How to Find Duplicate X500 Addresses in Active Directory
Question details
The user needs to locate and resolve duplicate X500 addresses causing Azure AD Connect synchronization errors.
- Product
- Active Directory
- Device & OS
- not provided
- Scenario
- Azure AD Connect synchronization is failing due to identical X500 proxy addresses assigned to multiple objects.
- Observed behavior
- Azure AD Connect reports an error indicating that two synchronized on-premises Active Directory objects have the exact same X500 address in their proxyAddresses attribute.
Ensure you have the Active Directory PowerShell module installed and possess sufficient administrator privileges to query and modify user attributes in your domain.
Export and Modify proxyAddresses using PowerShell
Use the Get-ADUser PowerShell cmdlet to export all proxy addresses to a CSV file, identify the duplicates, and correct the affected user objects.
When Azure AD Connect encounters duplicate X500 addresses in the proxyAddresses attribute, it halts synchronization for those specific objects. Exporting the directory data to a CSV allows you to easily search and filter for the duplicate values using a spreadsheet application.
Open PowerShell as an Administrator on a domain controller or a machine with Remote Server Administration Tools (RSAT) installed.
Execute the Get-ADUser cmdlet to export user proxyAddresses to a CSV file. For example: Get-ADUser -Filter * -Properties proxyAddresses | Select-Object Name, @{L='ProxyAddresses'; E={$_.proxyAddresses -join ';'}} | Export-Csv -Path C:\temp\proxyaddresses.csv -NoTypeInformation.
Open the resulting CSV file in your preferred spreadsheet application to search for the specific duplicate X500 address reported by the Azure AD Connect error.
Open Active Directory Users and Computers (ADUC), locate the incorrect user object, navigate to the Attribute Editor tab, and remove or correct the duplicate X500 entry in the proxyAddresses attribute.
Run a delta sync in Azure AD Connect to apply the changes and resolve the synchronization conflict.
Quickly Find Duplicates in CSV Exports using WPS Spreadsheet
After exporting your Active Directory proxyAddresses to a CSV file, you can easily open, filter, and highlight duplicate X500 entries using WPS Spreadsheet.
- 1. Open the exported CSV file: Launch WPS Office and open the exported CSV file containing the Active Directory proxy addresses.
- 2. Select the target column: Click the column header that contains the proxy addresses to highlight the entire column.
- 3. Apply conditional formatting: Go to the 'Home' tab, click on 'Conditional Formatting', select 'Highlight Cells Rules', and then choose 'Duplicate Values'.
- 4. Locate the exact duplicates: Scroll through or filter the highlighted duplicate X500 addresses to quickly identify which Active Directory objects need correction.
Frequently Asked Questions
Why does Azure AD Connect care about duplicate X500 addresses?
Azure AD Connect requires unique proxyAddresses, including X500 and SMTP addresses, across all synchronized objects to properly route emails and maintain accurate directory identities. Duplicates cause synchronization errors for the affected objects.
How do I force Azure AD Connect to sync after fixing the duplicate?
Open PowerShell on your Azure AD Connect server and run the command 'Start-ADSyncSyncCycle -PolicyType Delta' to initiate a delta synchronization immediately.
Can I search for a specific X500 address directly in ADUC without PowerShell?
Yes. In Active Directory Users and Computers, you can use the 'Find' feature, select 'Custom Search', go to the 'Advanced' tab, and use an LDAP query like proxyAddresses=X500:YourDuplicateAddress to find the exact user causing the conflict.
