Exchange 2010. About 10,000 mail objects in AD. When adding "Full-Access Permissions" to any mailbox, the Select User or Group picker is extremely slow. If I press STOP before all objects are found... and then manually enter a name such as smith in the SEARCH: box, it takes forever to find all of the smiths in the GAL. Anyone else experiencing this issue ? I previously managed a 25,000 mailbox Exchange2007 environment, and never had any slowness when assigning permissions and using the picker.

Have you tried the Add-MailboxPermission exchange shell command. More Information about this command you will find on http://technet.microsoft.com/en-us/library/bb676551.aspx Please remember that when using LDAP Seaarch (Pickerr) not all objects will be shown. So if you are working on a large infrastructure yu have to use the commandline interface. Further information you will find on http://support.microsoft.com/kb/315071 or http://ldapwiki.willeke.com/wiki/LDAP%20policy%20in%20Active%20Directory regards Thomas Paetzold visit my blog on: http://susu42.wordpress.com

The powershell method works great for anyone comfortable with PS and knows the exact name of the group and mailbox ahead of time. But for this customer (a hospital)... their helpdesk and email support team need to be able to use the EMC to assign these permissions. The issue is when scrolling through 5000 objects in the picker or using "find now" to locate the correct security group to assign the permissions... performance is incredibly slow.

Yes, I reported the same problem: http://social.technet.microsoft.com/Forums/en-US/exchangesvradmin/thread/b2ebf28d-dc03-4e71-a064-1a77d6b0ebe8/?prof=required You replied there as well....so I know it's NOT just me. FIX FIX FIX Microsoft! :-)

There were alot of improvements with the picker/search functionality in Service Pack 1 for Exchange 2010. Do you have SP1 installed? If you try searching for on object in Active Directory Users and Computers, how are the results? (Use a test account, go to properties, security tab, and try to add/search) We've had this reported and SP1 seemed to improve the functionality a bit... Thanks, Kevin Ca - MSFTKevin Ca - MSFT

Yes, SP1 is installed. Searching for objects in AD Users and Comptuers the results are fast like always. On Exchange 2010, if you go under the properties of a mailbox, and select something like "Send on Behalf Of" and search, it's fast. Only using Full Access and Send-As permissions from the main Exchange 2010 Console is it slow. When we were on Exchange 2007, this was very fast like it should be. I think it's a bug and it needs addressed.

Can confirm it too (2010 SP1 + UR2) It wants to show all user and group objects, even non-mail enabled (since you can grant access to a security group) -I'd guess this would total up to over 500,000 for my env. I don't even want to pick the name from the list, I just want to search for it!

Hi, when you are administering a real big Active Directory with 10,000 Mailobjects you should think about using the commandline instead of using the graphical userr interface (Exchange Console) Please refer to the Excahnge Shell (Powershell extensions) Commands for administering the Exchange system. regards Thomas Paetzold visit my blog on: http://sus42.wordpress.com

I am going to have to disagree with your Peddy. While us real Exchange admins can easily use the Shell, and thats what I have been having to do, there are times in enivroments where a help desk worker has the Exchnage Recipient Admin role, and needs to be able to set these via the GUI. Thats why the GUI is there. We have a very large AD enviroment, over 100,000 objects, and the picker worked just fine on Exchange 2007. Like CN9 said above, it wouldn't as bad if the stupid search even worked, but it has to wait for it to try to show everything first before you can even do anything. It's a bug, and it's needs fixed, even though the Shell is a work around, it's not a solution to the problem that is being reported.

We have a few cases open with this issue reported. They're all still under investigation. I'll need a few days to do some research and once i have more information i can update this post. Thanks, Kevin Ca - MSFTKevin Ca - MSFT

On top of the functionality, I'd also be concerned about the impact to Global Catalogs. Not sure what's happening in the backround but hopefully it's not hammering them with some inefficient query. I may have hundreds of people running the Exchange console - not only do I not want to teach them powershell but I'd hate to see GCs going down. Good to hear it's being looked at.

To provide an update on my earlier post. I did some research on the cases we have right now, and they are all scenarios where Service Pack 1 has the fixes included to address the performance issues. If you have Service Pack 1 installed, we'll likely need to pursue this in 1 of the 2 following ways: 1. Evaluation of basic performance monitor counters on the affected Exchange Servers & Domain Controllers/Global Catalogs or 2. Open a support case to report the problem. To comment on the second option; without any open tickets or reported problems, our options to pursue/troubleshoot these issues via forums communications are very limited. As a reminder; if you open a support case and it is determined to be a code problem or a bug, you are not charged/decremented for the incident. I did in fact try to reproduce the issue in my lab by importing 30K mail enabled users; but could not reproduce it. This is a scenario where real data is critical for us to troubleshoot. Thanks, Kevin Ca - MSFTKevin Ca - MSFT

Kevin, I have already been through option 1, and performance looks normal. Nothing out of the ordinary I can tell. And like we stated, it only happens when setting Send-As or Full Access from the main MMC GUI. Creating mailboxes and searching, setting send on behalf of, journal rules and searching and selecting a user, etc...all normal. Exchange 2007 never had this problem in our enviroment as well. We have operations manager that logs performance data, and I have used process monitor, task manager, performance monitor, etc, locally and on the DC's to see if there is an additional load. Not seeing anything. So that leaves option 2. I relize that we may not be charged, but I do not make deceisions at work in terms of money, and I cannot contact support for something like this unless it would be determined to be a major issue. Unless you can provide a way for me to talk to support without asking for credit card info, I cannot report the problem, hence why I am on these forums. If you want to touch base with me through e-mail, feel free, and I can send you all the logs, information etc, you want. Thats one of the problems with Micrsoft support. There needs to be a place for support to report bugs like these without being hassled for biling information. I really don't think I can get the people who control money at work to allow me to use a credit card to call support on this issue because in their minds, this wont' be a critical need and doesn't impact end users at all. But I know Microsoft has a desire to gather information from clients to get these issues fixed, so we are kind of in a catch 22 situation. Feel free to touch base with me thoguh e-mail. I am sure as a mod you can find my e-mail address.

Kevin, I have already been through option 1, and performance looks normal. Nothing out of the ordinary I can tell. And like we stated, it only happens when setting Send-As or Full Access from the main MMC GUI. Creating mailboxes and searching, setting send on behalf of, journal rules and searching and selecting a user, etc...all normal. Exchange 2007 never had this problem in our enviroment as well. So that leaves option 2. I relize that we may not be charged, but I do not make deceisions at work in terms of money, and I cannot contact support for something like this unless it would be determined to be a major issue. Unless you can provide a way for me to talk to support without asking for credit card info, I cannot report the problem, hence why I am on these forums. If you want to touch base with me through e-mail, feel free, and I can send you all the logs, information etc, you want. Thats one of the problems with Micrsoft support. There needs to be a place for support to report bugs like these without being hassled for biling information. I really don't think I can get the people who control money at work to allow me to use a credit card to call support on this issue because in their minds, this wont' be a critical need and doesn't impact end users at all. But I know Microsoft has a desire to gather information from clients to get these issues fixed, so we are kind of in a catch 22 situation. Feel free to touch base with me thoguh e-mail. I am sure as a mod you can find my e-mail address.

We haven't deployed 2010 yet as we're still testing. I'm going to apply the latest update rollup to our lab (just came out the other day) and if it's still occurring I'll open a case. I'll post back, but it might take a couple of weeks.

I just find it odd it only happens in the main MMC screen: Recipient Configuration -> Mailbox -> right click user mailbox and select Full Access or Send-As permissions. SLOW SLOW SLOW The picker is fast everywhere else in my testing. Trying to compile a list of where the picker is normal (like it was in Exchange 2007): · When creating a mailbox for an existing AD user · Mailflow tab on a mailbox. Going to delivery options on a mailbox and setting Send on Behalf of permission, or setting a Forward To address · Mailflow tab on a mailbox. Setting message delivery restrictions to accept/reject messages from certain senders · Organization Config -> Hub Transport -> Journal Rules. Creating a journal rule and setting the journal reports, or journal message recipient. · Recipient Config -> Distribution Group -> select a group and add a member I am sure there are other places as well. It also makes no difference if you are using the management console on any of the Exchange servers (whether it be a mailbox, CAS, or HUB) or even remotely on my management workstation using just the management tools.

Get the exact same thing here, running 2010 SP1 RU3. If I add group members to dist. groups it runs just fine. If I do a full permisison add it takes awhile to load up.

I have exactly the same issue as described above. Running Exc2010 SP1 UR 3. I have a parent domain, with three child domains underneath. I have around 5'000 mailboxes in my system, and around 6000 AD users acounts in my main domain (not factoring in other AD objects like groups, or user accounts on other domains). Does anyone have an update on this issue? Kevin Ca, what environment are you running in your lab? Are you on Update Rollup 3? I'm very suprised that you say you can't replicate the issue. Perhaps your AD in your Lab is too thinly populated to cause the issue? Is there a way of setting a default context for these searches? Mine reverts to the top level of our forest on each use. If it was at least set to the child domain\OU where my users accounts are, this might speed things up slightly. Obviously that's only a workaround, just like suggesting using powershell (user admins aren't often powershell gurus). We need this behaviour rectifiying, it's clearing been identified in multiple sites, all running up to date Exchange builds. Is there any chance that UR4 may include a fix for this? Have any other users out there found any resolutions themselves? I've actually had an operations guy today start reporting that his MMC is crashing when he tries to do these searches in the console. Has anyone experienced that yet? I've not yet been able to replicate it on any of my consoles, just wanted to know if anyone else out there has. Thanks in advance all :) Gavin Connell