Error Message

Event ID 41111

The Exchange mailbox provisioning task failed during processing of a mailbox. The process will continue.

Error: SqlDateTime overflow. Must be between 1/1/1753 12:00:00 AM and 12/31/9999 11:59:59 PM.

• Permissions within the Active Directory (AD) domain have been locked down. Some additional permissions modifications will need to be configured.
   
• Authenticated Users group was removed from the Organizational Unit (OU) per Active Directory Lock-down protocols.
   
• Attributes read from AD exceed the maximum character count of the corrosponding column in the ExchangeMailboxEntry table within the EnterpriseVaultDirectory database.
   

Running a dtrace of EvExchangePolicySyncTask will show the following:

(EvExchangePolicySyncTask) <852> EV-H {DIRECTORYSP.EN_US} Exception: SqlDateTime overflow. Must be between 1/1/1753 12:00:00 AM and 12/31/9999 11:59:59 PM. Info:GetExchangeMbxEntryState...

Accessing a user account within Active Directory Service Interface Editor (ADSI Edit), opened as the Vault Service Account (VSA) will show that the "whenCreated" and "whenChanged" attributes are blank while if the same is performed with an account with the proper rights (Ex. Domain Admins), these attributes will show as populated.

In order for the Provisioning Task to access the necessary AD Attributes for users, the VSA must have "Read All Properties & Attributes" throughout Active Directory.

1. Confirm that none of the user values from AD (Ex. Title) exceed the maximum for the corrosponding column in ExchangeMailboxEntry table.
2. Grant the Windows special group 'Authenticated Users' the permission 'Read All Properties':
    
   1. Launch Active Directory Users and Computers.
   2. Navigate through the console tree to the OU containing user objects that you are attempting to provision.
   3. Right-click the OU and choose Properties.
   4. Click on the Security tab.
   5. Click the Advanced button.
   6. Click Add.
   7. Enter Authenticated Users and click OK (See Note below).
   8. Check the Allow box next to Read All Properties & Attributes.
   9. Click OK 3 times.
       
   4. Re-run the EV Provisioning Task and confirm that Event 41111 is no longer being logged.

NOTES:  

a.  As an alternative, it is possible to grant the VSA this right directly rather than granting this to "Authenticated User".

b. This issue can also occur if the 'Hide from Exchange Address lists' setting is selected on the 'Exchange Advanced' tab of the user properties in 'Active Directory Users and Computers'.  This setting must be removed so that the user can be provisioned properly