So if the RUS is not working as expected against new or modified objects (the objects that would be touched by an Update Now), running a Rebuild will not help.

Because of the time it can take for a Rebuild to complete in a large environment, carefully consider how much time it will take to resume normal RUS operation before you choose to do a Rebuild.

Just after the 8011 you should find an 8012: Event Type: Information Event Source: MSExchange AL Event Category: LDAP Operations Event ID: 8012 Description: Search of directory base ‘DC=bilong, DC=test’ returned 16 objects.

This results in the application log quickly overwriting itself and makes it difficult to follow the sequence of events described above.

When troubleshooting the RUS, it is best to avoid Rebuilding or Applying and instead focus on a single test user and use only Update Now to check for new and modified objects.

If you are seeing this behavior repeatedly, it’s best to get a netmon trace capturing the behavior so the network problem can be identified.

If the search returned 0 objects, then the Exchange server computer account did not have permissions to see that user object.

Another way to check for a Rebuild is to turn down the diagnostics logging on everything but Address List Sychronization, and leave Address List Synchronization at Medium.

Then, watch the application log for the following events.After an Update Now, you can walk through the events described above to understand what the RUS is doing to a particular recipient. First you should determine if the RUS is even looking for recipients to process.Based on the schedule, or when Update Now is chosen, the RUS will query the domain for any new or modified objects.This article describes how to use the event log to identify these issues.It is up to the domain RUS’s for a given domain to stamp the mail-enabled objects in that domain naming context.Exchange allows you to create up to one domain RUS for every DC in the domain.