| Event Id | 136 |
| Source | MSExchangeDX |
| Description | Message received from unknown DirSync requestor - X400:/ddat=ms /ddav="NEWTORK/POSTOFFICE/$SYSTEM. |
| Event Information | The above error message can be generated if the Microsoft Exchange Directory Synchronization service (DXA) receives a directory synchronization (dirsync) message from an unknown requestor. When a directory synchronization (dirsync) requestor or remote requestor is created, a custom recipient (CR) for the $SYSTEM of the MSMail postoffice (PO) is automatically generated. The MSExchangeDX component uses this to address dirsync messages. This CR is also used to identify valid remote dirsync requestors and DirSync servers. The MSExchangeDX component only deals with Distinguished Names (DN). When a message comes in, it is compared to the list of the DNs that the MSExchangeDX component knows about. If the DN doesnt match, it gets discarded. In this case, the MS Mail Connector is transporting the message, and as part of the hand-off, it tries to convert the MS proxy address of the sender into a known DN. When it fails, the MSExchangeDX component generates the above error message. Possible reasons for the DN lookup failing include multiple occurrences of an address. In other words, it can fail if the CR was created for the $SYSTEM account in two separate sites before those sites replicated. To correct the problem, you must look for both hidden and regular recipients to see if the CR for the particular PO already exists. If it does, the duplicate entry from the server or site that is not running the DirSync process must be deleted and the change must be replicated. |
| Reference Links | Message Received from Unknown Dirsync Requestor |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.