Question

I’m using the System.DirectoryServices.AccountManagement library to create an AD user account, then soon after using a PowerShell runspace to run the Enable-Mailbox command.

When I run this, it is sometimes failing on the Mail-Enable with the error “Active Directory account must be logon-enabled for the user’s mailbox.“

If rerun the same code, but just try to Mail-Enable the account only, it works fine. And again, other times it’s able to create the AD account and Mail-Enable.

This link suggests that AD is still configuring the account when Exchange tries to mail-enable it:

http://social.technet.microsoft.com/Forums/en-US/exchangesvrdevelopment/thread/d53d91fd-c479-40e4-9791-32cb5da24721?prof=required

Here is the runspace code:

var connectionInfo = new WSManConnectionInfo(new Uri(ConfigurationManager.AppSettings["PSExchangeURI"]), ConfigurationManager.AppSettings["PSExchangeShellURI"], new PSCredential(ConfigurationManager.AppSettings["Username"], ConfigurationManager.AppSettings["Password"].ToSecureString()));
connectionInfo.AuthenticationMechanism = AuthenticationMechanism.Kerberos;

var command = new Command("Enable-Mailbox");
command.Parameters.Add("Identity", userPrincipal.UserPrincipalName);
command.Parameters.Add("Alias", userPrincipal.SamAccountName);
command.Parameters.Add("DisplayName", userPrincipal.DisplayName);
command.Parameters.Add("Database", ConfigurationManager.AppSettings["ExchangeDatabase"]);

using (var runspace = RunspaceFactory.CreateRunspace(connectionInfo)) {
    using (var pipeline = runspace.CreatePipeline()) {
        runspace.Open();
        pipeline.Commands.Add(command);

        var results = pipeline.Invoke();
    }
}

Is there something else I can do to avoid this error (besides introducing a thread sleep)?

Answer 1

What you are seeing is likely to be down to replication time lag and the exchange server talking to a different DC then the AD user creation code.

What you should do is to line up exchange and your AD creation code to talk to the same DC.

From the PrincipalContext object under S.DS.AM read the DC’s FQDN from the ConnectedServer property. Then pass in that value to the -DomainController parameter to the enable-mailbox cmdlet.