5ea-11d1-bbcb-0080c76670c0' referrs to the 'Employee Number' LDAP attribute, which a group object does not have? 
It doesn't appear to cause any issues, but I would still like to fix the problem. 

Anyone got any ideas to what might be causing this error? We are running Exchange 2016 CU16 in a hybrid environment. 

11 Replies
Highlighted

@bec064 
Thank you for the suggestion.
I ran "Get-Mailbox -monitoring" but found no errors there. 

Highlighted

@Gitte_Lysell Hey, try this then :)

 

https://social.technet.microsoft.com/Forums/en-US/213afa53-0b61-4dd6-a807-a0262aa16474/the-access-co...

 

What I want to highlight is this.

 

1. Run the IISReset on all Exchange server.
2. If reset IIS does work, reboot all Exchange server and check the result.

Highlighted

@bec064 
I have tried this earlier, both iis reset and reboot. I have also tried recycling the "MSExchangeECPAppPool" as suggested in the post. 

Highlighted

@Gitte_Lysell I'm sure one of the Exchange experts will reply with a solution. At least we have narrowed it down then.

Highlighted
Highlighted

@bec064 
I checked the Ad permissions for the domain now, and it's not yielding any errors either. 

Highlighted
Highlighted

@VickVega 
I have not. I tried to verify the active directory versions now, and I see in ADSI that that the 'objectVersion' in the Configuration naminig context is <not set>. So you may be onto something. We wil try to update schema again next week.

Highlighted

@Gitte_Lysell did you find a fix, I have exactly the same warning messages when editing Distributons Groups in Ex2016 EAC? 

Highlighted

@blozza77 No, I did not - sorry for not updating the post. Eventually we tried to update schema again, but it did not resolve the issue.