Exchange Management: Error "Multiple objects with Sid S-1-5-10 were found"

Question

Hello,

we have a forest with two trees that hold one domain each. There is a default tree-root trust (transitive, two-way) between the top domains. Since both trees are in the same forest they share the same global catalog and schema.

We configured a button in Adaxes (Version 2017.2) to manage the "Send on behalf of" and "Full Access" properties of our shared mailboxes in Exchange. We used the built-in functionality from Adaxes. The shared mailboxes are all held in one OU of our forest root domain. We use an OU-filter to list all operation targets.

As long as the shared mailboxes are of the type "Regular" everything works fine. If we change the type of a shared mailbox user to "Shared" the "Full Access" property cannot be managed with Adaxes anymore. Adaxes shows the error message "Multiple objects with Sid S-1-5-10 were found".

Any help would be appreciated, thank you!

Regards HarryNew

Answer 1

Hello HarryNew,

The issue occurs because the permissions granted to the Self well-known security principal are duplicated in the properties of the objects the issue persists with. As per our check this is not allowed in Exchange and we are not sure how/why it happens. We recommend you to contact Microsoft support regarding possible causes and solutions.

Comments

Hello,

thank you for your answer but I don't think this is correct. We are using Exchange 2016 and have had this problem ever since updating to CU14, which was a while back.

A consulting company we are partnering with was able to confirm the duplicate entry in their test environment so this is not an effect that only happens in our domain. Exchange itself does not have a problem with the duplicate SID.

In both environments the duplicate entry shows up when switching the shared mailbox to "shared" and disappears when going back to "regular".

Regards HarryNew

---

Hello HarryNew,

Sorry for the confusion, but Adaxes just passes the error that is returned from Exchange. Most probably, it happens when Adaxes attempts to add permissions for the trustee which is already added to the permissions list (e.g. Self). For troubleshooting purposes, please, do the following:

• Check the permissions of the mailbox the issue persists with before and after conversion to shared. It can be done using the Get-MailboxPermissions cmdlet. Please, post here or send us (support[at]adaxes.com) the output of the cmdlet execution.
• Clarify how the mailbox conversion to shared is performed.

A screenshot of the error and any additional details would be much appreciated.