On one of my DAG enabled Exchange 2013 mailbox servers, I get this error in event viewer every five minutes:

Everything is working ok, but I'm concerning that I"m seeing this.  

ST

My "Microsoft Exchange Transport Log Search" service is crashing constantly and will not remain started.  

This is Exchange 2013 SP1 installed on Windows Server 2012 R2.

Application Event log reports:

I have change the logging directory path.  That did not help.  

I have renamed the "C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ActiveUsersStats\backups" folder and that did not help.  

I removed all files from the "C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ActiveUsersStats" folder.  No help.

I have restarted the transport service that did not help.

If anyone has any suggestions that would be great.

Russ

Hello,

We recently moved mailboxes (180 or so) from Exchange 2007 to Exchange 2013.  We are noticing that Outlook navigation seems to be very slow compared to the last server.  Changing folder views, switching from Inbox to Calendar, Deleting items, etc.  Also we used to be able to send 40MB HTML emails very quickly.  This now takes about 5 min just to open a reply. (These are tripwire reports.)  Most users are using Outlook in Online mode on the new server and were using Online mode on the old server

Environment: Exchange 2013 SP1 on Server 2012r2 Standard (6 cores 24 gigs of RAM, VMWare VM.)  Old server is Exchange 2007 8.3.348.2 on Server 2008x64 Standard SP2 (8 cores 12 gigs of RAM. Physical.)

I have a ticket open with MS but didn't really get anywhere after 9 hours yesterday.

Thanks.

Hello,

We have a multi domain parent child AD domain infrastructure and now we upgraded our exchange from Exchange 2007 to Exchange 2013. Since last few days, we see the below error on the mailbox server event viewer.

--------------------------------------------------------------------------------------------------------------------------------------

EVENT ID : 1121

The Microsoft Exchange Mailbox Replication service was unable to process a request due to an unexpected error. 
Request GUID: '93a7d1ca-68a1-4cd9-9edb-a4ce2f7bb4cd' 
Database GUID: '83d028ec-439d-4904-a0e4-1d3bc0f58809' 
Error: An Active Directory Constraint Violation error occurred on <domain controller FQDN>. Additional information: The name reference is invalid. 
This may be caused by replication latency between Active Directory domain controllers. 
Active directory response: 000020B5: AtrErr: DSID-0315286E, #1:

---------------------------------------------------------------------------------------------------------------------------------------------

Our Exchange setup is in parent domain, but we keep on getting this error for various domain controllers in each child domain in the same site. We then configured one of the parent domain domain controller on Exchange. Still we are getting this error for the configured parent domain DC.

Verified the AD replication and there is no latency or pending stuffs.

Any support  to resolve this issue will be highly appreciated. Thank you in advance.

Regards,

Jnana R Dash

Anybody ever see this error before? I see it intermittently and it just started a few weeks ago, even though we have been on exchange 2013 for a few months now. No issues have been reported by users (no tickets or calls complaining of connection issues) Any help would be appreciated!

Description: Process Microsoft.Exchange.InfoWorker.Common.Delayed`1[System.String]: Unable to open connection for mailbox <user>SMTP:user@xxxx.com. Exception returned is: Microsoft.Exchange.Data.Storage.StorageTransientException: Cannot open mailbox /o=xxxxx/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=EXCH2013/cn=Microsoft System Attendant. ---> Microsoft.Mapi.MapiExceptionRpcServerTooBusy: MapiExceptionRpcServerTooBusy: Unable to make connection to the server. (hr=0x80004005, ec=2419) Diagnostic context:

Lid: 41841   StoreEc: 0x973    

    Lid: 51059 

    Lid: 62321   StoreEc: 0x973    

    Lid: 47987 

    Lid: 50033   StoreEc: 0x973    

    Lid: 50544   ClientVersion: 15.0.847.32

    Lid: 52080   StoreEc: 0x973    

    Lid: 51152 

    Lid: 52465   StoreEc: 0x973    

    Lid: 60065 

    Lid: 33777   StoreEc: 0x973    

    Lid: 59805 

    Lid: 52487   StoreEc: 0x973    

    Lid: 19778 

    Lid: 27970   StoreEc: 0x973    

    Lid: 17730 

    Lid: 25922   StoreEc: 0x973    

   at Microsoft.Mapi.MapiExceptionHelper.InternalThrowIfErrorOrWarning(String message, Int32 hresult, Boolean allowWarnings, Int32 ec, DiagnosticContext diagCtx, Exception innerException)

   at Microsoft.Mapi.MapiExceptionHelper.ThrowIfError(String message, Int32 hresult, IExInterface iUnknown, Exception innerException)

   at Microsoft.Mapi.ExRpcConnectionFactory.Create(ExRpcConnectionInfo connectionInfo)

   at Microsoft.Mapi.MapiStore.OpenMapiStore(String serverDn, String userDn, String mailboxDn, Guid guidMailbox, Guid guidMdb, String userName, String domainName, String password, String httpProxyServerName, ConnectFlag connectFlags, OpenStoreFlag storeFlags, CultureInfo cultureInfo, Boolean wantRedirect, String& correctServerDN, ClientIdentityInfo clientIdentity, Boolean unifiedLogon, String applicationId, Client xropClient, Boolean wantWebServices, Byte[] clientSessionInfo, TimeSpan connectionTimeout, TimeSpan callTimeout, Byte[] tenantHint)

   at Microsoft.Mapi.MapiStore.OpenMailbox(String serverDn, String userDn, Guid guidMailbox, Guid guidMdb, String userName, String domainName, String password, ConnectFlag connectFlags, OpenStoreFlag storeFlags, CultureInfo cultureInfo, WindowsIdentity windowsIdentity, String applicationId, Byte[] tenantPartitionHint, Boolean unifiedLogon)

   at Microsoft.Exchange.Data.Storage.MailboxSession.ForceOpen(MapiStore linkedStore, Boolean unifiedSession)

   --- End of inner exception stack trace ---

   at Microsoft.Exchange.Data.Storage.MailboxSession.ForceOpen(MapiStore linkedStore, Boolean unifiedSession)

   at Microsoft.Exchange.Data.Storage.MailboxSession.Initialize(MapiStore linkedStore, LogonType logonType, ExchangePrincipal owner, DelegateLogonUser delegateUser, Object identity, OpenMailboxSessionFlags flags, GenericIdentity auxiliaryIdentity, Boolean unifiedSession)

   at Microsoft.Exchange.Data.Storage.MailboxSession.<>c__DisplayClass1a.<CreateMailboxSession>b__18(MailboxSession mailboxSession)

   at Microsoft.Exchange.Data.Storage.MailboxSession.InternalCreateMailboxSession(LogonType logonType, ExchangePrincipal owner, DelegateLogonUser delegatedUser, CultureInfo cultureInfo, String clientInfoString, IBudget budget, Action`1 initializeMailboxSession, InitializeMailboxSessionFailure initializeMailboxSessionFailure, MailboxSessionSharableDataManager sharedDataManager)

   at Microsoft.Exchange.Data.Storage.MailboxSession.CreateMailboxSession(LogonType logonType, ExchangePrincipal owner, DelegateLogonUser delegateUser, Object identity, OpenMailboxSessionFlags flags, CultureInfo cultureInfo, String clientInfoString, PropertyDefinition[] mailboxProperties, IList`1 foldersToInit, GenericIdentity auxiliaryIdentity, IBudget budget, Boolean unifiedSession, MailboxSessionShar

Hi

After MS-Support recreated all our ECP Virtual Directories in another case we cannot force a retention policy.
MS-Support claims it has nothing to do with that even tho it worked before their ECP recreation.

When running the command "Start-ManagedFolderAssistant -Identity USER" you get a yellow Warning back:
"WARNING: The User 'USER' Archive mailbox is offline"

However the server is running, the user can access its Archive mailbox and on the normally scheduled job of running retention policys at night or when ever it happens seems to work. Because after a few days the Archive mailbox i getting old emails in it.

Anyone seen this or have any ideas of what could cause this?
MS-Support says nothing is wrong with the ECP directories.
We have 8 servers, 3 Mailboxes, 3 Archive Mailboxes and 2 CAS server.
Its an multi domain/site environment, with E2013 servers in the root domain, some E2007 servers in the root and child domains.

Best regards
Robban

北京老马

I'm running exchange 2013 and it seems to have problems with health mailboxes (monitoring mailboxes). I have 5 mailbox databases on this server, DB1, DB2, DB3, DB4 and DB5.

I know there are 2 health mailboxes per mailbox database.

The command `Get-Mailbox -monitoring | Get-MailBoxStatistics` shows that several of these have not been accessed since December, even though they are in mounted Databases and powershell shows they are healthy.

There is also 2 health mailboxes that are missing from the below output because I got warninings saying these mailboxes have not been logged into yet.

-----

[PS] C:\windows\system32> Get-Mailbox -monitoring | Get-MailBoxStatistics

DisplayName   : HealthMailbox98fb2dc7692341ad8a3325ea2b14bbcc
ItemCount     : 17426
LastLogonTime : 12/8/2012 3:28:04 PM
Database      :  DB1

DisplayName   : HealthMailboxe27d88df28ae4d53af620604a83aca4d
ItemCount     : 12386
LastLogonTime : 2/4/2013 3:29:46 PM
Database      : DB1

DisplayName   : HealthMailbox815f0ff077a342f7889a53ef38e40256
ItemCount     : 291
LastLogonTime : 12/8/2012 3:26:43 PM
Database      : DB3

DisplayName   : HealthMailboxbca2f3409f1d4ae99098f48b574fc36d
ItemCount     : 579
LastLogonTime : 12/8/2012 3:26:05 PM
Database      : DB2

DisplayName   : HealthMailbox2412e1a0e5d9415b8328f653b2e42efe
ItemCount     : 209
LastLogonTime : 2/3/2013 6:08:41 PM
Database      : DB3

DisplayName   : HealthMailbox594b739a129941e688eafee6bbdfece6
ItemCount     : 209
LastLogonTime : 2/3/2013 6:09:52 PM
Database      : DB2

DisplayName   : HealthMailboxc401cae2a70d4d659f5758908582406e
ItemCount     : 210
LastLogonTime : 2/4/2013 3:28:59 PM
Database      : DB4

DisplayName   : HealthMailbox4b81211d555c4accad1f61a98700382e
ItemCount     : 212
LastLogonTime : 2/3/2013 6:09:46 PM
Database      : DB5

Warning: The user hasn't logged onto mailbox `<AD Domain>/users/HealthMailbox2c62876ca1bb45849c0daf2ecee6d715`, so there is no data to return. After the user logs on, this warning will no longer appear.

Warning: The user hasn't logged onto mailbox `<AD Domain>/users/HealthMailbox4399c592609a464d95c993ecee46f671`, so there is no data to return. After the user logs on, this warning will no longer appear.

-----

I am also getting a lot of queued messages in the inboundproxy.com queue that have the subject line "Undelieverable: Inbound Proxy Probe". I dont know how to get these to stop. I just have to clean out the queue once a day to prevent it from getting to large.

The last thing I notice is that I get a lot of audit errors in the event log when the system is trying to login to these mailboxes. That might be what is causing the issue. Here is one of the messages:

-----

An account failed to log on.
Subject:
Security ID:SYSTEM
Account Name:<computer name here>$
Account Domain:<AD DOMAIN>
Logon ID:0x3E7

Logon Type:8
Account For Which Logon Failed:
Security ID:NULL SID
Account Name:HealthMailboxbca2f3409f1d4ae99098f48b574fc36d@<domain.tld>
Account Domain:

Failure Information:
Failure Reason:Unknown user name or bad password.
Status:0xC000006D
Sub Status:0xC0000064

Process Information:
Caller Process ID:0x1265c
Caller Process Name:C:\Windows\System32\inetsrv\w3wp.exe

Network Information:
Workstation Name:<computer name here>
Source Network Address:::1
Source Port:34602

Detailed Authentication Information:
Logon Process:Advapi  
Authentication Package:Negotiate
Transited Services:-
Package Name (NTLM only):-
Key Length:0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

-----

As you can see, the system can not login to to this health mailbox account. The one in my example one of the mailboxes that has not been logged into since december.

Is there anywhere to troubleshoot these? or possibly rebuild them? The is a huge lack of documentation on these mailboxes from microsoft, I  can not find any commands to interact with these other then 'get-mailbox -monitoring'

Okay so here is the scenario... An employee leaves a company, we want to remove their account on the server but we want to have some sort of backup to access his mail. (Preferably backed up to a PST). I would like to know the easiest way of handling this kind of situation. We have been using a powershell command but we cannot seem to get it to work on 64 Bit installs. 

We are looking for something that works on Exchange 2007 - 2010 

After installing Exchange Server 2013 Service Pack 1 I'm getting 6003 error in the event log:

MSExchangeHMHost: Exchange failed to create the log directory D:\MonitoringDiagnosticLogs\MSExchangeHMHost ...

I can't believe it but see for yourself: this "D:\..." path is HARDCODED to "\Program Files\Microsoft\Exchange Server\V15\Bin\Microsoft.Exchange.Monitoring.ActiveMonitoring.Local.Components.dll"  !!!

How could it be and how to deal with this error!?

Alexey Kuznetsov,
Relief Software
More than 80 free add-ins for Outlook

Hi,

Please advise if there is any best practice for the above issue?

Thanks 

srabon

Hi Friends.

Please help me to slove the given issue.

Recently I changed my ISP line and I got the new IP address also. So after changing all these things I found that some mail are not going outside to some particular domains. I am using exchange server 2010

Regards,

Jaison

I am getting Exchange errors repeatedly through out the day. Both are Event ID 1006 and come from MSExchangeDiagnostics.

Environment
Windows 2012 (not R2)
Exchange 2013 CU3
VMWare 5.1

C: drive has 38GB free (38% free)
D: drive has 1TB free (99% free)

I've posted the event log entries below. I know I can edit Microsoft.Exchange.Diagnostics.Service.exe.config to disable the alert, but that is not really a valid solution, just a work around. I'm posting this mainly because I want MS to be aware and to fix the problem, or at least explain what is causing this alert, i.e., what is the trigger threshold. But if anyone knows how to actually fix this please let me know.

Log Name:      Application
Source:        MSExchangeDiagnostics
Date:          12/9/2013 12:44:41 PM
Event ID:      1006
Task Category: Triggers
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      servername
Description:
The performance counter '\\servername\MSExchangeIS Store(DB4)\Logical To Physical Size Ratio' sustained a value of '0.00', for the '10' minute(s) interval starting at '12/9/2013 8:33:00 PM'. Additional information: None. Trigger Name:DatabaseLogicalPhysicalSizeRatioTrigger. Instance:db4
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeDiagnostics" />
    <EventID Qualifiers="49156">1006</EventID>
    <Level>2</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-12-09T20:44:41.000000000Z" />
    <EventRecordID>194500</EventRecordID>
    <Channel>Application</Channel>
    <Computer>servername</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\\servername\MSExchangeIS Store(DB4)\Logical To Physical Size Ratio</Data>
    <Data>0.00</Data>
    <Data>10</Data>
    <Data>12/9/2013 8:33:00 PM</Data>
    <Data>None</Data>
    <Data>DatabaseLogicalPhysicalSizeRatioTrigger</Data>
    <Data>db4</Data>
  </EventData>
</Event>

Log Name:      Application
Source:        MSExchangeDiagnostics
Date:          12/9/2013 12:44:41 PM
Event ID:      1006
Task Category: Triggers
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      servername
Description:
The performance counter '\\servername\LogicalDisk(C:)\Free Megabytes' sustained a value of '39,409.00', for the '15' minute(s) interval starting at '12/9/2013 8:26:00 PM'. Additional information: None. Trigger Name:DatabaseDriveSpaceTrigger. Instance:c:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeDiagnostics" />
    <EventID Qualifiers="49156">1006</EventID>
    <Level>2</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-12-09T20:44:41.000000000Z" />
    <EventRecordID>194499</EventRecordID>
    <Channel>Application</Channel>
    <Computer>servername</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\\servername\LogicalDisk(C:)\Free Megabytes</Data>
    <Data>39,409.00</Data>
    <Data>15</Data>
    <Data>12/9/2013 8:26:00 PM</Data>
    <Data>None</Data>
    <Data>DatabaseDriveSpaceTrigger</Data>
    <Data>c:</Data>
  </EventData>
</Event>

Log Name:      Application
Source:        MSExchangeDiagnostics
Date:          12/9/2013 12:44:41 PM
Event ID:      1006
Task Category: Triggers
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      servername
Description:
The performance counter '\\servername\LogicalDisk(HarddiskVolume1)\Free Megabytes' sustained a value of '108.00', for the '15' minute(s) interval starting at '12/9/2013 8:26:00 PM'. Additional information: None. Trigger Name:DatabaseDriveSpaceTrigger. Instance:harddiskvolume1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeDiagnostics" />
    <EventID Qualifiers="49156">1006</EventID>
    <Level>2</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-12-09T20:44:41.000000000Z" />
    <EventRecordID>194498</EventRecordID>
    <Channel>Application</Channel>
    <Computer>servername</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\\servername\LogicalDisk(HarddiskVolume1)\Free Megabytes</Data>
    <Data>108.00</Data>
    <Data>15</Data>
    <Data>12/9/2013 8:26:00 PM</Data>
    <Data>None</Data>
    <Data>DatabaseDriveSpaceTrigger</Data>
    <Data>harddiskvolume1</Data>
  </EventData>
</Event>

Ever since upgrading to Exchange Server 2013 CU2 I now constantly get these in the Event Viewer...

The performance counter '\\EXCHANGE\LogicalDisk(HarddiskVolume1)\Free Megabytes' sustained a value of '108.00', for the '15' minute(s) interval starting at '16/07/2013 12:07:00'. Additional information: None. Trigger Name:DatabaseDriveSpaceTrigger. Instance:harddiskvolume1

Anyone know how to fix this?

Hi there,

Our co is MNC so we have now two e-mail domains such as  user@a.com and user@kr.a.com.

However, Our head office in U.S intends to limit our Korean user only user@kr.a.com domain in near future.

I  would like to use the autoreply function when someone mail us via user@a.com domain.

the contents will be "user@a.com no longer availabe please use user@kr.a.com"

I am not very sure if it is possible.

Please advise.

Thanks in advance.

Hi Guys,

I have ran into quite an interesting problem - and it seems it appeared out of nowhere.
I have an Exchange 2007 server, where the autodiscover service stopped working. I'll try and post as much details as possible.

My internal and external URLs are different.

Browsing to the Autodiscover service on https://mydomain/autodiscover/autodiscover.xml returns the expected error 600 Invalid request.

In EMS the output for Test-OutlookWebServices is as follows:

However Outlook (editions from 2007 to 2013) are not happy apparently:

Output is as follows:

I use self-signed certificates, that has not changed or expired.
The local DNS has the _autodiscover SRV record set correctly.
Local Firewall is accepting traffic on port 80 and 443 between the CAS server and the local network.

If needed: I get "Operation Failed. An object cannot be found" when I try and download the OAB.

I am out of ideas and any help will be greatly appreciated.

Shaun

The issue started earlier today when in my production (three people on it) exchange 2013 i made a change to the default website while logged into ecp.

I pointed https://website/owa under OWA and https://website/owa under ECP.

I tried to remove and re- add the directories though exchange shell (locally) without any success. 

This is what i get when i try to log into https://website/owa

 https://website/owa/?bO=1 the tab just says loading

when i try 

https://website/ecp/  i get to the exchange admin center enter user name and password

then i get https://website/owa/auth.owa and its a blank page

the ssl wildcard certificate is in place.    

Any help is appreciated. 

Hi,

We have federation services enabled and organisation relationships setup - all which are working OK. But when a user tries to look at the free/busy information for a user in a remote organisation we get the following error in the application log:

4001 -