'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Disabled Active Directory Users Appearing as Exchange Contacts
Question details
Users who are disabled in Active Directory are incorrectly showing up as mail contacts in Exchange Online following a mailbox conversion and directory synchronization.
- Product
- Active Directory / Exchange Online
- Device & OS
- not provided
- Scenario
- Converting user mailboxes to shared mailboxes and synchronizing on-premises Active Directory with Azure AD.
- Observed behavior
- Disabled Active Directory user accounts appear as mail contacts rather than the expected shared mailboxes in the Exchange Online directory.
Ensure you have administrative access to your on-premises domain controller to use ADSI Edit, and the necessary permissions to force a delta synchronization on your Azure AD Connect server.
Clear the targetAddress Attribute and Force Synchronization
This solution removes the unwanted routing address that forces the user object to be recognized as a mail contact rather than a shared mailbox in Exchange Online.
When an on-premises Active Directory user is converted and disabled, lingering attributes can confuse the synchronization process. The targetAddress attribute dictates external routing; when populated, Exchange Online assumes the object is a contact. Clearing this attribute allows the system to properly recognize the user as a shared mailbox.
Log in to your domain controller, open the Run dialog, type 'adsiedit.msc', and press Enter. Connect to the Default naming context.
Navigate through your Organizational Units (OUs) to find the disabled user account that is appearing as a contact. Right-click the user object and select 'Properties'.
Scroll through the Attribute Editor to verify the 'MSExchMailboxGUID' attribute is intact. Next, find the 'targetAddress' attribute, select it, click 'Edit', and clear the value. Click 'OK' to save your changes.
Open an elevated PowerShell prompt on your Azure AD Connect server and execute the command: 'Start-ADSyncSyncCycle -PolicyType Delta'. Wait a few minutes for the changes to replicate to Exchange Online.
Looking for a lightweight alternative for your daily office tasks?
While managing Exchange and Active Directory requires specialized Microsoft administrative tools, your daily document management doesn't have to be tied to expensive subscriptions. WPS Office provides a free, lightweight, and highly compatible alternative for handling Word, Excel, and PowerPoint files.
- 1. Download the software: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install WPS Office: Run the setup file and follow the on-screen instructions to complete the quick installation process.
- 3. Open your documents: Launch WPS Office and open your existing Microsoft Office documents with perfect layout retention.
Frequently Asked Questions
Why does a disabled AD user convert into a mail contact instead of a shared mailbox?
This typically happens when the 'targetAddress' attribute is populated in the on-premises Active Directory. Azure AD Connect syncs this attribute, causing Exchange Online to interpret the object as a mail-enabled contact with an external routing address rather than an internal shared mailbox.
How long does it take for the delta sync to reflect changes in Exchange Online?
After triggering a delta sync via PowerShell, it generally takes between 5 to 30 minutes for the directory changes to propagate to Azure AD and reflect in the Exchange Online admin center.
Can I use the Exchange Admin Center instead of ADSI Edit to fix this?
If your environment is synchronized via Azure AD Connect from an on-premises Active Directory, object attributes like 'targetAddress' are locked in the cloud. They must be managed from the on-premises AD using tools like ADSI Edit or Active Directory Users and Computers (ADUC).
