Exchange 2003, MSExchangeIS event ID 9548

Recently, event ID 9548 has been flooding my Exchange Server application log, resulting in performance degradation.

As described by the screenshot above, it is caused when an account does not have a master account SID assigned.It is usually triggered when you have a disabled user account with exchange  attributes in your Active Directory. This is what happened to me. One option you  can do is to delete the corresponding user from the AD, and purge everything related to the said user.

In my case, due to our company policy, deleting an account from the AD requires me to behead a black goat, put the corpse on top of a stone tablet, facing sunrise….. Kidding 😀 Let’s just say it’s not easily done 🙂 So I need to keep the disabled user account, and still be able to prevent this from happening.

Based on this, I need to set the Master Account SID for each of the disabled account in my AD. Unfortunately, there were tons of them. Luckily Microsoft provides us with nomas, a tool to perform such task in bulk. As written on the link, to get nomas, you need to contact Microsoft Product Support Service… or you can download it here 😀

Nomas is simple and very straight forward to use. Just unzip, and then doubleclick the nomas.exe file to start.

Pick check on Mode Selection, and check the “Disabled users” on User selection to start checking for disabled user without assigned Master account SID. The result will be stored on the log file. Change mode selection to “Fix” to start adding Master account SID on disabled users.

After running the tool, I’m happy to report that I no longer receive the event ID 9548 on my Exchange box 🙂