Hi there!
We have 2 forests (2-way trust), one forest has Exchange 2019 (CU11) and the other Exchange 2019 (CU10).
FIM GALSync is syncing Address Books between organization. So we have cross-forest contacts created with the attribute set required for cross-forest sharing ability.
FIM has been setup a while ago when both Exchange orgs were on 2013 version, and all the cross-forest contacts have msExchVersion attribute value set to '88218628259840', which refers to Exchange 2013.
When I try to add cross-forest permissions with msExchVersion=88218628259840 I got an exception:
Add-MailboxPermission domain1\john.smith -user domain2\michael.brown -AccessRights fullaccess -AutoMapping:$False -InheritanceType all
WARNING: An unexpected error has occurred and a Watson dump is being generated: Unable to cast object of type 'Microsoft.Exchange.Data.Directory.Recipient.ADContact' to type
'Microsoft.Exchange.Data.Directory.Recipient.IADSecurityPrincipal'.
Unable to cast object of type 'Microsoft.Exchange.Data.Directory.Recipient.ADContact' to type 'Microsoft.Exchange.Data.Directory.Recipient.IADSecurityPrincipal'.
+ CategoryInfo : NotSpecified: (:) [Add-MailboxPermission], InvalidCastException
+ FullyQualifiedErrorId : System.InvalidCastException,Microsoft.Exchange.Management.RecipientTasks.AddMailboxPermission
Although, I can add cross-forest permissions to the calendar:
Add-MailboxfolderPermission "john.smith@domain1.com:\Calendar" -user michael.brown@domain2.com -AccessRights PublishingEditor
FolderName User AccessRights
---------- ---- ------------
Calendar michael.brown {PublishingEditor}
==================================================================================
Then I set msExchVersion=1125899906842624 to the cross-forest contact, which is actually 2016, but I'm not able to find any reference to 2019.
Now I'm able to successfully add cross-forest permissions:
Add-MailboxPermission domain1\john.smith -user domain2\michael.brown -AccessRights fullaccess -AutoMapping:$False -InheritanceType all
Identity User AccessRights IsInherited Deny
-------- ---- ------------ ----------- ----
domain1.local\jo... domain2\michael.b... {FullAccess} False False
At the same time I got 'Add-MailboxfolderPermission' broken:
Add-MailboxfolderPermission "john.smith@domain1.com:\Calendar" -user michael.brown@domain2.com -AccessRights PublishingEditor
The user "michael.brown@domain2.com" is either not valid SMTP address, or there is no matching information.
+ CategoryInfo : NotSpecified: (:) [Add-MailboxFolderPermission], InvalidExternalUserIdException
+ FullyQualifiedErrorId : [Server=ServerName,RequestId=29d1bcf9-52f8-4bf9-90a7-570a392490c7,TimeStamp=22.11.2021 10:16:00] [FailureCategory=Cmdlet-InvalidExternalUse
rIdException] 78747CAA,Microsoft.Exchange.Management.StoreTasks.AddMailboxFolderPermission
I have never managed to get these things work together. We have not had any issues with sharing on Exchange 2013.
We have no option to open a case in MS Support, so any input would be appreciated.
