Exchange 2016 – DNString mismatch

This little article should be hopefully helpful to solve the following error while Updating a Microsoft Exchange Server 2016 or Accessing this Server using Powershell.
It’s not a solution to solve the actual problem, but a work a round to complete the Setup and get the Server up and running.

The Error shows up as:

„DNString length mismatch“

Don’t run into the wrong direction

At First don’t run into the wrong direction. This Error has noting to do with DNS (and a forgotten second „s“). It’s a LDAP Error. If this Error would be written by:

„DN String length mismatch“

it would be more clearly!

Description

While running the Update procedure to MS Exchange 2016 CU 8, the Setup interrups while progressing Mailbox role: Client Access service with the following Error:

Searching objects of type "ADOwaVirtualDirectory" with filter "(OwaVersion NotEqual Exchange2003or2000)", scope "SubTree" under the root "EXCH16".
[ERROR] DNString length mismatch
[WARNING] An unexpected error has occurred and a Watson dump is being generated: DNString length mismatch
Die Active Directory-Sitzungseinstellungen für 'Set-OwaVirtualDirectory' lauten: Vollständige Gesamtstruktur anzeigen: 'True', Konfigurationsdomänencontroller: 'pdc.example.com', Bevorzugter globaler Katalog: 'pdc.example.com', Bevorzugte Domänencontroller: '{ pdc.example.com }'
User specified parameters:  -Identity:'EXCH16\OWA (Exchange Back End)' -FormsAuthentication:'False' -WindowsAuthentication:'True'
Beginning processing set-OwaVirtualdirectory
Searching objects "EXCH16\OWA (Exchange Back End)" of type "ADOwaVirtualDirectory" under the root "$null".
Previous operation run on domain controller 'pdc.example.com'.
[ERROR] DNString length mismatch
[WARNING] An unexpected error has occurred and a Watson dump is being generated: DNString length mismatch

While accessing the OWAVirtualDirectory I got the same Error:

Get-OwaVirtualDirectory
WARNUNG: Unerwarteter Fehler. Ein Watson-Abbild wird generiert: DNString length mismatch.

Trying to remove the actual OWA Directory to recreate it would fail with the same error

Remove-OwaVirtualDirectory "Exch16\owa (Default Web Site)"
WARNUNG: Unerwarteter Fehler. Ein Watson-Abbild wird generiert: DNString length mismatch.
DNString length mismatch
    + CategoryInfo          : NotSpecified: (:) [Remove-OwaVirtualDirectory], FormatException
    + FullyQualifiedErrorId : System.FormatException,Microsoft.Exchange.Management.SystemConfig 
   urationTasks.RemoveOwaVirtualDirectory
    + PSComputerName        : Exch16.example.com

work a round

OK, let’s fix it!

Short info: The Attributes we will need to correct will be not editable by using ADSI, so I used Apache Directory Studio.

Connect to
CN=Configuration,DC=example,DC=com

LDAP-Tree and Navigate to:
DN: CN=owa (Default Web Site),CN=HTTP,CN=Protocols,CN=EXCH16,CN=Servers,CN= Exchange Administrative Group (ABCDEFGH12IJKLM),CN=Administrative Groups,CN =First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=example,DC=com

If you dump this branch into ldif File you would find something link this:

msExchOWABlockedMIMETypes: S:22:application/javascript:CN=owa (Default Web S
 ite),CN=HTTP,CN=Protocols,CN=EXCH16,CN=Servers,CN=Exchange Administrative 
 Group (ABCDEFGH12IJKLM),CN=Administrative Groups,CN=First Organization,CN=M
 icrosoft Exchange,CN=Services,CN=Configuration,DC=example,DC=com
msExchOWABlockedMIMETypes:: Uzo2NjrigKDigKDigKDigKDigKDigKDigKDigKDigKDigKDi
gKDigKDigKDigKDigKDigKDigKDigKDigKDigKDigKDmhKA6Q049b3dhIChEZWZhdWx0IFdlYiBT
aXRlKSxDTj1IVFRQLENOPVByb3RvY29scyxDTj1FWENIMTYsQ049U2VydmVycyxDTj1FeGNoYW5n
ZSBBZG1pbmlzdHJhdGl2ZSBHcm91cCAoQUJDREVGR0gxMklKS0xNKSxDTj1BZG1pbmlzdHJhdGl2
ZSBHcm91cHMsQ049Rmlyc3QgT3JnYW5pemF0aW9uLENOPU1pY3Jvc29mdCBFeGNoYW5nZSxDTj1T
ZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWV4YW1wbGUsREM9Y29t=

The second line is the problem.

Find and Remove the Lines starting with „††.*“

After that connect to powershell and discard and recreate the OWAVirtualDirectory (with command Feedback):

Remove-OwaVirtualDirectory "EXCH16\owa (Default Web Site)"
Remove-OwaVirtualDirectory "EXCH16\owa (Exchange Back End)"
 
New-OwaVirtualDirectory  -InternalUrl “https://exch16.example.com/owa” -ExternalUrl “https://mail.example.com/owa”
 
Name                             Server                           OwaVersion
----                             ------                           ----------
owa (Default Web Site)           EXCH16                          Exchange2013
 
New-OwaVirtualDirectory  -InternalUrl “https://exch16.example.com/owa” -ExternalUrl “https://mail.example.com/owa” -WebSiteName “Exchange Back End”
 
Name                             Server                           OwaVersion
----                             ------                           ----------
owa (Default Web Site)           EXCH16                          Exchange2013
 
Get-OwaVirtualDirectory
 
Name                             Server                           OwaVersion
----                             ------                           ----------
owa (Default Web Site)           EXCH16                          Exchange2013

Please check also OWAMailboxPolicy, it’s possible that you get the same error:

Get-OwaMailboxPolicy
WARNUNG: Unerwarteter Fehler. Ein Watson-Abbild wird generiert: DNString length mismatch.
DNString length mismatch
    + CategoryInfo          : NotSpecified: (:) [Get-OwaMailboxPolicy], FormatException
    + FullyQualifiedErrorId : System.FormatException,Microsoft.Exchange.Management.Tasks.GetOwa
   MailboxPolicy
    + PSComputerName        : exch16.example.com

If so, goto DN: CN=Default,CN=OWA Mailbox Policies,CN=First Organization,CN=Microsoft Ex change,CN=Services,CN=Configuration,DC=example,DC=com and Find and Revove the Lines starting with „††.*“.
After that recreate the MailboxPolicy by:

Remove-OwaMailboxPolicy
New-OwaMailboxPolicy -Name Default

Then restart the Exchange Upgrade Setup. It should be completed.

Environment

This problem occours while Updating MS Exchange Server 2016 to CU 8 released on 17. Dec. 2017 on Windows 2012 Server R2 Std. The MSAD PDC is a Windows Server 2012 R2 and a Samba Server Version 4.5.12 (Running Debian Stretch) as Fileserver and Domain Controller.

Uncheck assumption: The Problem maybe occurs because of an Replication Error.
Possible hint: The defect BASE64 String in the LDAP Tree is maybe happend by a bit toppler in replication
ToDo: Try to reproduce in Lab

freeSwitch – versatel.sip

As known, Versatel needs „versatel.sip“ as REALM. This is not an fqdn and there for we run in some little possible config trouble.

Basic example for connection freeswith pbx to (1&1) Versatel public phone service

This example contains an example phone number and password – please change it!

<include>
  <gateway name="versatel">
    <param name="username" value="0049301234567"/>
    <param name="password" value="bu!Msuf5"/>
 
    <!--/// proxy /realm host: Versatel Name! ///-->
    <param name="proxy" value="versatel.sip"/>
    <param name="realm" value="versatel.sip"/>
 
    <!--/// send register to this proxy: correct DNS Name! ///-->
    <param name="register-proxy" value="wia-sip-proxy.ngn.versatel.de"/>
    <param name="outbound-proxy" value="wia-sip-proxy.ngn.versatel.de"/>
 
    <!--/// expire in seconds: *optional* 3600, if blank ///-->
    <!--<param name="expire-seconds" value="60"/>-->
 
    <!--/// do not register => false ///-->
    <param name="register" value="true"/>
    <param name="register-transport" value="udp"/>
 
    <!--<param name="retry-seconds" value="30"/>-->
    <!--Use the callerid of an inbound call in the from field on outbound calls via this gateway, imported to versatel -->
    <param name="caller-id-in-from" value="true"/>
 
    <!--extra sip params to send in the contact-->
    <!--<param name="contact-params" value="tport=tcp"/>-->
    <!--send an options ping every x seconds, failure will unregister and/or mark it down-->
    <!--<param name="ping" value="25"/>-->
  </gateway>
  <!--rfc5626 : Abilitazione rfc5626 ///-->
  <!--<param name="rfc-5626" value="true"/>-->
  <!--rfc5626 : extra sip params to send in the contact-->
  <!--<param name="reg-id" value="1"/>-->
</include>

Asterisk – versatel.sip

Die Versatel wünscht sich als REALM „versatel.sip“ in der Registrierung. Mit der folgenden Konfiguration funktioniert die Registrierung mit einer Asterisk PBX.

Telefonnummer und Kennwort sind natürlich der individuellen Konfiguration anzupassen…

/etc/asterisk/sip.conf:

register => 0049301234567:bu!Msuf5@versatel.sip/0049301234567
 
[0049301234567]
type=peer
host=62.214.36.241
outboundproxy=versatel.sip
realm=versatel.sip
proxy=versatel.sip
registrar=versatel.sip
port=5060
context=isdn-incoming
defaultuser=0049301234567
fromuser=0049301234567
username=0049301234567
secret=bu!Msuf5
dtmfmode=rfc2833
insecure=port,invite
canreinvite=no
registertimeout=600
disallow=all
allow=alaw
allow=ulaw

ggf. ist noch in der /etc/hosts der folgende Eintrag sinnvoll hinzuzufügen:

62.214.36.241   versatel.sip