Exchange trying to resolve external e-mail addresses in local Active Directory

Question

Hi
On all of my Mailbox Database servers, i'm getting the following warning in my Application log: 
Level: Warning
Source: MSExchange Mid-Tier Storage
EventID: 2009
Message:
[Process:w3wp PID:6032 Thread:89] Error occurred while resolving the Active Directory object for from email address field: '[email protected]'. Audit log will not be generated for this case. Exception details:
Microsoft.Exchange.Data.Storage.ObjectNotFoundException: The Active Directory user wasn't found.
at Microsoft.Exchange.Data.Storage.ExchangePrincipalFactory.FromProxyAddress(IRecipientSession session, String proxyAddress, RemotingOptions remotingOptions)
at Microsoft.Exchange.Data.Storage.ExchangePrincipalFactory.FromProxyAddress(ADSessionSettings adSettings, String proxyAddress, RemotingOptions remotingOptions)
at Microsoft.Exchange.Data.Storage.ExchangePrincipal.FromProxyAddress(ADSessionSettings adSettings, String proxyAddress)
at Microsoft.Exchange.Data.Storage.COWAudit.GetSubmitEffectiveMailboxOwner(MailboxSession session, CallbackContext callbackContext)
I have three Exchange Server 2013 MBX/CAS servers, and two Exchange Server 2013 Edge Transport servers in front of them.
As mentioned earlier, this warning is on all three of the MBX/CAS servers. The external e-mail address vary.
I've used the Get-MessageTrackingLog to debug, and I can see that this error comes when an internal user sends a "Meeting Forward Notification" to an external e-mail address. Exchange tries to resolve the external e-mail address in Active Directory
and throws this warning, for some reason.
Is there anyone that knows how to fix this?

Answer 1

Hi Allen
Sorry for the late reply.
1. No it's not. It gets the EventID "HADISCARD" and SourceContext "ExplicitlyDiscarded". Here's an example:
RunspaceId : a25e81b2-9f4a-49f2-895b-xxxxxxxxxxxx
Timestamp : 09-02-2015 13:01:02
ClientIp :
ClientHostname :
ServerIp :
ServerHostname : MBX01
SourceContext : ExplicitlyDiscarded
ConnectorId :
Source : SMTP
EventId : HADISCARD
InternalMessageId : 8907762172963
MessageId : <[email protected]>
Recipients : {[email protected]}
RecipientStatus : {}
TotalBytes : 17347
RecipientCount : 1
RelatedRecipientAddress :
Reference :
MessageSubject : Meeting Forward Notification: A subject
Sender : [email protected]
ReturnPath : [email protected]
Directionality : Originating
TenantId :
OriginalClientIp :
MessageInfo :
MessageLatency :
MessageLatencyType : None
EventData : {[DeliveryPriority, None], [PrioritizationReason, ShadowRedundancy]}
2. Yes, and other mails are routed to our Edge Transport Servers, and from there to Office 365 (Exchange Online Protection). It's only occurs when sending Meeting Forward Notifications, Accepting meetings, and so fourth - and it all comes from Outlook 2013
clients (RPC over HTTPS).