Hi,
We have 2 units of Exchange 2013 servers generating a lot of logon (Event ID: 4648, 4624), logoff (4634) and special logon (4672) by HealthMailbox in Security Log every second. It generates 1GB of Security Log daily.
I have done a lot of research online and know that it is "normal", many people see this in their Security Log. However, it is not feasible to save 365GB of Security Log in a year.
How can I disable this log or do you have better suggestion?
Hi!
After installing EX2013CU14 the database indexing if failed (all databases).
I tried all solution what i found:
Stop MSExchangeFastSearch and HostControllerService, remove index and start the service but doesn't work.
I tried also the ContentSubmitter group solution but doesn't work.
Get this error in event viewer:
Watson report about to be sent for process id: 28160, with parameters: E12IIS, c-RTL-AMD64, 15.00.1236.003, M.E.Search.Service, M.E.Data.Directory, M.E.D.D.ScopeSet.GetOrgWideDefaultScopeSet, System.ArgumentNullException, 301, 15.00.1236.000.After moving out mailboxes in databaseOld to another mailbox database (databaseNEW) how can I tell if everything is really out of the Old one?
When I defrag it, it was 680gigs now it's 160gig. (If it's truly defragged / compacted it should be way less that 160gb)
What could be taking up the space?
Room resources are on New, Public Folders are on new...so what the heck is left?? How can I tell?
Thank you..
Brett
Hi There,
I have a DC and an Exchange server both running Server 2012 standard. Both have all the updates installed and necessary Exchange 2013 pre requisites. No AV running on the network yet either.
The installation ran with no problems but I get the below error when I try and login to https://servername/ecp
Server Error in '/owa' Application.
--------------------------------------------------------------------------------
The user has insufficient access rights.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.DirectoryServices.Protocols.DirectoryOperationException: The user has insufficient access rights.
Source Error:
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
Stack Trace:
[DirectoryOperationException: The user has insufficient access rights.]
System.DirectoryServices.Protocols.LdapConnection.ConstructResponse(Int32 messageId, LdapOperation operation, ResultAll resultType, TimeSpan requestTimeOut, Boolean exceptionOnTimeOut) +1904
System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request, TimeSpan requestTimeout) +381
Microsoft.Exchange.Data.Directory.PooledLdapConnection.SendRequest(DirectoryRequest request, LdapOperation ldapOperation, Nullable`1 clientSideSearchTimeout) +9836289
Microsoft.Exchange.Data.Directory.ADDataSession.ExecuteModificationRequest(ADObject entry, DirectoryRequest request, ADObjectId originalId, Boolean emptyObjectSessionOnException, Boolean isSync) +1215
[ADOperationException: Active Directory operation failed on FA01.fa.local. This error is not retriable. Additional information: Insufficient access rights to perform the operation.
Active directory response: 00002098: SecErr: DSID-03150BC1, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
]
Microsoft.Exchange.Data.Directory.ADDataSession.AnalyzeDirectoryError(PooledLdapConnection connection, DirectoryRequest request, DirectoryException de, Int32 totalRetries, Int32 retriesOnServer) +3682
Microsoft.Exchange.Data.Directory.ADDataSession.ExecuteModificationRequest(ADObject entry, DirectoryRequest request, ADObjectId originalId, Boolean emptyObjectSessionOnException, Boolean isSync) +1978
Microsoft.Exchange.Data.Directory.ADDataSession.ExecuteModificationRequest(ADObject entry, DirectoryRequest request, ADObjectId originalId, Boolean emptyObjectSessionOnException) +27
Microsoft.Exchange.Data.Directory.ADDataSession.Save(ADObject instanceToSave, IEnumerable`1 properties, Boolean bypassValidation) +2068
Microsoft.Exchange.Data.Directory.Recipient.ADRecipientObjectSession.Save(ADRecipient instanceToSave) +98
Microsoft.Exchange.Data.Storage.ExchangePrincipal.Save() +1078
[StoragePermanentException: There was a problem accessing Active Directory. Check your network connections and try again.]
Microsoft.Exchange.Data.Storage.ExchangePrincipal.Save() +1600
Microsoft.Exchange.Clients.Owa2.Server.Core.RequestDispatcher.HandleLanguagePost(RequestContext requestContext, CultureInfo culture, String timeZoneKeyName, Boolean isOptimized, String destination) +2072
Microsoft.Exchange.Clients.Owa2.Server.Core.RequestDispatcher.DispatchIfLanguagePost(RequestContext requestContext) +642
Microsoft.Exchange.Clients.Owa2.Server.Core.RequestDispatcher.InternalDispatchRequest(RequestContext requestContext) +620
Microsoft.Exchange.Clients.Owa2.Server.Core.RequestDispatcher.DispatchRequest(RequestContext requestContext) +297
Microsoft.Exchange.Clients.Owa2.Server.Core.OwaRequestHandler.OnPostAuthorizeRequest(Object sender, EventArgs e) +352
System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +80
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +165
--------------------------------------------------------------------------------
Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.18033
I get lots of warnings 1035 MSExchangeFrontEndTransport, SmtpReceive. Receiving mail is no problem. Details:
Inbound authentication failed with error LogonDenied for Receive connector Client Frontend ITSPECSRV. The authentication mechanism is Login. The source IP address of the client who tried to authenticate to Microsoft Exchange is [::1].
Leo
Hi, I'm new to managing our company's Office 365 licenses. An employee has left and I'm in the process of managing his data. I've found a great page that takes me step-by-step through the things I need to sort out.
Before I remove his license - see quote below - I'd like to understand what data will be lost after 30 days (his files are already saved elsewhere). I can't find any definitive info on these data.
"Caution: When a user’s license is removed, all data that is associated with that user account is held for 30 days. After the 30 day grace period, the data is deleted and can’t be recovered, except for documents that are saved on SharePoint Online."
Many thanks,
Lesley
hi all
i have a big problem
please give me advice
all of my files ( doc , xls , jpg , etc ) converted to *.9c96
and it isnot work now
what can i do ?
Hello,
Currently I am try to understand the quota message in Exchange server 2013. Currently our exchange server is in CU12. I can't find any official document. The only reference document I can find is for 2010 version:
https://technet.microsoft.com/en-us/library/bb232173(v=exchg.141).aspx
After searching in the forum, it seems the behavior change in post-2010 version.
My question is when does the quota warning message will be generated? Are there different notifications for issue warning quota and prohibit send quota? How the flag is cleared in exchange 2013?
Base on this document, in Exchange 2010 sp1 version:
In addition, the flag is cleared after you run the Set-MailboxDatabase cmdlet with the QuotaNotificationSchedule parameter. When you run that command, the mailbox won’t be checked again until the flag is reset. Flags are reset when a message is saved in the mailbox or when a message is sent to or from the mailbox.At that point if the mailbox size is greater than 50% of the Prohibit send quota, the flag is reset and the mailbox is checked at the time specified by the QuotaNotificationSchedule parameter.
but QuotaNotificationSchedule have been deprecated in Exchange 2013. If user doesn't reduces email quota, will he/she receives notification again?
Thank you for your help.
Hi
I try to get log of mailbox: Search-MailboxAuditLog test
- no result. "Recoverable Items" folder of this mailbox is too empty.
Before i do this: Set-Mailbox test -AuditEnabled $true (other leave default)
What else i need to do/check?
Thanks.
Hi all,
is it normal that all RPC connections to our NLB servers are to a single server of the 2 that we have?
We have 2 MBX servers (DAG) and 2 CAS servers (NLB). Version on 2013 CU12.
Some days ago whitespace of a database started decrease quite fast. Until this time whitespace was 80GB, now this is only megabytes.
Amount of transaction logs is also bigger, than other databases.
And disk free space also decreasing. When I do backup, transaction logs are deleted, but database still growing.
I moved some bigger mailboxes to another database. But this problematic database still shows moved mailboxes, although ecp shows new location of moved mailbox.
Result on Get-MailboxStatistics against "old" database shows moved mailbox also.
If it is related with problem of database growning at all...
I made couple of times Get-MailboxStatistics to compare, is there any mailbox started to grow fast, but I did'nt notice.
What minght be best method to know, what is going on?
ExMon shows something, but there is difficult to understand usernames - just numbers and characters, what doesnt remind any AD object.
I already made a backup plan, to move all mailboxes to another databases, delete this database and recreate another...
Hi, there,
My exchange server was working perfectly before. But, there is not enough disk space on exchange server. I followed the guide which was posted on "https://social.technet.microsoft.com/wiki/contents/articles/31117.exchange-2013-logging-clear-out-the-log-files.aspx".
Yeah, indeed, the disk space has been free up. However, user can send out the emails but not able receive emails at more. Can you direct me to the correct root please?
All my domain users cannot receive emails any more.
Thanks in advance and look forward to hearing from your answer.
Regards,
Jinping
Hello all - We recently upgraded our Exchange environment to CU13. We noticed now that when a user creates a distribution group via ECP..the "Select an organizational unit" is blank. This was working prior to the CU13 upgrade. The windows says "There are more results available than are currently displayed. There are no items to show in this view."
I attempted to adjust the web.config file to display more results, but that did not do anything either. Screen shot is attached...please let me know if anyone has any ideas
Our environment includes two on-prem Exchange 2013 servers that are members of the same DAG, running Version 15.0 (Build 1156.6).
I'm running into a problem in the Exchange Control Panel when I go to configure Federation Trust. Under 'Organization' > 'Sharing' > and under the 'Federation Trust' Header, there's a 'modify' button. When I click the button, a new browser page opens with a '500 Unexpected Error' message.
In the 'Application' event log on our Exchange Servers I'm seeing the following error being generated after the 500 error is thrown:
Flight info: Features:[[Global.DistributedKeyManagement, False],[Global.GlobalCriminalCompliance, False],[Global.MultiTenancy, False],[Global.WindowsLiveID, False],[Eac.AllowMailboxArchiveOnlyMigration, True],[Eac.AllowRemoteOnboardingMovesOnly, False],[Eac.BulkPermissionAddRemove, True],[Eac.CmdletLogging, True],[Eac.CrossPremiseMigration, False],[Eac.DevicePolicyMgmtUI, False],[Eac.DiscoveryDocIdHint, False],[Eac.DiscoveryPFSearch, False],[Eac.DiscoverySearchStats, False],[Eac.DlpFingerprint, False],[Eac.EACClientAccessRulesEnabled, False],[Eac.GeminiShell, False],[Eac.ManageMailboxAuditing, False],[Eac.ModernGroups, False],[Eac.Office365DIcon, False],[Eac.OrgIdADSeverSettings, False],[Eac.RemoteDomain, False],[Eac.UCCAuditReports, False],[Eac.UCCPermissions, False],[Eac.UnifiedAuditPolicy, False],[Eac.UnifiedComplianceCenter, False],[Eac.UnifiedPolicy, False],[Eac.UnlistedServices, False],], Flights:[], Constraints:[[LOC, EN-US],[MACHINE, exchangeserver],[MODE, ENTERPRISE],[PROCESS, W3WP],[USER, username@],[USERTYPE, BUSINESS],], IsGlobalSnapshot: False
Any help would be appreciated.
how to block all attachments types in exchange 2013 for senders who are a member of a security group using a transport rule.
In our environment we have two exchange servers. Have group ID's. Recently have created a ID which have all group ID's as a member. Now the issue is people those who are in multiple groups getting multiple copies of same mail if we send mail to that newly created group ID which has many group ID's.
How to stop the multiple duplicate mail copies receiving to clients?
I would like to find out if it is possible to go straight from exchange 2013 cu 8/9 to exchange 2013 cu 14 or there are intermediate steps that should be followed?
Also what procedure should be followed for the upgrade.
We have 2 CAS servers behind a load balancer.
And 2 mailbox servers in a DAG.
Should I be upgrading 1 server, reboot that server and go to next server and so on
OR
Specific procedure should be followed?
And what backups to take before the upgrade.
And what will be the restore procedure ?
Should I keep 1 Domain Controller shutdown during the upgrade and that way in case of issues just restore the exchange servers from backup and power on this DC(and shutdown others)?