Support-Tip: (GALSYNC): Exchange 2010 Provisioning: extension-dll-timeout on Export

APPLIES TO:

Forefront Identity Manager 2010, R2, R2 SP1 Microsoft Identity Manager 2016, SP1

 

ENVIRONMENT / ASSOCIATED WITH THE BREAK - FIX SCENARIO

Synchronization Service Engine GalSync Management Agent (Connector) Microsoft Exchange 2010

 

PROBLEM SCENARIO DESCRIPTION

GalSync Management Agent configured for Exchange 2010 provisioning was failing on Export with "extension-dll-timeout".  The export would run for approximately 3 minutes and then fails.  No adds, updates or deletes would be processed. NOTE The words "extension-dll-timeout" will appear to the right of the object that has thrown the error.

 

RESOLUTIONS

#1: Fix the Exchange CAS URI Reviewed the configuration. Tried running a test to export 10 objects.  The export still failed. All other management agent run profiles were running successfully, just the export was failing. Reviewed the "Configure Extensions" for the GalSync MA and verified the Exchange URI. The Exchange URI was pointing to a single CAS server.  The export had worked previously but just recently had stopped working. The specified Exchange CAS server has had an issue recently with opening PowerShell where it will take a long time to open a PowerShell session even directly on the server. Updated the URI to point to a different CAS server, which was not having an issue when opening PowerShell and the export is now running successfully. #2: HTTPS with Kerberos Auth is not supported  by Exchange for the remote call to the Exchange CAS Utilize the HTTP protocol rather than HTTPS

 

ADDITIONAL INFORMATION - BACKGROUND ON THE ISSUE

An Export on the GalSync Management Agent with Exchange 2010 Provisioning enabled first tries to connect to the Exchange 2010 CAS Server based on the URI specified on the Configure Extensions Tab (How to get the Exchange 2010 CAS Information) even prior to exporting any objects to ensure it is available and the FIM Synchronization Service is able to connect.Once the connection has been confirmed the GalSync Management Agent will export the contact objects to Active Directory.Once the contact has been export the GalSync Management Agent executes a remote PowerShell CMDLET called Update-Recipient which populates the legacyExchangeDN and the mail attributes on the contact objects.

 

ADDITIONAL INFORMATION - RESOURCES

GALSYNC Resources (A good index of GalSync related resources): http://social.technet.microsoft.com/wiki/contents/articles/1726.global-address-list-synchronization-galsync-resources.aspx GALSync: Implementing Exchange Remote PowerShell Tools for FIM Galsync between 2 AD Forests: http://social.technet.microsoft.com/wiki/contents/articles/21759.galsync-implementing-exchange-remote-powershell-tools-for-fim-galsync-between-2-ad-forests.aspx Troubleshooting the Exchange Management Shell: https://technet.microsoft.com/en-us/library/dd351136(v=exchg.141).aspx