The format of the schedule attribute of the following object is unrecognizable

Symptoms:
Knowledge Consistency Checker logs “The format of the schedule attribute of the following object is unrecognizable. ” error in Directory Service log on a Domain Controller.

Error message:
Log Name: Directory Service
Source: Microsoft-Windows-ActiveDirectory_DomainService
Event ID: 1121
Task Category: Knowledge Consistency Checker
Level: Error
Keywords: Classic
User: ANONYMOUS LOGON
Computer: LON-DC01.contoso.com
Description:
The format of the schedule attribute of the following object is unrecognizable.

Object:
CN=Lon2NYC,CN=IP,CN=Inter-Site Transports,CN=Sites,CN=Configuration,DC=contoso,DC=com

A default schedule will be substituted. This event will continue to occur until the schedule attribute on this object has been corrected.

User Action
Modify the schedule attribute.

Resolution:
The error is logged when there is no allowed period when replication can run between the sites connected by the Site Link referenced in the error, so replication fails back to the default 3 hours.
To resolve the issue open Active Directory Sites and Services snap-in, expand to Sites > Inter-site Transports > IP, then locate the Site Link highlighted in the error, and in the Properties of the Site Link on the General tab click on Change Schedule… and make sure there are period(s) when replication is allowed.

replication
The corrected replication schedule will need to replicate to sites that are connected by the Site Link, which can take up to 3 hours.

Disabled user account prevents ActiveSync remote wipe to succeed

It is a common security practice to disable user accounts before a former employee’s device is wiped. But Exchange ActiveSync remote wipe command is received successfully only when the target device can connect and authenticate to Exchange.

Remote wipe command queued.wipe pending

ActiveSync device attempts to connect to Exchange server while the AD account is disabled or password is invalid. The attempt fails with HTTP Error 401: Unauthorized

10:10:54 10.1.1.10 OPTIONS /Microsoft-Server-ActiveSync/default.eas &CorrelationID=<empty>;&ClientId=…&cafeReqId=…; 443 Contoso\jsmith 10.1.1.20 Apple-iPhone4C1/1206.70 – 401 1 1326 437

ActiveSync device successfully connects to the Exchange server

10:42:17 10.1.1.10 OPTIONS /Microsoft-Server-ActiveSync/default.eas &CorrelationID=<empty>;&ClientId=… &cafeReqId=…; 443 Contoso\jsmith 10.1.1.20 Apple-iPhone4C1/1206.70 – 200 0 0 15

ActiveSync device successfully retrives policy update

10:42:18 10.1.1.10 POST /Microsoft-Server-ActiveSync/default.eas User=jsmith&DeviceId=…&DeviceType=iPhone&Cmd=Provision&CorrelationID=<empty>;&ClientId=… &cafeReqId=…; 443 Contoso\jsmith 10.1.1.20 Apple-iPhone4C1/1206.70 – 200 0 0 93

ActiveSync device successfully confirms device wipe started

10:42:18 10.1.1.10 POST /Microsoft-Server-ActiveSync/default.eas User=jsmith&DeviceId=..&DeviceType=iPhone&Cmd=Provision&CorrelationID=<empty>;&ClientId=… &cafeReqId=…; 443 Contoso\jsmith 10.1.1.20 Apple-iPhone4C1/1206.70 – 200 0 0 62

Device wiped successfully .wipe successfull

Now you can disable the user account in Active Directory.

(example logs truncated for readability.)

homeMTA points to Active Directory object that have been deleted

Symptoms:

After uninstalling Exchange server and removing its Active Directory object  Event ID 2937 logged in Application log on an Exchange server and/or Warning “One or more Objects properties are pointing to Active Directory deleted objects” is recorded in SCOM.

Example event logged in Event log
Log Name:      Application
Source:        MSExchange ADAccess
Event ID:      2937
Task Category: Validation
Level:         Warning
Computer:      EX1-LON.adatum.com
Description:
Process powershell.exe (PID=12345). Object [CN=Doe\, John, OU=Users,OU=London, ,DC=Adatum,DC=com]. Property [HomeMTA] is set to value [adatum.com/Configuration/Deleted Objects/Microsoft MTA
DEL:aae571ff-19d3-bbcc-bf8a-eed91e496ea1], it is pointing to the Deleted Objects container in Active Directory. This property should be fixed as soon as possible.

SCOM warning:
Process mmc.exe (PID=67890). Object [CN=Doe\, John, OU=Users,OU=London, ,DC=Adatum,DC=com]. Property [HomeMTA] is set to value [adatum.com/Configuration/Deleted Objects/Microsoft MTA
DEL:aae571ff-19d3-bbcc-bf8a-eed91e496ea1], it is pointing to the Deleted Objects container in Active Directory. This property should be fixed as soon as possible.
EventSourceName: MSExchange ADAccess

Knowledge: http://go.microsoft.com/fwlink/?LinkID=67336&id=D00ED0ED-D9B5-48DF-9FF7-32F1A9CC592B

Computer: EX1-LON.adatum.com

Note: process name can be different depending on what process accessed the object

Resolution:
Generally  recommended solution in MS Article “One or more Objects properties are pointing to Active Directory deleted objects” solves the issue except if on the object in question has the msExchHomeServerName attribute point to an Exchange server which no longer exist.

In this case running Get-Mailbox <Alias> | Update-Recipient has no effect.
To resolve the issue when both homeMTA and msExchHomeServerName attribute have invalid values, run:
$MBX = Get-Mailbox -Identity ‘Doe, John’
Set-Mailbox $MBX -Database $MBX.Database -Confirm:$true -Force -Verbose

Source:
http://www.yusufozturk.info/windows-powershell/how-to-fix-incorrect-msexchhomeservername-attribute-after-removing-an-exchange-mailbox.html

Note: alert might not be cleared in SCOM up to 24 hours