user admin privileges may be broken

[mattprom]

In my initial testing of importing data to the target server I get the following error message.

domain 'domain-name-hidden': cannot resolve Account Id: user admin privileges may be broken

This is on Zimbra 7.2.3 Network Edition running on CentOS.

This IS a multi mailstore environment, with the Zextras core only installed and running on one of the 11 store servers. Before scheduling a brief maintenance to install the core on all hosts, could you tell me if the error above is likely due to me not having installed the core across all hosts? I'd like to have a little extra confidence that the install and mailboxd restarts will resolve this issue.

Thank you,
Matt

[Cine]

Hello Matt,
welcome to the forums!

While the ZeXtras Core must be installed on all mailboxd servers in order to be properly functional, this is unlikely the cause of the issue you are experiencing...

The message you report is a non-blocker error that appears when you import/restore a domain that has one or more Access Control Entries granted to a user that does not exist on the server.

Sample scenarios
- Domain a.com and b.com on the source server, user@a.com is domain admin for b.com. Move b.com to another server.
- user@a.com is a domain admin for a.com. user@a.com is deleted and the delegation settings are not properly updated by Zimbra. Move a.com to another server or restore a.com on the same server.

To check which users have at least one ACE set on the domain you can use the following oneliner on the source server (tested on Zimbra 8 only - execute as the zimbra user)

for i in `zmprov gd example.com | grep zimbraACE: | awk -F' ' {'print $2'} | sort -u`; do zmprov ga $i|grep "# name"; done;

Please let me know if you can find the cause of the error, otherwise I'll alert the devs to check for a possible bug.
Also, remember that both Classes of Service and Users can have ACEs referring to other users/cos/domains too.

Have a nice day,
Cine
the ZeXtras Team