AD Removing Proxy Address

[NeilSuth89]

Hi Edugeek!

 

I've got a very strange problem and for the life of me, I cannot figure out what is causing it, if its a scheduled task (I've looked on all the DC's and I can't see one) I've spoken to Microsoft incase its AADConnect doing it (It isn't)

 

I've also installed AD Audit Plus to try find out.

 

When adding a proxy address on any account via Attribute Editor in AD, I add smtp:[email protected] I do an AAD Delta Sync, and it syncs up to 365 with no issues. However, by morning the proxy address has been removed. I can see no events under event viewer and Security to see what could be removing it and AD Audit Plus shows me that I have added the proxy address, and then the trail ends there.

 

Has anyone else had similar issues?

[Frodo_Baggins]

Hi Edugeek!

 

I've got a very strange problem and for the life of me, I cannot figure out what is causing it, if its a scheduled task (I've looked on all the DC's and I can't see one) I've spoken to Microsoft incase its AADConnect doing it (It isn't)

 

I've also installed AD Audit Plus to try find out.

 

When adding a proxy address on any account via Attribute Editor in AD, I add smtp:[email protected] I do an AAD Delta Sync, and it syncs up to 365 with no issues. However, by morning the proxy address has been removed. I can see no events under event viewer and Security to see what could be removing it and AD Audit Plus shows me that I have added the proxy address, and then the trail ends there.

 

Has anyone else had similar issues?

Use anything like Salamander to sync AD?

[NeilSuth89]

XPorter and Groupcall IDaaS but I'm not sure that would be doing it. I didn't think to check there. As far as i'm aware with XPorter and IDaaS it only runs when a new user is put in, for example if a user is changed in SIMS it doesn't update them in AD or anything (Or not that i'm aware of it doing)

[3s-gtech]

More than one DC? Could be that it's syncing the previous value back from another DC (though this could happen quickly depending on your sync settings).

[NeilSuth89]

Replication seems to be working fine. We have 3 DC's and it replicates over to all three. But then by morning its gone. I'm wondering if perhaps it is Groupcall or Xporter - But thought I would have seen something to say it was that.

[chaplic]

Agree it’s not AADC

 

 

It is the particular proxy address or is the whole field being changed? What happens if you add smtp:[email protected] does that get nuked too?

 

You can apply permissions to specific AD attributes so you could put an explicit deny on a service account and see if it still changes..?

[kevin_lane]

Replication seems to be working fine. We have 3 DC's and it replicates over to all three. But then by morning its gone. I'm wondering if perhaps it is Groupcall or Xporter - But thought I would have seen something to say it was that.

 

I can’t imagine it would of been these apps as they don’t touch AD attributes and they just pull info from sims

 

What have Microsoft said ?

 

Is this effecting all users ? Or just a few?

Edited June 29, 2023 by kevin_lane

[Mr.Ben]

Do you have any Exchange On Prem still in use?

[NeilSuth89]

Yeah it doesn't matter what you put in it, it nukes it and keeps their SMTP: just not the smtp:

[NeilSuth89]

It effects all users, we have a few different trusts we deal with aswell, and I tested on a completely different tenant and it did the same thing. Driving me up the wall!

[CHiLL]

How are your AD accounts provisioned?

[NeilSuth89]

SIMS > Xporter > IDaaS and then it creates the AD Account

[Michael]

Try putting in an smtp alias, then signing into Xporter and manually refresh data.

[Koldov]

When adding a proxy address on any account via Attribute Editor in AD, I add smtp:[email protected]

 

SIMS > Xporter > IDaaS and then it creates the AD Account

 

Sorry, don't have an answer for you but are you saying that your AD accounts are automatically created from SIMS by Xporter/IDaaS, then when you 'manually' add an attribute to the user in ADUC, it is then changed/overwritten/deleted overnight (I presume when Xporter runs)?

 

I'm also presuming there isn't there an equivalent field in SIMS that you can populate and have the export fill it for you, so best guess is maybe Xporter/IDaaS is rewriting that field with a blank as it doesn't have the information (bit of a stretch, but might be worth looking at as a possibility)?

 

Maybe something in Azure though, this isn't something I know anything about and you're obviously well up on me, so I'm not trying to 'teach you how to suck eggs', but it seems there's a lot that can go wrong with populating that field and it has a few 'gotchas' and it looks like it won't take much for it to be dropped:

 

https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/proxyaddresses-attribute-populate

 

"The proxyAddresses attribute in Active Directory is a multi-value property that can contain various known address entries. For example, it can contain SMTP addresses, X500 addresses, SIP addresses, and so on. When an object is synchronized to Azure AD, the values that are specified in the mail or proxyAddresses attribute in Active Directory are copied to a shadow mail or proxyAddresses attribute in Azure AD, and then are used to calculate the final proxyAddresses of the object in Azure AD according to internal Azure AD rules. The logic that populates mail, mailNickName and proxyAddresses attributes in Azure AD is called proxy calculation and it takes into account many different aspects of the on-premises Active Directory data, such as:

 

Set or update the Primary SMTP address and additional secondary addresses based on the on-premises ProxyAddresses or UserPrincipalName.

Set or update the Mail attribute based on the calculated Primary SMTP address.

Set or update the MailNickName attribute based on the on-premises MailNickName or Primary SMTP address prefix.

Discard on-premises addresses that have a reserved domain suffix, e.g. @*.onmicrosoft.com, @*.microsoftonline.com;

Discard on-premises ProxyAddresses with legacy protocols like MSMAIL, X400, etc;

Discard malformed on-premises addresses or not compliant with RFC 5322, e.g. missing protocol prefix "SMTP:", containing a space or other invalid character;

Remove ProxyAddresses with a non-verified domain suffix, if the user is assigned an Exchange Online license.

Therefore, the values of the Mail and ProxyAddresses attributes for the object in Active Directory may not be the same as the values of the ProxyAddresses attribute in Azure AD"

 

HTH

Edited June 30, 2023 by Koldov

[NeilSuth89]

Sorry, don't have an answer for you but are you saying that your AD accounts are automatically created from SIMS by Xporter/IDaaS, then when you 'manually' add an attribute to the user in ADUC, it is then changed/overwritten/deleted overnight (I presume when Xporter runs)?

 

I'm also presuming there isn't there an equivalent field in SIMS that you can populate and have the export fill it for you, so best guess is maybe Xporter/IDaaS is rewriting that field with a blank as it doesn't have the information (bit of a stretch, but might be worth looking at as a possibility)?

 

Maybe something in Azure though, this isn't something I know anything about and you're obviously well up on me, so I'm not trying to 'teach you how to suck eggs', but it seems there's a lot that can go wrong with populating that field and it has a few 'gotchas' and it looks like it won't take much for it to be dropped:

 

https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/proxyaddresses-attribute-populate

 

"The proxyAddresses attribute in Active Directory is a multi-value property that can contain various known address entries. For example, it can contain SMTP addresses, X500 addresses, SIP addresses, and so on. When an object is synchronized to Azure AD, the values that are specified in the mail or proxyAddresses attribute in Active Directory are copied to a shadow mail or proxyAddresses attribute in Azure AD, and then are used to calculate the final proxyAddresses of the object in Azure AD according to internal Azure AD rules. The logic that populates mail, mailNickName and proxyAddresses attributes in Azure AD is called proxy calculation and it takes into account many different aspects of the on-premises Active Directory data, such as:

 

Set or update the Primary SMTP address and additional secondary addresses based on the on-premises ProxyAddresses or UserPrincipalName.

Set or update the Mail attribute based on the calculated Primary SMTP address.

Set or update the MailNickName attribute based on the on-premises MailNickName or Primary SMTP address prefix.

Discard on-premises addresses that have a reserved domain suffix, e.g. @*.onmicrosoft.com, @*.microsoftonline.com;

Discard on-premises ProxyAddresses with legacy protocols like MSMAIL, X400, etc;

Discard malformed on-premises addresses or not compliant with RFC 5322, e.g. missing protocol prefix "SMTP:", containing a space or other invalid character;

Remove ProxyAddresses with a non-verified domain suffix, if the user is assigned an Exchange Online license.

Therefore, the values of the Mail and ProxyAddresses attributes for the object in Active Directory may not be the same as the values of the ProxyAddresses attribute in Azure AD"

 

HTH

I've spoken to Microsoft and done testing with them and its deffo not Azure.

 

But yeah, user is created in SIMS, that goes across to Xporter/IDaaS which then creates their account based off their SIMS information, which links to SDS and such to create Class Teams and such

 

I'm going to take a look at Xporter to see if there is a field, I've been told by others in my team who have worked for the company longer that Xporter only kicks in on a NEW person adding to SIMS, but... I'm not so convinced that is what is happening.

 

Thanks for all the ideas everyone!

[chaplic]

Is there an Exchange server hanging about with address book generation rules?

[Koldov]

There must be a way... Not on a DC at the moment, but is there a way in AD that you can tell at what time an attribute was changed or an account was updated?

 

EDIT: Found something... Would this work?

 

"Each Active Directory object has an uSNChanged attribute that corresponds to a directory-global USN (Update Sequence Number) object. Whenever an Active Directory object is created, modified or deleted, the global sequence object value is increased, and the new value is assigned to the object's uSNChanged attribute."

[Koldov]

Also, just to mention the old tried and trusted saying: 'when was it last working, when did it stop working, what happened inbetween?'...

 

Are there any issues about the method used to enter the information in the proxy address field?

 

This might be outdated, but I found this (translated from the original German):

 

https://www.msxfaq.de/exchange/admin/proxyaddresses.htm

 

"You can access the "ProxyAddresses" field in the expanded view via the "Attribute Editor" tab, which is highlighted in green. However, you should definitely refrain from such changes if, for example, Exchange is installed in your environment. The corresponding commandlets from Exchange as well as Skype for Business ensure, for example, that...

 

... mail addresses are unique and

The Active Directory itself does not check whether the address has already been assigned to another object

... mail address is "valid"

Mail addresses may only contain certain characters. Everyone will understand that eg two "@" are not allowed. But a period at the beginning or end of the user part is also not allowed.

... Mail and the primary proxy address match

The two fields are not linked by the domain controller. Exchange ensures that the primary SMTP address from the ProxyAddresses is also maintained in the "Mail" field without the leading "SMTP:".

... only "Accepted Domains" are used

Exchange is responsible for certain SMTP domains and it only makes sense to create email addresses for these domains

SIP addresses for voicemail are maintained

Skype for Business adds the SIP address with the prefix "SIP:" so that the voicemail works.

You would have to implement all these and other checks in your own code if you really didn't want to use the Skype for Business and Exchange commandlets. Irrespective of this, direct modification of Exchange Properties is not supported by Microsoft."

 

HTH

[kevin_lane]

Does your sims users have anything inside their email field ?

[NeilSuth89]

I haven't checked that yet

[NeilSuth89]

Does your sims users have anything inside their email field ?

 

I just checked - yes he has his email address, and the one I wanted to use as an alias too

[NeilSuth89]

Try putting in an smtp alias, then signing into Xporter and manually refresh data.

 

Did that and the Alias stayed so its not Xporter doing it. Additional email addresses are also in SIMS, so I'm at a total loss

[Michael]

I presume AD linked groups are fine and SMTP entries are staying, so it's just isolated to smtp aliases?

 

I can only speculate a Powershell script is doing this. If you have service accounts, where possible, temporarily disable the account and/or reset the service account password. Leave it overnight and see what happens.

[NeilSuth89]

I presume AD linked groups are fine and SMTP entries are staying, so it's just isolated to smtp aliases?

 

I can only speculate a Powershell script is doing this. If you have service accounts, where possible, temporarily disable the account and/or reset the service account password. Leave it overnight and see what happens.

 

Exactly that. Just isolated smtp aliases.

[robintech]

For me at least the Azure audit logs show changes to ProxyAddresses in a users audit log and the Initiated by (actor) name