Mail-Enabling a User

Posted: March 27, 2010 in Active Directory, Exchange Server, Server, System Information
Tags: ,


You want to mail-enable a user.


Using a graphical user interface

  1. Open the Users and Computers (ADUC) snap-in.
  1. If you need to change domains, right-click on Active Directory Users and Computers in the left pane, select Connect to Domain, enter the domain name, and click OK.
  2. In the left pane, browse to the parent container of the user, right-click on the user, and select Exchange Tasks.
  3. On the Welcome screen, click Next.
  4. Select Establish E-mail Address and click Next.
  5. Verify the mail alias is what you want.
  6. Click Modify, select external email address type (generally SMTP Address), click OK, enter an external email address, and click OK.
There is an Advanced tab on the Internet Address Properties screen. On this tab, you have the option to override the default handling of email sent to this recipient (e.g., you can force all email to be delivered as HTML or plain text, etc.).
  1. On the Completion screen, click Finish.

Using a command-line interface

> exchmbx -b “<User DN>” -me <smtp email address>

Replace <User DN> with the user’s distinguished name and <smtp email address> with the user’s external email address.

To mail enable the user john with the email address, execute the following command. The command should be contained on one line:

> exchmbx -b “cn=john,cn=users,dc=bang,dc=com” -me

For an alternative Microsoft-native tool method, create an LDIF file called mailenable_user.ldf with the following contents:

dn: <User DN>

changetype: modify

replace: targetAddress

targetaddress: SMTP:<smtp email address>

replace: mailNickName

mailNickname: <mail nickname>

replace: mAPIRecipient

mAPIRecipient: FALSE

replace: legacyExchangeDN

legacyExchangeDN: <legacy exchange DN>

replace: internetEncoding

internetEncoding: 1310720

Replace <User DN> with the user’s distinguished name, <smtp email address> with the user’s external email address, and <legacy exchange DN> with the proper legacy exchange distinguished name value. Then run the following command:

>ldifde -i -f mailenable_user.ldf


A mail-enabled user is a user object that has at least one email address defined within Exchange, but does not have a mailbox. This does not give any access rights to the user within the Exchange system; it simply allows Exchange users to select the mailenabled user from the GAL and easily send email to them. You would use a mailenabled user when you have a user who needs to log in to the domain, but has an email address external to the forest’s Exchange organization. The email address could be external to the company or it could just be external to the Exchange organization of that forest. Examples would be users with mailboxes on external email systems or users with mailboxes on internal non- Exchange servers.

To mail-enable a user, you need to have permissions of Exchange View-Only Administrator or higher for the target administrative group. In addition, you need to have Read and Write permissions to the following object attributes:

  • adminDisplayName
  • autoReplyMessage (ILS Settings)
  • displayName (Display Name)
  • dLMemDefault
  • homeMDB (Exchange Mailbox Store)
  • homeMTA
  • internetEncoding
  • legacyExchangeDN
  • mail (E-Mail Address)
  • mailNickname (Alias)
  • mAPIRecipient
  • msExchADCGlobalNames
  • msExchControllingZone
  • msExchFBURL
  • msExchHideFromAddressLists
  • msExchHomeServerName (Exchange Home Server)
  • msExchMailboxGuid
  • msExchMailboxSecurityDescriptor
  • msExchPoliciesExcluded
  • msExchPoliciesIncluded
  • msExchResourceGUID
  • proxyAddresses (Proxy Addresses)
  • showInAddressBook
  • targetAddress
  • textEncodedORAddress

When you create a mail-enabled user with ADUC or with VBScript, you call out to the CDOEXM interface, which is the Microsoft-supported method of managing Exchange attributes on users, groups, and contacts. The specific method in this case is MailEnable. In the background, the specific changes made by the MailEnable method are on the user object in Active Directory and include changes to the following attributes:

  • targetAddress
  • mailNickname
  • mAPIRecipient
  • legacyExchangeDN

In addition to those attributes, the internetEncoding attribute should also be set for proper message handling. This is the attribute that is updated if you go into the Advanced tab of the Internet Address Properties screen. The default value for this attribute is 1310720, which tells Exchange to use the default settings of the Internet Mail Service. You can specify other values to force email to be converted to various formats. Table contains the list of alternate values for the internetEncoding attribute.

Table. internetEncoding attribute values
Value Meaning
1310720 Use Internet Mail Service settings
917504 Allow plain text
1441792 Allow plain text or HTML
2228224 Allow plain text/uuencoding
131072 Allow plain text/uuencoding with BinHex

Once all of those attributes are in place, the RUS sets additional attributes on the user object to make it useable for Exchange.

Using a graphical user interface

Mail-enabling a user is a little more confusing if you are creating new users because you don’t get prompted to mail-enable them. To create a mail-enabled user from scratch, create the user and, when prompted to create a mailbox, clear the Create an Exchange Mailbox checkbox. Once the user is created, follow the directions described in the solution.

Using a command-line interface

Command-line administration tools for Exchange are rather rare. Luckily, the Exch-Mbx tool is available as a free download from This tool can turn a difficult process into something quite simple. If you need to modify the internetEncoding attribute, add the internetencoding option to the parameter list specifying the proper value from above table, For example:


exchmbx -b <UserDN> -me <SmtpEmailAddress> -internetencoding 917504

If you prefer Microsoft-native solutions, the LDIF solution we described will work, but can be dangerous because there is the possibility of duplicating critical values within the Exchange organization. If you put duplicate mailNickname or legacyExchangeDN values into the system, you will have bad results in your Exchange organization that will almost certainly start producing nondelivery reports (NDR) for the mail objects involved.

The mailNickname attribute can generally be set to be the same as the sAMAccountName, which has to be unique in the domain. But what should you do you with legacyExchangeDN? If you aren’t tied to a legacy 5.5 organization, you can follow the simple format the system currently uses. If you have a legacy 5.5 organization, you need to follow the structure for that organization. For assistance with this, contact Microsoft PSS or Microsoft Consulting Services.

The general format of legacyExchangeDN is:


You should always verify by searching Active Directory that the legacyExchangeDN you chose is not already used. The reason for this is that someone may have changed an existing user’s mailNickname but, correctly, did not touch the legacyExchangeDN value. You could, of course, fix the legacyExchangeDN of that other user so that it properly fits the pattern, but you would impact the user’s email functionality.

The attribute legacyExchangeDN is used in Exchange internally for addressing email. If you try to respond to an email sent to you by a user within the same Exchange organization who has had her legacyExchangeDN changed, you will get an NDR and the mail will not be delivered. So, if a user has a name change from Chris Smith to Chris Jones and her sAMAccountName and mailNickname both change from csmith to cjones, her legacyExchangeDN must remain the same so that anyone within the Exchange organization will be able to easily respond to emails she sent as csmith. The point is that you should always check that the legacyExchangeDN value you are setting is unique. The simple solution to follow if the value is already present is to append a -1, -2, or whatever dash value is required to get to a unique value.

You have the option of not specifying the legacyExchangeDN in the LDIF file. If the attribute is empty, Exchange will populate it for you. If there is already a value, Exchange will not change the attribute.

Unfortunately, if you are mail enabling an object that was previously mail- or mailbox enabled, it could have an existing value for legacyExchangeDN; this value may or may not be unique. One very specific case is that some tools will set the legacyExchangeDN value to ADCDisabled when an object is mail or mailbox disabled to alert the ADC to the object’s status.

  1. volheckmo says:

    “This is the attribute that is updated if you go into the Advanced tab of the Internet Address Properties screen. The default value for this attribute is 1310720, which tells Exchange to use the default settings of the Internet Mail Service. You can specify other values to force email to be converted to various formats. Table contains the list of alternate values for the internetEncoding attribute.”
    Where I have been able to read about this?

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s