Exchange 2016 – DNString mismatch

This little article should be hopefully helpful to solve the following error while Updating a Microsoft Exchange Server 2016 or Accessing this Server using Powershell.
It’s not a solution to solve the actual problem, but a work a round to complete the Setup and get the Server up and running.

The Error shows up as:

„DNString length mismatch“

Don’t run into the wrong direction

At First don’t run into the wrong direction. This Error has noting to do with DNS (and a forgotten second „s“). It’s a LDAP Error. If this Error would be written by:

„DN String length mismatch“

it would be more clearly!

Description

While running the Update procedure to MS Exchange 2016 CU 8, the Setup interrups while progressing Mailbox role: Client Access service with the following Error:

Searching objects of type "ADOwaVirtualDirectory" with filter "(OwaVersion NotEqual Exchange2003or2000)", scope "SubTree" under the root "EXCH16".
[ERROR] DNString length mismatch
[WARNING] An unexpected error has occurred and a Watson dump is being generated: DNString length mismatch
Die Active Directory-Sitzungseinstellungen für 'Set-OwaVirtualDirectory' lauten: Vollständige Gesamtstruktur anzeigen: 'True', Konfigurationsdomänencontroller: 'pdc.example.com', Bevorzugter globaler Katalog: 'pdc.example.com', Bevorzugte Domänencontroller: '{ pdc.example.com }'
User specified parameters:  -Identity:'EXCH16\OWA (Exchange Back End)' -FormsAuthentication:'False' -WindowsAuthentication:'True'
Beginning processing set-OwaVirtualdirectory
Searching objects "EXCH16\OWA (Exchange Back End)" of type "ADOwaVirtualDirectory" under the root "$null".
Previous operation run on domain controller 'pdc.example.com'.
[ERROR] DNString length mismatch
[WARNING] An unexpected error has occurred and a Watson dump is being generated: DNString length mismatch

While accessing the OWAVirtualDirectory I got the same Error:

Get-OwaVirtualDirectory
WARNUNG: Unerwarteter Fehler. Ein Watson-Abbild wird generiert: DNString length mismatch.

Trying to remove the actual OWA Directory to recreate it would fail with the same error

Remove-OwaVirtualDirectory "Exch16\owa (Default Web Site)"
WARNUNG: Unerwarteter Fehler. Ein Watson-Abbild wird generiert: DNString length mismatch.
DNString length mismatch
    + CategoryInfo          : NotSpecified: (:) [Remove-OwaVirtualDirectory], FormatException
    + FullyQualifiedErrorId : System.FormatException,Microsoft.Exchange.Management.SystemConfig 
   urationTasks.RemoveOwaVirtualDirectory
    + PSComputerName        : Exch16.example.com

work a round

OK, let’s fix it!

Short info: The Attributes we will need to correct will be not editable by using ADSI, so I used Apache Directory Studio.

Connect to
CN=Configuration,DC=example,DC=com

LDAP-Tree and Navigate to:
DN: CN=owa (Default Web Site),CN=HTTP,CN=Protocols,CN=EXCH16,CN=Servers,CN= Exchange Administrative Group (ABCDEFGH12IJKLM),CN=Administrative Groups,CN =First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=example,DC=com

If you dump this branch into ldif File you would find something link this:

msExchOWABlockedMIMETypes: S:22:application/javascript:CN=owa (Default Web S
 ite),CN=HTTP,CN=Protocols,CN=EXCH16,CN=Servers,CN=Exchange Administrative 
 Group (ABCDEFGH12IJKLM),CN=Administrative Groups,CN=First Organization,CN=M
 icrosoft Exchange,CN=Services,CN=Configuration,DC=example,DC=com
msExchOWABlockedMIMETypes:: Uzo2NjrigKDigKDigKDigKDigKDigKDigKDigKDigKDigKDi
gKDigKDigKDigKDigKDigKDigKDigKDigKDigKDigKDmhKA6Q049b3dhIChEZWZhdWx0IFdlYiBT
aXRlKSxDTj1IVFRQLENOPVByb3RvY29scyxDTj1FWENIMTYsQ049U2VydmVycyxDTj1FeGNoYW5n
ZSBBZG1pbmlzdHJhdGl2ZSBHcm91cCAoQUJDREVGR0gxMklKS0xNKSxDTj1BZG1pbmlzdHJhdGl2
ZSBHcm91cHMsQ049Rmlyc3QgT3JnYW5pemF0aW9uLENOPU1pY3Jvc29mdCBFeGNoYW5nZSxDTj1T
ZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWV4YW1wbGUsREM9Y29t=

The second line is the problem.

Find and Remove the Lines starting with „††.*“

After that connect to powershell and discard and recreate the OWAVirtualDirectory (with command Feedback):

Remove-OwaVirtualDirectory "EXCH16\owa (Default Web Site)"
Remove-OwaVirtualDirectory "EXCH16\owa (Exchange Back End)"
 
New-OwaVirtualDirectory  -InternalUrl “https://exch16.example.com/owa” -ExternalUrl “https://mail.example.com/owa”
 
Name                             Server                           OwaVersion
----                             ------                           ----------
owa (Default Web Site)           EXCH16                          Exchange2013
 
New-OwaVirtualDirectory  -InternalUrl “https://exch16.example.com/owa” -ExternalUrl “https://mail.example.com/owa” -WebSiteName “Exchange Back End”
 
Name                             Server                           OwaVersion
----                             ------                           ----------
owa (Default Web Site)           EXCH16                          Exchange2013
 
Get-OwaVirtualDirectory
 
Name                             Server                           OwaVersion
----                             ------                           ----------
owa (Default Web Site)           EXCH16                          Exchange2013

Please check also OWAMailboxPolicy, it’s possible that you get the same error:

Get-OwaMailboxPolicy
WARNUNG: Unerwarteter Fehler. Ein Watson-Abbild wird generiert: DNString length mismatch.
DNString length mismatch
    + CategoryInfo          : NotSpecified: (:) [Get-OwaMailboxPolicy], FormatException
    + FullyQualifiedErrorId : System.FormatException,Microsoft.Exchange.Management.Tasks.GetOwa
   MailboxPolicy
    + PSComputerName        : exch16.example.com

If so, goto DN: CN=Default,CN=OWA Mailbox Policies,CN=First Organization,CN=Microsoft Ex change,CN=Services,CN=Configuration,DC=example,DC=com and Find and Revove the Lines starting with „††.*“.
After that recreate the MailboxPolicy by:

Remove-OwaMailboxPolicy
New-OwaMailboxPolicy -Name Default

Then restart the Exchange Upgrade Setup. It should be completed.

Environment

This problem occours while Updating MS Exchange Server 2016 to CU 8 released on 17. Dec. 2017 on Windows 2012 Server R2 Std. The MSAD PDC is a Windows Server 2012 R2 and a Samba Server Version 4.5.12 (Running Debian Stretch) as Fileserver and Domain Controller.

Uncheck assumption: The Problem maybe occurs because of an Replication Error.
Possible hint: The defect BASE64 String in the LDAP Tree is maybe happend by a bit toppler in replication
ToDo: Try to reproduce in Lab