get-aduser with filter - missing attributes

A forest, 40 domains, one attribute, let's assume 'attribute-N'. Attribute was deprecated (isDefunct=True), now is visible again. near 40k user objects have this value set - boolean type, not system, in global catalog (SearchFlags=1). When I was looking for I got 40k objects. After clear no instances. 

After that I undeleted user object with this attribute and again looking for objects with attribute-N in a domain and in the forest (global catalog) - I received no answers. Get-ADUser for this single objects returns attribute value. Looking for with Get-ADObject - also no return. 

Finally, when I added value to my user object - I can find by searching in the domain and in the forest. Is there a limit of 1 instance per domain or the forest when I can find objects? 

Yes, I must have minimum 2 instances to look for objects. 

password rotation in ADFS

 ADFS farm, configuration in dedicated SQL database, standard service accounts in Active Directory, how to rotate passwords? Nothing unexpected:

• change password on account in Active Directory
• change on every node of the farm - in service configuration (through services.msc)
• restart
• low risk of account lockout - my personal preference - do it on Wednesday or Thursday evening - when most of customers do not use it actively

LSASS Schema Cache

 Interesting - every time, when I'm modifying schema there is a gap when I can't see changes from perspective of tools. For example - I'm adding new attribute and this attribute will be available after a small gap - 5-15 minutes before it will be available. Is it Schema Cache? 

Or maybe Schema Management Thread (ntdsai.dll)?

After hide of one of attributes in Powershell I can still query for this attribute and magically - after 5-15 minutes it just disappears...

schema isDefunct - hide attribute

 First test deactivation of attribute:

• created custom attribute - emptyAttribute1 (ldap emptyAttr1), some oid, OMx 64
• custom attribute added to class User (I know, it should be auxiliary class)
• few user objects created - few of them with this attribute populated
• all test accounts deleted - moved to trash - recycle bin
• all restored - without issue
• all test accounts deleted again - in recycle bin 
• isDefunct = True set on attribute 
• I can't restore them

Second test undelete:

• try to add mayContain in user class - error 0x57 - error in attribute conversion
• 00000057: LdapErr: DSID‑0C090EBF, comment: Error in attribute conversion operation
• isDefunct cleared (means False)
• few errors - but finally success - maybe I must close dialog boxes - they have their own cache - cache of threads connected with dialog boxes
• now attribute is in class... lets try to recover objects - still error with user objects with attribute unhidden
• attribute is not reachable from ADUC, but from Powershell is visible, can be set
• ok - finally I can restore object 
• can I defunct attribute now? no, I have 2 objects with this value...
• 0x20C2 (WILL_NOT_PERFORM) + data 8386 → „attribute is used in may‑contain”
• - let's try to clear the value... cleared - still can't defunct, let's populate it again and try to remove from may contain
• removed from maycontain - it is possible with objects with this value
• now isDefunct=TRUE is possible - objects still have this value
• I can change value of attribute that is already set
• ok, now I have error in Powershell - parameter is incorrec - so I should wait - even in lab with the single server
• objects have been deleted, isDefunct=TRUE, in theory they don't have attributes set - before removal - no attributes visible, even from Powershell
• isDefunct cleared  - can I restore object? no, I must add to mayContain
• I can't add to mayContain - error in attribute conversion... why? dialog boxes or Search Flags? 
• Bingo! searchFlags must be cleared - now I can add to mayContain, can I recover accounts?
• yes - 5 minutes waiting - accounts undeleted

Summary:

• to recover objects with isDefunct attributes
• clear isDefunct in attribute
• clear SearchFlags in attribute
• add attribte to mayContain in class
• wait 5 minutes (in lab)
• recover

Observation - important:

• objects can have values in attributes not active anymore - attributes in state inDecfunct=TRUE, class mayContain - cleared with these attributes

TaskScheduler error 0xFFFD0000

0xFFFD0000 - source of this error:

• wrong path - missing script

Exchange Online versus on-premise environment

Let's assume there are:

• (MF) main forest - source of the indentities - single user = single account
• (RF) resource forest - linked mailboxes - Exchange attributes
• (AT) tenant - with migrated mailboxes

Sometime I can see object in AADC/EIDC:

• AT connector
• MF connector

Sometime it's build of:

• AT connector
• RF connector

In this particular hybrid configuration part of attributes are managed by IAM in MF, rest of attributes come from RF. To properly build object MV (metaverse) must be build with the three connectors - MF - main account, RF - resource account - linked mailbox and finally AT - object in Azure.

I'm not sure who is responsible for two strange cases. I don't know - maybe IAM team, maybe EXO team, finally - me - guy responsible for Active Directory, AADC/EIDC and partially for Azure I should repair it. So how to enforce AADC/EIDC in this case to properly connect them:

• ms-DS-ConsistencyGuid - present on MF account usually is equal to Base64 objectGuid of the MF account itself
• ms-DS-ConsistencyGuid - in Base64 format should be on AT account as immutableId
• ms-DS-ConsistencyGuid - can't be present on RF account or... this account will be a placeholder - so on RF account this attribute must be empty - null
• msExchMasterAccountSid - on RF account must be equal SID's of MF account.

TaskScheduler error 0x800710e0

0x800710e0 - meaning - task not launched do to missed start time - reason? Server restarted - by updating team.