Hello!

There are a few entries on the Internet stating that an object is no longer in the AD and cannot be resolved.

The object domain.local/OU/Groups/Object has been damaged and is in an inconsistent state. Verification error:

The access control entry defines the following ObjectType '9b026da6-0d3c-465c-8bee-5199d7165xxx', which cannot be resolved

The error message with exactly the same ObjectType, i.e. the same Guid, appears on the website for all calls in Exchange 2013 ECP.

Has worked without any problems so far.

A change has been made: another Domain Controller Server 2016 has been added.

The AD database was replicated correctly, all group policies and even the SYSVOL folder. Everything is correct and the same on both DCs.
Age DC=2012R2
New DC=2016

After 1 day, the FSMO roles were transferred to the 2016-DC via Powershell. Recently, the admin on site noticed that this message appears. Everything continues to work normally in ECP, every change can be made, everything works. It's just that the message also appears every time.

https://www.msxfaq.de/exchange/admin/exchange_acl_problem.htm

The website describes the problem, but I don't know exactly what the solution was or what to look for.

After the same ID for ObjectType "9b026da6-0d3c-465c-8bee-5199d7165xxx" is always the same for all mailboxes or groups or similar, this one ID is apparently always queried or included when a mailbox is opened in the ECP (i.e. in the browser). This ID must be stored or found somewhere in Exchange?

I can't quite figure it out, is it just due to a missing ACL authorization or an entry in a security tab that should be deleted?

Has anyone ever had this or has any help?

Thanks for any help!