Exchange 2010/2013: Some entries in the offline address list were omitted by the OALGen. (ID 9327, 9323)

by

The error (9327, 9323 offline address list) is often found in the event log of the Exchange server that generates the offline address book:

MSExchangeSA
9327

Some entries in the offline address list "\Global address list" of OALGen have been omitted. To determine which entries are affected, the event logging for the offline address generator must be set to at least "Medium".
- \Default offline address book

Offline address list

To determine what is causing the warning, the diagnostic level must be raised, in some cases this message then appears as the cause:

MSExchangeSA
9323

Entry 'User' has invalid or expired e-mail certificates. These certificates are not included in the offline address list for '\Global address list'.
- \Default offline address book

2

So the cause is expired certificates that have been published in the Active Directory, now you can of course go through every user that is reported and delete the corresponding certificates, or you can use the script that I have created.

3

The Quest Active Directory Tools are required to execute the script. The tools can be downloaded here free of charge:

http://www.quest.com/powershell/activeroles-server.aspx

In addition, the Exchange Management Shell must be installed on the computer that executes the script.

The script increases the diagnosis level and then starts a generation of the offline address book. It then searches for all affected users and removes the invalid certificates if required.

In principle, the script should also work with Exchange 2013, but I have not yet tested this.

You can download the script here:

[wpdm_file id=6]

7 thoughts on “Exchange 2010/2013: Es wurden einige Einträge in der Offlineadressliste vom OALGen ausgelassen. (ID 9327, 9323)”

  1. Pingback: Exchange 2016: Offline address book (OAB) cannot be downloaded (0x8004010F) - Frankys Web

  2. Hallo Frank,
    also auch in der QuestShell bekomme ich nur Fehler:
    Set-EventLogLevel : The Event Source ‚MSExchangeSA‘ was not found.
    At C:\Service\Clean-ExpiredCertificates.ps1:23 char:13
    + $loglevel = Set-EventLogLevel -Identity $generator -level medium
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : InvalidData: (\MSExchangeSA\OAL Generator:ECIdParameter) [Set-EventLogLevel], DataSource
    OperationException
    + FullyQualifiedErrorId : [Server=APP006,RequestId=b02d07ba-1d13-4782-b1e9-a2224952549a,TimeStamp=19.12.2018
    12:05:13] [FailureCategory=Cmdlet-DataSourceOperationException] C10D6994,Microsoft.Exchange.Management.EventLogTas
    ks.SetEventLogLevel

    Starte OAB Generierung auf Server

    Warte bis das OAB erzeugt wurde
    Get-EventLog : Cannot validate argument on parameter ‚ComputerName‘. The argument is null or empty. Provide an
    argument that is not null or empty, and then try the command again.
    At C:\Service\Clean-ExpiredCertificates.ps1:31 char:44
    + $checkevent = Get-EventLog -ComputerName $oabserver -LogName Applic …
    + ~~~~~~~~~~
    + CategoryInfo : InvalidData: (:) [Get-EventLog], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.GetEventLogCommand

    Hast du eine Idee warum das so sein mag?

    Vielen Dank

    Reply

  4. Hallo Frank,

    ich erhalte diese Meldungen:

    Get-EventLog : Keine Übereinstimmungen gefunden.
    Bei C:\users\xxxxxxxGLOBAL\desktop\Clean-ExpiredCertificates.ps1:50 Zeichen:24
    + $events = Get-EventLog <<<< -ComputerName $oabserver -LogName Application -InstanceId 2147492971 -after $now
    + CategoryInfo : ObjectNotFound: (:) [Get-EventLog], ArgumentException
    + FullyQualifiedErrorId : GetEventLogNoEntriesFound,Microsoft.PowerShell.Commands.GetEventLogCommand

    In einem NULL-Array kann kein Index erstellt werden.
    Bei C:\users\xxxxxxxxxGLOBAL\desktop\Clean-ExpiredCertificates.ps1:53 Zeichen:36
    + $user = $event.ReplacementStrings[ <<<< 0]
    + CategoryInfo : InvalidOperation: (0:Int32) [], RuntimeException
    + FullyQualifiedErrorId : NullArray

    Get-QADUser : Invalid identity
    Bei C:\users\xxxxxxxGLOBAL\desktop\Clean-ExpiredCertificates.ps1:54 Zeichen:29
    + $expiredcerts = Get-QADUser <<<< "$user" | Get-QADCertificate -Valid:$false
    + CategoryInfo : NotSpecified: (:) [Get-QADUser], Exception
    + FullyQualifiedErrorId : Quest.ActiveRoles.ArsPowerShellSnapIn.Powershell.Cmdlets.GetUserCmdlet

    Reply

  5. Guten Morgen,

    nettes Tool was sicherlich hilfreich ist, jedoch erhalte ich folgende Fehler nach „OAB Generierung ist abgeschlossen [in grün]“:

    Get-EventLog : Keine Übereinstimmungen gefunden.
    …..

    [ : In einem NULL-Array kann kein Index erstellt werden.
    ….

    Get-QADUser : Die Benennung „Get-QADUser“ wurde nicht als Name eines Cmdlet, einer Funktion, einer Skriptdatei oder
    es ausführbaren Programms erkannt. Überprüfen Sie die Schreibweise des Namens, oder ob der Pfad korrekt ist (sofern
    halten), und wiederholen Sie den Vorgang. …..

    Irgend eine Idee?

    Reply

    • Hallo,

      Du musst wie im Artikel beschrieben die Quest Tools runterlaufen und installieren, dann das Script aus der Quest Shell ausführen.

      Gruß, Frank

      Reply

Leave a Comment