Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9305 Source: MSExchangeSA

OALGen encountered error 8004010f while loading the template /O=Organization_Name/cn=Configuration/cn=Addressing/cn=Address-Templates. All display templates will not be available for the client download.
From a newsgroup post: "9305 events are created when the System Attendant (MSExchangeSA) calls the OABGen.dll to build the files. This event is logged when there is trouble with the templates.

To turn up logging on the OAB:
1. Open ESM, and navigate to the Server Name specified as the OAB server.
2. Right-click the Server Name, and then click Properties.
3. Click the Diagnostics Logging tab.
4. Click MSExchangeSA.
5. Turn the OAL Generator to minimum. In extreme cases, Maximum can be used.

Note: This should be set to none after troubleshooting the issue.

There are several possible causes and solutions.

INCORRECT LegacyExchangeDN value:
1. Open adsiedit.msc on your Exchange server, and navigate to:
     CN=Microsoft Exchange
2. Right-click Address-Templates, and then click Properties.
3. Double-click the legacyExchangeDN.
4. Copy the value to a text file as a backup.
5. Change this value to anything else.
6. Force AD replication if you there are multiple DCs.
7. Rebuild the OAB.
8. Event 9305 event errors in the application log.
9. To resolve the issue, copy the DN name in the event log error back into the Address-Templates legacyExchangeDN value.

The value is normally formatted as:

There may be incorrect entries in the Display Templates or Address Templates.

To recreate the error by adding an inappropriate value:
1. Using ADSIEdit, expand Configuration..., CN=Configuration...,
CN=Services, CN=Microsoft Exchange, CN=<OrgName>, CN=Addressing
2. Right-click Address-Templates, or right-click Display-Templates
3. Open MSExchTemplateRDNs, and add an incorrect value. The correct values
should also be listed with a "CN=" value underneath the container. For
example, on an English server add a value of 9.
4. Open ESM, and navigate to Recipients, and then Offline Address Lists.
5. Right-click an OAB, and then click Rebuild.

Note: By default the Default Offline Address List will be listed, and can be rebuilt.
6. A message will be received that this could take several hours. Click OK.
7. Open the Application Event Log to view the 9305 event.

Authenticated Users need Read permissions on the Address Templates and
Display Templates.

To recreate the issue:
1. Using ADSIEdit, expand Configuration..., CN=Configuration...,
CN=Services, CN=Microsoft Exchange, CN=<OrgName>, CN=Addressing
2. Right-click Address-Templates, or right-click Display-Templates
3. Click the Security tab
4. For Authenticated Users, clear the Allow for the "Read" permission.
Rebuild the OAB (detail steps up above) to generate the 9305 error.

Note: If a deny is set, article ME300444 has great information on using
DSACLS to remove a deny. For example:

If a deny was set on the Address-Templates, you would use dsacls to find the deny:
dsacls "CN=Address-Templates, CN=Addressing, CN=<OrgName>, CN=Microsoft
Exchange, CN=Services, CN=Configuration, DC=<DomainName>, DC=com".

In our example, say that Authenticated Users has the DENY. To remove the Deny:
DSACLS "CN=Address-Templates, CN=Addressing, CN=<OrgName>, CN=Microsoft
Exchange, CN=Services, CN=Configuration, DC=<DomainName>, DC=com" /I:T /R
"Authenticated Users"

Note: This command may remove Authenticated Users. ADSIEdit can be used to add Authenticated Users with Read permissions back to the Address-Template container.

The legacyExchangeDN for Address-Templates and Display-Templates must
contain the same information as the Organization container.

For example, the legacyExchangeDN for an organization name of "First
Organzation" will have the following legacyExchangeDNs:

for the Address-Templates container...
     /o=First Organization/cn=Configuration/cn=Addressing/cn=Address-Templates
for the Display-Templates container...
     /o=First Organization/cn=Configuration/cn=Addressing/cn=Display-Templates
for the Organzation...
     /o=First Organization

In this example, if the Address-Templates container had an extra space in the name, then the 9305 error would be generated.
     /o=First Organization

ADSIEdit can be used to correct.

the Address-Templates and Display-Templates containers can be deleted using ADSIEdit, and the setup with the forestprep switch can be run to repopulate.
CAUTION: This second option should only be done if a full backup of the
server and AD have been completed.

Address Templates or Display Templates may be missing. By running the
Exchange setup with the ForestPrep switch the objects will be regenerated.
(i.e. setup.exe /ForestPrep)
The regenerated objects in AD will be under the following branch:

CN=Addressing, CN=EPM, CN=Microsoft
Exchange, CN=Services, CN=Configuration, DC=tree, DC=exchadmin, DC=com".

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.