We have 2 Exchange 2013 servers that are VMs. I am in need to search mailboxes for some legal matters. I get

High Everyone,

We recently migrated from Exchange 2007 to Exchange 2013. Around 9:00 every morning, we are seeing CPU utilization go to 100% for between 2 and 10 minutes. We monitor processes during this time and it is parserserver.exe that is the culprit. We see an instance for the 4 DB's that reside on each server. The rest of the day the servers run normally between 30-50% CPU utilization. During this time when the CPU's are pegged, we have some client connectivity issues.

We are running Exchange 2013 SP1 with CU7

We have provided Perfmon information to Microsoft but wondered if anyone else has run into this?

Hi guys Im having a problem using eDiscovery the search results shows, details below i hope you can help me on this

Status: Search Failed

"ExceptionHandler_Execute=Microsoft.Exchange.Data.Storage.StorageTransientException: Cannot open mailbox /o exchange/ou exchange administrative group (fydibohf23spdlt)/cn recipients/cn 36b3a4113b5f46478724738a0488c3f6-tecex303. ---> Microsoft.Mapi.MapiExceptionTimeout: MapiExceptionTimeout: Unable to open message store. (hr 0x80040401  ec -2147220479)
Diagnostic context:
    Lid: 55847   EMSMDBPOOL.EcPoolSessionDoRpc called [length 511]
    Lid: 43559   EMSMDBPOOL.EcPoolSessionDoRpc returned [ec 0x0][length 248][latency 0]
    Lid: 52176   ClientVersion: 15.0.995.32
    Lid: 50032   ServerVersion: 15.0.995.6032
    Lid: 23226   --- ROP Parse Start ---
    Lid: 27962   ROP: ropLogon [254]
    Lid: 17082   ROP Error: 0x80040401
    Lid: 26937  
    Lid: 21921   StoreEc: 0x80040401
    Lid: 27962   ROP: ropExtendedError [250]
    Lid: 1494    ---- Remote Context Beg ----
    Lid: 53152   dwParam: 0xA
    Lid: 35440   StoreEc: 0x80040401
    Lid: 57721   StoreEc: 0x80040401
    Lid: 61692   StoreEc: 0x80040401
    Lid: 54056   StoreEc: 0x80040401
    Lid: 56872   dwParam: 0xFE
    Lid: 42712   StoreEc: 0x80040401
    Lid: 10786   dwParam: 0x0        Msg: 15.00.0995.032:CHRP5100
    Lid: 1750    ---- Remote Context End ----
    Lid: 26849  
    Lid: 21817   ROP Failure: 0x80040401
    Lid: 26297  
    Lid: 16585   StoreEc: 0x80040401
    Lid: 32441  
    Lid: 1706    StoreEc: 0x80040401
    Lid: 24761  
    Lid: 20665   StoreEc: 0x80040401
    Lid: 25785  
    Lid: 29881   StoreEc: 0x80040401    at Microsoft.Mapi.MapiExceptionHelper.InternalThrowIfErrorOrWarning(String message  Int32 hresult  Boolean allowWarnings  Int32 ec  DiagnosticContext diagCtx  Exception innerException)    at Microsoft.Mapi.ExRpcConnection.OpenMsgStore(OpenStoreFlag storeFlags  String mailboxDn  Guid mailboxGuid  Guid mdbGuid  String& correctServerDn  ClientIdentityInfo clientIdentityAs  String userDnAs Boolean unifiedLogon  String applicationId  Byte[] tenantHint  CultureInfo cultureInfo)    at Microsoft.Mapi.MapiStore.OpenMapiStore(String serverDn  String userDn  String mailboxDn  Guid guidMailbox  Guid guidMdb  String userName  String domainName  String password  String httpProxyServerName  ConnectFlag connectFlags  OpenStoreFlag storeFlags  CultureInfo cultureInfo  Boolean wantRedirect  String& correctServerDN ClientIdentityInfo clientIdentity  Boolean unifiedLogon  String applicationId  Client xropClient  Boolean wantWebServices  Byte[] clientSessionInfo  TimeSpan connectionTimeout  TimeSpan callTimeout  Byte[] tenantHint)   at Microsoft.Mapi.MapiStore.OpenMailbox(String serverDn  String userDn  Guid guidMailbox  Guid guidMdb  String userName  String domainName  String password  ConnectFlag connectFlags  OpenStoreFlag storeFlags CultureInfo cultureInfo  ClientIdentityInfo clientIdentity  String applicationId  Byte[] tenantPartitionHint  Boolean unifiedLogon)    at Microsoft.Exchange.Data.Storage.MailboxSession.ForceOpen(MapiStore linkedStore  Boolean unifiedSession)    --- End of inner exception stack trace ---    at"

Kindly help.

Thanks & regards,

Amit Jha

Hey guys,

May I ask you one question regarding mailbox auditing, we need to have to functionality to log if a user did read an email or not - since yesterday we are running exchange 2013 cu14.

Regarding on several other post I found that "MessageBind" for the Owner should do this, also the description on technet would match our need.

An item is accessed in the reading pane or opened.

So I enabled auditlog for some users with the following configuration:

AuditEnabled     : True
AuditLogAgeLimit : 90.00:00:00
AuditAdmin       : {Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create}
AuditDelegate    : {Update, SoftDelete, HardDelete, SendAs, Create}
AuditOwner       : {MessageBind}

What is strange now, as soon as an email arrives in the mailbox an "MessageBind" event is logged, then when the email is read an other "MessageBind" event is logged:

Mail received

RunspaceId                    : 96a8f3c2-8041-406a-a2ff-1431d53a7ec9
Operation                     : MessageBind
OperationResult               : Succeeded
LogonType                     : Owner
ExternalAccess                : False
DestFolderId                  :
DestFolderPathName            :
FolderId                      : LgAAAACICyK1BpkzRLsYeoQPy6aDAQCdZ6+kh3akSpRHWZvRS5gbADufp63vAAAB
FolderPathName                : \Posteingang
ClientInfoString              : Client=ActiveSync;User=Firstname.Lastname@Company.ch
ClientIPAddress               : ::1
ClientMachineName             :
ClientProcessName             :
ClientVersion                 :
InternalLogonType             : Owner
MailboxOwnerUPN               : Firstname.Lastname@Company.ch
MailboxOwnerSid               : S-1-5-21-1938582166-862939105-1542849698-30254
DestMailboxOwnerUPN           :
DestMailboxOwnerSid           :
DestMailboxGuid               :
CrossMailboxOperation         :
LogonUserDisplayName          : Lastname Firstname
LogonUserSid                  : S-1-5-21-1938582166-862939105-1542849698-30254
SourceItems                   : {}
SourceFolders                 : {}
SourceItemIdsList             :
SourceItemSubjectsList        :
SourceItemFolderPathNamesList :
SourceFolderIdsList           :
SourceFolderPathNamesList     :
ItemId                        : RgAAAACICyK1BpkzRLsYeoQPy6aDBwCdZ6+kh3akSpRHWZvRS5gbADufp63vAAA9DLSsFG6HS6l+05Ohyp1HAAJ
                                2/Fj3AAAJ
ItemSubject                   : 1106
DirtyProperties               :
OriginatingServer             : SERVERNAME (15.00.1236.000)
MailboxGuid                   : 2addd0de-880a-4436-b229-a154c690f6f2
MailboxResolvedOwnerName      : Lastname Firstname
LastAccessed                  : 01.11.2016 11:06:36
Identity                      : AAMkADcxMDgwY2NjLWZiNmItNDMyOS1iZmMyLWUxNDljODgyNjZjNgBGAAAAAACICyK1BpkzRLsYeoQPy6aDBwA
                                9DLSsFG6HS6l+05Ohyp1HAAHvGhoZAAA9DLSsFG6HS6l+05Ohyp1HAAJ2/GT5AAA=
IsValid                       : True
ObjectState                   : New

Mail read

RunspaceId                    : 96a8f3c2-8041-406a-a2ff-1431d53a7ec9
Operation                     : MessageBind
OperationResult               : Succeeded
LogonType                     : Owner
ExternalAccess                : False
DestFolderId                  :
DestFolderPathName            :
FolderId                      : LgAAAACICyK1BpkzRLsYeoQPy6aDAQCdZ6+kh3akSpRHWZvRS5gbADufp63vAAAB
FolderPathName                : \Posteingang
ClientInfoString              : Client=ActiveSync;User=Firstname.Lastname@Company.ch
ClientIPAddress               : ::1
ClientMachineName             :
ClientProcessName             :
ClientVersion                 :
InternalLogonType             : Owner
MailboxOwnerUPN               : Firstname.Lastname@Company.ch
MailboxOwnerSid               : S-1-5-21-1938582166-862939105-1542849698-30254
DestMailboxOwnerUPN           :
DestMailboxOwnerSid           :
DestMailboxGuid               :
CrossMailboxOperation         :
LogonUserDisplayName          : Lastname Firstname
LogonUserSid                  : S-1-5-21-1938582166-862939105-1542849698-30254
SourceItems                   : {}
SourceFolders                 : {}
SourceItemIdsList             :
SourceItemSubjectsList        :
SourceItemFolderPathNamesList :
SourceFolderIdsList           :
SourceFolderPathNamesList     :
ItemId                        : RgAAAACICyK1BpkzRLsYeoQPy6aDBwCdZ6+kh3akSpRHWZvRS5gbADufp63vAAA9DLSsFG6HS6l+05Ohyp1HAAJ
                                2/Fj3AAAJ
ItemSubject                   : 1106
DirtyProperties               :
OriginatingServer             : SERVERNAME (15.00.1236.000)
MailboxGuid                   : 2addd0de-880a-4436-b229-a154c690f6f2
MailboxResolvedOwnerName      : Lastname Firstname
LastAccessed                  : 01.11.2016 11:08:37
Identity                      : AAMkADcxMDgwY2NjLWZiNmItNDMyOS1iZmMyLWUxNDljODgyNjZjNgBGAAAAAACICyK1BpkzRLsYeoQPy6aDBwA
                                9DLSsFG6HS6l+05Ohyp1HAAHvGhoZAAA9DLSsFG6HS6l+05Ohyp1HAAJ2/GT6AAA=
IsValid                       : True
ObjectState                   : New

So my question: Why is a "MessageBind" event logged when the mail received? Is there something wrong in my environment? How can I now tell if the mail was read or not?

Thanks a lot for your assitance.

Hello,

I have a new Exchange 2013 server. There is a folder "c:\program files\microsoft\exchange server\v15\bin\search\ceres\diagnostics\etltraces" that seems to churn DocumentProcessingTrace_???.etl files constantly (where ??? is an incrementing number). There are always exactly 100 files that rotate (oldest deleted) and each file is about 52MB. At least 4 per hour, sometimes more.

My issue is that these take up a bunch of space on the OS disk, and it does a lot of data writes which fragment the filesystem and create a lot of change blocks for my backup system.

What is creating these files and what are they for? More importantly, can I disable or change its location?

Thanks.

Hi All,

i have any question, how to hidden meeting room when booked / cannot make a meeting schedule with occupied meeting room? it's possible or not ?

Thanks and Regards,

Rizal Syahputra

I have an exchange server that has a couple of issues. 

1-some of the meeting requests arrive days or weeks late. This is happening both internally and externally.

2-When a meeting is canceled a couple of days later the invitees for the said meeting will get an invitation to the same event even though it has been canceled.

I read online that this could be related to the calander becoming corrupted or out of sync. What do I need to do to fix this?

Usually if a user A delegates user B on his mailbox, when user B reads messages inside user A mailbox the message is marked as read for both users.

Is it possible in some way to configure exchange server to retain unread marking on a "per user" base? So when user B reads an email it's still unread for user A and he knows that has to read that message?

Hi, all! Environment is single-forest domain, Server 2k8 effective level, Exchange 2013 multi-site DAG on Server 2012 R2.  Getting several NULL SID auth errors (Event ID 4625, Status 0xC000006D, sub status 0x80090325).  This is not a cached credential issue, and not related to any scheduled tasks.    Renaming either of these servers and/or removing them from the domain and rejoining them is not an option.  The errors occur several times a minute, every minute, and have been occurring for as long as I can remember.

I've read multiple threads on various boards, and unfortunately none of them touch on any core issues of my problem.  I'm looking for suggestions for trying to track down this (I'm assuming) SSL related authentication issue.  Unless this is a documented bug, I'm sorry but I can't accept "just ignore it"; the Security server logs are effectively useless with this level of events occurring.

Thanks!

Steve

Event details (relevant info posted)----------------

Hello Folks,

Need yoursuggestion to troubleshoot subjected issue. 

Current Environment: Exchange server 2007 SP2  (2 Mailbox server deployed in SCC cluster, 2 HUB and 2 CAS in NLB). Symantec Mail security is also installed and configured.  

Issue: Store.exe utilizing high CPU (around 80% to 90%). High utilization is not continuous but it is happening very frequently. e.g. every 20 min.

We are checking event logs but we didn't find any clue. We are monitoring store.exe utilization through process explore. Also i have used perfmon to monitor RPC request and RPC Operation/Sec. screenshot is attached. 

Please suggest another troubleshooting options. 

   

Thanks, Chinmay.

Hi everybody,

it is hard to categorize which part of the forum is the correct one because the problem stretches to multiple problems.

Since I migrated from Exchange 2010 SP3 to Exchange 2013 SP1 I have problem with the name resolution as I believe it should work. (BTW: we are using AD 2012 R2)

When I am trying to search for an user in the addressbook in outlook (2013 and 2016) with the samaccountname I can't find the user (using GAL so no offline address book). I actually can only find the user while using his last name (surname does not work either)

When I am writing an E-Mail via ActiveSync or OWA-Client and I try using the samaccountname in from,cc,bcc it does not work either. I am not sure about the GAL but I am very certain (as are my co-workers) this was possible before the migration.
(However it works with e-mail/name -> using "Mark" in OWA or ActiveSync I will get every user who has that in his name/email (Mark, Markus, Marketing, etc.)

When I am writing an E-Mail with Outlook and I am using samaccountname in from,cc,bcc it wont recognize the user while searching for it for the very first time. If I type in every samaccountname I want (seperated with an ; of course) and I use the "check name"-button it works.

But with an exception that I dont think is right. For example: if I have an samaccountname "mark" and I am using that in outlook with the name resolution -> I have to choose between every single user that has "mark" somewhere in his name (e.g. everybody called Mark or Markus)

However: if I type in =Mark he will find the exact user after using the "name resolution"-button

So I started googling where this problem could come from and I stumbled upon ambiguous name resolution (ANR).

I found an old article (2004 - hell): https://blogs.technet.microsoft.com/exchange/2004/08/23/why-we-named-a-bit-in-the-directory-after-billg/

After reading that I checked via ADSI-Editor if the mentioned dSHeuristics-Attribut inCN=Directory Service,CN=Windows NT,CN=Services,CN=Configurationwas set with the value 1 or 1000.

But the value is not set and according to this article this should turn off ANR.
Besides that I really dont understand the mentioned 4th character - maybe here are some changes since server 2003. I can only set dSHeuristics in the properties of the CN=directory-service (maybe I am missing something)

My problem is now that I do not know if this could essentially be the problem or if this feature was somehow replaced or is configured somewhere else in the AD (since between 2004 and 2016 (2012 R2 AD) could change a lot)

And if this is the right place -> is it really deactivated, could this be my problem and is the number 1000 still the right one or did this change?

I would really appreciate any help to solve this since my colleagues really wanna use the samaccountname to search via activesync on their smartphone instead of typing the IP-Address - same for OWA and Outlook.

Ask away if anything is unclear.

Exchange server 2016 binary Dive( installation Drive )Grows Rapidly .After Analysis found that a lot of logs creating on daily basis in binary drive and they are not getting purge by windows backup tool .

(<Install Drive>\Microsoft\Exchange Server\V15\Logging) .

vivek singh

Hi,

I have a problem where Event ID 3028 Source MSExchangeApplicationLogic is beeing logged every 6 hours with 4 same type of events. Here is the log:

Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.995.29\ext\killbit\killbit.xml' because it is being used by another process.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
   at System.IO.File.Open(String path, FileMode mode, FileAccess access, FileShare share)
   at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

The environment is single virtual MS Exchange 2013 server running on Windows 2012 R2. DC is running on a separate server.

I can't seem to find any articles or blogs relating to this issue.

Thanks for any help.

Hello,

I would like to have a way to manually exclude Exchange 2013 servers from the L7 load balancers like BigIP and NetScaler.

The idea is to have the load balancer monitor a file in a virtual directory and if that file exists, take the server out of the load balancing groups. Just like the standard monitor urls, /owa/healthcheck.htm for example.

The problem is that all paths are redirected to owa or have authentication enabled.

Where can I put the file in order to be able to access it directly? Can I exclude a path using the web.config files?

Regards,

Christos

Hi,

Mailboxes keep getting quarantined and I can't find the reason. We have Exchange 2013 Version 15.0 ‎(Build 1236.3)‎. Mailboxes were migrated from Exchange 2007. Everything is finished and old Exchange removed. 

I got event logs: Event 1006

Can you please help me find the reason and address the problem.

Thank you,

Hello Everybody

I have a issue in regards to my email routing. I have following secnario

--Two Domain Controller

--Exchange migration performed from 2007 to 2010, migrated all mailboxes, public database. All mailbox is using newly created database on exchange 2010.

My issue is that i was trying to do decommission exchange 2007 and the moment i stopped send and receive connector on exchange 2007, i am not able to see any email flow inside and outside. I created a Send and Receive connector on Exchange 2010. 

Please help me how can i resolve this issue. I want to get rid of legacy exchange 2007.

Thanks for your help in Advance!!

Amar

Amar

Hello,

I am getting this message whenever I open my Outlook. Please advise. 





Thank You!