Exchange 2013,2010 – Event log analysis (Health Check part 1.)

I have created a database of common event log Errors and Warning generated on Exchange servers. Here is the list of Event IDs, description and its solution:

EventID EntryType Source Message Action
4 Error MSExchange Control Panel Current user: ‘<USER>’–Request for URL ‘<URL> failed with the following error:<ERROR> No action needed if not frequent.
6 Error MSExchange CmdletLogs Cmdlet failed. Cmdlet <CMDlet>, <Parameters>. No action needed
50 Error Microsoft-Windows-Time-Service The time service detected a time difference of greater than 5000 milliseconds for 900 seconds. The time difference might be caused by synchronization with low-accuracy time sources or by suboptimal network conditions. The time service is no longer synchronized and cannot provide the time to other clients or update the system clock. When a valid time stamp is received from a time service provider, the time service will correct itself. Register correct time source and check if it is correctly synchronized
63 Warning Microsoft-Windows-WMI A provider, PolicyAgentInstanceProvider, has been registered in the Windows Management Instrumentation namespace <NAMESPACE> to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. No action needed if not frequent
74 Warning MSExchange RBAC (Process w3wp.exe, <PID>) <user ID> in Microsoft.Exchange.Configuration.Authorization.WSManBudgetManager class. Leaked Value 1. test DataProtection Health Set http://technet.microsoft.com/en-us/library/ms.exch.scom.dataprotection(v=exchg.150).aspx
106 Error MSExchange Common Performance counter updating error. Counter name is Time in Resource per second, category name is <Category name>. Optional code: <number>. Exception: The exception thrown is : <Exception text>. This is common error, which can be handled by re-registering performance counters (use http://support.microsoft.com/kb/2870416)
111 Error AD FS The Federation Service encountered an error while processing the WS-Trust request <description> Chceck Technet articles based on exception (usually wrong username / password or wrong account)
118 Error ExchangeStoreDB At <Time> the copy of database ‘<MDB GUID>’ on this server appears to be experiencing performance issues, possibly as a result of storage failure. Consult the event log on the server for other storage and “ExchangeStoreDb” events for more specific information about the failure. Recovery was not attempted. check Technet for right solution – https://technet.microsoft.com/en-us/library/hh361352(v=exchg.140).aspx
129 Warning Microsoft-Windows-Time-Service NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: The entry is not found. Check NTP environment health
131 Warning Microsoft-Windows-Time-Service NtpClient was unable to set a domain peer to use as a time source because of DNS resolution error on ‘<DNS name of NTP>’. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. Check DNS resolution for NTP client/Server
139 Error ExchangeStoreDB At <Time> the copy of database ‘<MDB GUID>’ on this server appears to be experiencing performance issues, possibly as a result of storage failure. Consult the event log on the server for other storage and “ExchangeStoreDb” events for more specific information about the failure. Recovery was not attempted. check Technet for solution – https://social.technet.microsoft.com/Forums/en-US/878c4557-81ca-4aab-94f4-9fac30d4bb71/false-database-performance-alerts?forum=exchangesvradminlegacy
139 Error ExchangeStoreDB At <time> the copy of database ‘<MDB name>’ on this server appears to be experiencing performance issues, possibly as a result of storage failure. Consult the event log on the server for other storage and “ExchangeStoreDb” events for more specific information about the failure. Recovery was not attempted Reset search index catalog for affected MDB (https://social.technet.microsoft.com/Forums/en-US/878c4557-81ca-4aab-94f4-9fac30d4bb71/false-database-performance-alerts?forum=exchangesvradminlegacy)
143 Error MSExchange OWA RMS templates for the organization couldn’t be loaded due to Microsoft.Exchange.Security.RightsManagement.RightsManagementException:<exception, URL of RMS> check connectivity to RMS server from inside and outside of the organization
245 Error ESE Information Store – <MDB ID>: The internal database copy (for seeding or analysis purposes) has been stopped because it was halted by the client or because the connection with the client failed.——For more information, click http://www.microsoft.com/contentredirect.asp. check seeding failures on affected servers and ints connection to backup software
342 Error AD FS Token validation failed no action needed – wrong user credentials
364 Error AD FS Encountered error during federation passive request. <Exception> Check TEchnet articles based on exception (usually wrong username / password)
401 Error MSExchange Common The organization certificate named <ThumbPrint> in the Federation Trust object <TRUST OBJECT> cannot be found in the computer’s certificate store. Please review the Federation Trust properties and the certificates present in the certificate store of the server. Check servers for federation certificate. Import certificate if not present
415 Warning AD FS The SSL certificate does not contain all UPN suffix values that exist in the enterprise. Users with UPN suffix values not represented in the certificate will not be able to Workplace-Join their devices. For more information, see http://go.microsoft.com/fwlink/?LinkId=311954. create ALIASES for your ADFS server farm. – https://technet.microsoft.com/library/dn614658.aspx
489 Error ESE msexchangerepl <PID> Log Verifier <LOG BASE NAME>: An attempt to open the file “<LOG FILE>” for read only access failed with system error <ERROR ID>: “The process cannot access the file because it is being used by another process. “.   The open file operation will fail with error <ERROR> check log file accessibility and file lock and its connection to antivirus and backup software
507 Warning ESE Information Store – <MDB and PID>: A request to read from the file “<EDB file>” at offset <offset> for <bytes> bytes succeeded, but took an abnormally long time (<Time Span>) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem. Disk timeouts might be caused by several problems, check storage performance and its connection to other servers utilization (especially in virtualized environment, perform stress test for underlying storage)
509 Warning ESE Information Store – <MDB and PID>: A request to read from the file “<EDB file>” at offset <offset> for <bytes> bytes succeeded, but took an abnormally long time (<Time Span>) to be serviced by the OS. In addition, <count> other I/O requests to this file have also taken an abnormally long time to be serviced since the last message regarding this problem was posted <time delay> seconds ago. This problem is likely due to faulty hardware. Disk timeouts might be caused by several problems, check storage performance and its connection to other servers utilization (especially in virtualized environment, perform stress test for underlying storage)
510 Warning ESE Information Store – <MDB and PID>: A request to read from the file “<EDB file>” at offset <offset> for <bytes> bytes succeeded, but took an abnormally long time (<Time Span>) to be serviced by the OS. Connected to 507,509. Disk timeouts might be caused by several problems, check storage performance and its connection to other servers utilization (especially in virtualized environment, perform stress test for underlying storage)
628 Warning ESE Information Store – <MDB and PID>: Database ‘<EDB file>’: While attempting to move to the next or–previous node in a B-Tree, the database engine skipped over <Number>–non-visible nodes in <Number> pages. It is likely that these non-visible–nodes are nodes which have been marked for deletion but which are–yet to be purged. The database may benefit from widening the online–maintenance window during off-peak hours in order to purge such nodes–and reclaim their space. If this message persists, offline–defragmentation may be run to remove all nodes which have been marked–for deletion but are yet to be purged from the database. check performance and space of MDB and log volume, check maintenance window size and icrease if needed
629 Warning ESE Information Store – <MDB and PID>: Database ‘<EDB file>’: While attempting to move to the next or–previous node in a B-Tree, the database engine skipped over <Number>–non-visible nodes in <Number> pages. It is likely that these non-visible–nodes are nodes which have been marked for deletion but which are–yet to be purged. The database may benefit from widening the online–maintenance window during off-peak hours in order to purge such nodes–and reclaim their space. If this message persists, offline–defragmentation may be run to remove all nodes which have been marked–for deletion but are yet to be purged from the database. check performance and space of MDB and log volume, check maintenance window size and icrease if needed
1000 Error Application Error Faulting application name<description> check faulting application and use Technet to find related article
1000 Warning AD FS An error occurred during processing of a token request. The data in this event may have the identity of the caller (application) that made this request. The data includes an Activity ID that you can cross-reference to error or warning events to help diagnose the problem that caused this error. check event logs for Correlation Activity ID event logs and check technet for solution
1006 Warning MSExchangeFastSearch The FastFeeder component received a connection exception from FAST. Error details: System.ServiceModel.FaultException`1[System.ServiceModel.ExceptionDetail]: check FAST search or recreate FAST from scratch https://social.technet.microsoft.com/Forums/office/en-US/9679decc-8707-4ace-80cf-5f57833e59c2/exchange-2013-content-index-status-unknown?forum=exchangesvrdeploy
1007 Error MSExchangeDiagnostics Failed to create or start performance logs with error: System.ArgumentException: <Exception> Check servers if event log is frequent
1008 Warning MSExchange ActiveSync An exception occurred and was handled by Exchange ActiveSync. This may have been caused by an outdated or corrupted Exchange ActiveSync device partnership. This can occur if a user tries to modify the same item from multiple computers. If this is the case, Exchange ActiveSync will re-create the partnership with the device. check CAS server configuration for max request length (http://blogs.technet.com/b/get-exchangehelp/archive/2013/06/10/event-id-1008-quot-maximum-request-length-exceeded-quot.aspx)
1009 Warning MSExchangeFASTSearch The indexing of mailbox database <DB GUID> encountered an unexpected exception. Error details: Microsoft.Exchange.Search.Core.Abstraction.OperationFailedException: The component operation has failed.
1009 Error MSExchangeHM Microsoft Exchange Health Manager worker process <PID> received restart request and will be stopped. Restart reason: <RASON> No action if not frequent
1010 Warning MSExchangeFASTSearch An operation attempted against a FAST endpoint exprienced an exception. This operation may be retried. Error details: Microsoft.Exchange.Search.Fast.PerformingFastOperationException: An Exception was received during a FAST operation. —> System.ServiceModel.CommunicationException check FAST service connection to database
1012 Error MSExchange Store Driver Submission The store driver failed to submit event <Event> mailbox <mailbox ID><MDB> couldn’t generate an NDR due to exception <Exception> No action needed. Usually caused by invalid sender
1012 Error MSExchangeDiagnostics Data loss occurred in RetentionAgent: RetentionAgent: Data loss occurred. The size of this folder <Diagnostic logging path> has reached the max size allowed -<SIZE>. Some files will be purged. Connected to warning 1013. Consider increasing logging quota or redrect once it is available. Nowadays no action possible but cleaning logs.
1013 Warning MSExchangeDiagnostics Potential data loss warning in RetentionAgent: RetentionAgent: Warning: Potential data loss. The size of this folder <Daily Perf logs path> has reached 95% of max size allowed – <SIZE>. Some data will be purged once it reaches the max limit. Connected to error 1012. Consider increasing logging quota or redrect once it is available. Nowadays no action possible but cleaning logs.
1014 Warning Microsoft-Windows-DNS-Client Name resolution for the name <DNS record>. timed out after none of the configured DNS servers responded. Check if frequent, might be caused by maintenance
1023 Error Perflib The description for Event ID ‘<Event ID number>’ in Source ‘<source>’ cannot be found. The local computer may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them. The following information is part of the event:'<Service>’, ‘<Event>’ check correct registry entries for event log mentioned in the event log message https://msdn.microsoft.com/en-us/library/windows/desktop/aa363661(v=vs.85).aspx
1023 Warning MSExchange ActiveSync Exchange ActiveSync tried to access a mailbox on Mailbox server “<SERVER>”. It could not access the mailbox because the Mailbox server is offline. Check if frequent. Might be caused due to server in maintenance
1028 Error MSExchange Store Driver Delivery OOF history corruption was detected in mailbox <SMTP> use New-MailboxRepairRequest for affected mailbox
1029 Error MSExchange Store Driver Delivery Unable to open the OOF history folder <SMTP>. OOF history operation skipped. use New-MailboxRepairRequest for affected mailbox
1032 Warning MSExchange ActiveSync The connection to mailbox <IDENTITY> on Mailbox server <SERVER> failed. Examine the event log of Mailbox server <SERVER> Check server if event is frequent
1035 Warning MSExchangeFrontEndTransport Inbound authentication failed with error LogonDenied for Receive connector <Receive Connector Name> The authentication mechanism is <Authentication type>. The source IP address of the client who tried to authenticate to Microsoft Exchange is [<SourceIP>]. Check default authentication types for particular receive connector and change it according the best practice for Exchange server – https://technet.microsoft.com/cs-CZ/library/aa996395(v=exchg.150).aspx
1039 Error MSExchangeDiagnostics Failed to detect the bitlocker state for EDS log drive <Drive> If no Bitlocker enabled, service throuws an event, no action needed
1039 Warning MSExchangeHMHost Worker process manager timed out after <Number> seconds while waiting for a retired process handles to close (process id : <PID> ). No action needed if infrequent
1040 Error MSExchangeFrontEndTransport The SMTP availability of the Receive connector Server <Receive connector Name> was low (<number> percent) in the last 15 minutes. correct solution not available, probably caused by incorrect function of ExchangeHM, check free disk space for transport database and consider moving transport database to dedicated volume
1040 Warning MSExchange ActiveSync The average of the most recent heartbeat intervals [<number>] for request [Sync] used by clients is less than or equal to [<number>].–Make sure that your firewall configuration is set to work correctly with Exchange ActiveSync and direct push technology. Specifically, make sure that your firewall is configured so that requests to Exchange ActiveSync do not expire before they have the opportunity to be processed. For more information about how to configure firewall settings when using Exchange ActiveSync, see Microsoft Knowledge Base article 905013, “Enterprise Firewall Configuration for Exchange ActiveSync Direct Push Technology” (http://go.microsoft.com/fwlink/?linkid=3052&amp kbid=905013).
1050 Warning MSExchange Extensibility The execution time of agent ‘<Transport agent name>’ exceeded <Time span> milliseconds while handling event ‘<Transport Pipeline event>’ for message with InternetMessageId: ‘<Message ID>’. This is an unusual amount of time for an agent to process a single event. However, Transport will continue processing this message. check transport for messages in queues, restart transport service
1051 Warning MSExchange Extensibility Agent ‘<Transport Agent name>’ caused an unhandled exception <Exception> update exchange for latest version, otherwise no action needed
1057 Error MSExchange Extensibility Agent ‘<Transport agent name>’ went async but did not call Resume on the new thread, while handling event ‘<Transport Pipeline Event>’ This should be sent to the vendor of the application server calling async. logging according to: http://blogs.msdn.com/b/dvespa/archive/2013/02/18/exchange-2013-async-agent-resume-1057.aspx
1077 Warning MSExchangeIS The mailbox <Identity> on database <MDB GUID> is approaching its storage limit. A notification has been sent to the user. This warning will not be sent again for at least twenty four hours. No action needed
1079 Warning MSExchange Unified Messaging The VoIP platform encountered an exception RequestUri=sip:<sip URI and port>transport=Tls ID connected to 1136. check UM certificate. It must have SN as same as UM server name https://social.technet.microsoft.com/Forums/lync/en-US/59bdff60-355f-4105-9843-7e3e92a0d020/event-ids-1079-1136-hangups?forum=exchangesvrunifiedmessaginglegacy
1111 Error UmrdpService Driver<DRIVER NAME> required for printer <PRINTER> is unknown. Contact the administrator to install the driver before you log in again. No action needed
1136 Warning MSExchange Unified Messaging An error occurred while transferring a call to “<Extension>”. Additional information: The call transfer type is “Blind.”, the transfer target is “phone number”. Call ID: “<Call GUID>”. Referred by: “”. ID connected to 1079 check UM certificate. It must have SN as same as UM server name https://social.technet.microsoft.com/Forums/lync/en-US/59bdff60-355f-4105-9843-7e3e92a0d020/event-ids-1079-1136-hangups?forum=exchangesvrunifiedmessaginglegacy
1282 Error Microsoft-Windows-FailoverClustering Security Handshake between local and remote endpoints ‘<Source endpoint IP>~ -> <remote endpoint IP>’ did not complete in ‘<time>’ seconds, node terminating the connection check DAG status if occurs frequently
1309 Warning ASP.NET 4.0.30319.0 Event message: The request has been aborted<description> check ASP config in IIS and increase ASP request timeout value
1657 Warning MSExchange Unified Messaging DTMF map update failed for recipient “<Recipient GUID>”. Tenant: “Enterprise”, Run Id: “<RunID GUID>”, Error: Unable to read recipient. check if recipient can be read by Exchange server (inheritable properties) and correct DTMF mapping https://technet.microsoft.com/en-us/library/aa996919(v=exchg.150).aspx
1692 Warning MSExchange Unified Messaging The Microsoft Exchange Unified Messaging service couldn’t establish a media channel with the current Lync Server Audio/Video Edge resources associated with <LYNC host name and port>. Diagnostic information: No diagnostic information is available. check connection to EDGE server
2001 Error MSExchange Certificate Notification A transient failure has occurred. The problem may resolve itself. <DESCRIPTION> No action needed if not frequent.
2004 Warning MSExchange OAuth Unable to find the certificate with thumbprint <thumbprint> in the current computer or the certificate is missing private key. The certificate is needed to sign the outgoing token. check mentioned certificate, recreate OAUTH certificate – https://social.technet.microsoft.com/Forums/exchange/en-US/6d67e5ef-555e-41a5-8de9-2a56cf95363a/missing-the-microsoft-exchange-server-auth-certificate?forum=exchangesvradmin
2005 Warning MSExchange Certificate Deployment Federation or Auth certificate not found: <THUMBPRINT>. Unable to find the certificate in the local or neighboring sites. Confirm that the certificate is available in your topology and if necessary, reset the certificate on the Federation Trust to a valid certificate using Set-FederationTrust or Set-AuthConfig. The certificate may take time to propagate to the local or neighboring sites. consider updating Federation trust with new certificate
2005 Warning MSExchange Mid-Tier Storage <Process><Exception> check if frequent, this is common event log with no direct solution
2009 Warning MSExchange Mid-Tier Storage [Process:Microsoft.Exchange.RpcClientAccess.Service PID:<PID> Thread:<THREAD>] Error occurred while resolving the Active Directory object for from email address field: ‘<SMTP address>’. Audit log will not be generated for this case. Exception details<DETAILS> No action needed if not frequent, caused by unknown object being searched in AD
2030 Error MSExchangeFrontEndTransport The Ehlo options for the client proxy target <IP> did not match while setting up proxy for user <SMTP address> on inbound session <Session GUID>. The mismatched settings might cause some messages to get rejected. Continue with proxying even though there is a mismatch. The critical non-matching options were maxSize. The non-critical non-matching options were . Ensure that message size limits are same within all environment, especially FrontEnd and HUB transport messahe limits must correspond to not get messages rejected with NDR – http://technet.microsoft.com/en-us/library/bb124345(v=exchg.150).aspx
2058 Error MSExchangeRepl The Microsoft Exchange Replication service was unable to perform an incremental reseed of database copy ‘<MDB copy name>’ due to a network error. The database copy status will be set to Disconnected. Error A timeout occurred while communicating with server <Server>’. Error: “A connection could not be completed within <time span> seconds.” test replication health against the affected database copy
2091 Warning MSExchangeRepl Database: <MDB Copy>–Mailbox Server: <MBX Server>—Database <DB copy> will be mounted with the following loss information:–* The last log generated (known to the server) before the switchover or failover was check DAG MDB failover and Data loss settings
2107 Warning MSExchange ADAccess Process Microsoft.Exchange.Directory.TopologyService.exe <PID>. Exchange Active Directory Provider failed to obtain an IP address for DS server <DNS name>, error <ERROR ID>. This host will not–be used as a DS server by Exchange Active Directory Provider. check DNS regarding to AD
2120 Error MSExchange ADAccess Process Microsoft.Exchange.Directory.TopologyService.exe <PID>. Error ERROR_TIMEOUT (0x800705B4) occurred when DNS was queried for the service location (SRV) resource record used to locate a domain controller for domain <DOMAIN> check availability of DNS service for AD Topology Service
2123 Warning MSExchange ADAccess Process Microsoft.Exchange.Directory.TopologyService.exe <PID>. Exchange Active Directory Provider is unable to connect to the Domain Controller <Domain Controller> check availability of DNS service for AD Topology Service
2137 Warning MSExchangeRepl RPC request to the Microsoft Exchange Information Store service for log truncation failed for database <MDB copy name>. Error: Failed to notify source server ‘<source Exchange server name>’ about the local truncation point. Hresult: <result>. Error: Operation has been aborted. check mailbox database replay and copy queue length as well as truncation log time for lagged copy database
2142 Error MSExchangeADTopology Process Microsoft.Exchange.Directory.TopologyService.exe <PID> Forest <FOREST>. Topology discovery failed, error details –TimedOut. No action needed if not frequent
2153 Error MSExchangeRepl The log copier was unable to communicate with server ‘<Mailbox server name>’. The copy of database ‘<MDB copy name>’ is in a disconnected state. The communication error was: An error occurred while communicating with server ‘<Mailbox server name>’. Error: Unable to write data to the transport connection: An established connection was aborted by the software in your host machine. The copier will automatically retry after a short delay. check mailbox database copy health on mailbox servers experiencing errors
2193 Warning MSExchange ADAccess Process Microsoft.Exchange.Directory.TopologyService.exe <PID>. Suitability check failed for server <DC> with an exception. <Exception> Check connection to affected DC. No immediate action needed. DC can be down for maintenance
3008 Warning MSExchange Front End HTTP Proxy [Owa] Failed to refresh Mailbox server for database <MDB GUID> in resource forest . Exception:<Exception> check databases availability
3028 Warning MSExchangeApplicationLogging Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file ‘<KillBit XML file path>’ because it is being used by another process. use handle.exe for killbit.xml file to chek which process is using it, consider antivirus and backup software exclusions for Exchange related files and paths according MS Best Practice
3028 Warning MSExchangeApplicationLogic Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file ‘<Killbit file path>’ because it is being used by another process.<Exception> Check file accessibility. Might be caused by antivirus or backup
4001 Warning MSExchangeIS Microsoft Exchange Information Store service has encountered a message (internet message id <ID>) with an invalid submit time (<TIME>). Duplicate copies of this message may be delivered. No action if not frequent
4002 Error MSExchange Availability Process <PID>: ProxyWebRequest CrossSite from <GUID> to https://ex13-cz-02.cz.avg.com:444/ews/Exchange.asmx failed <Description> check EWS authentication and settings on both endpoints – https://social.technet.microsoft.com/Forums/exchange/en-US/fbaeb391-ab2b-428a-a376-12c3845c67b2/event-id-4002-availability-server
4009 Error MSExchange Availability Process Microsoft.Exchange.InfoWorker.Common.Delayed`1[System.String]: Unable to open connection for mailbox <MAILBOX><EXCEPTION> No action if not frequent
4026 Error MSExchangeRepl [Seed Manager] The seed request for database ‘<DB ID>’ encountered an error during seeding. Error: An Exception was received during a FAST operation. check index and FAST service state for the database mentioned in error description
4057 Error MSExchangeRepl The Microsoft Exchange Replication service encountered an unexpected error in log replay for database <ID>. Error MapiExceptionMdbOffline: LogReplayRequest rpc failed. check if exists after correction of HC – bring DB online
4065 Error MSExchangeRepl The Microsoft Exchange Replication service sent a request to Hub Transport server <Server ID> to resubmit messages for database <DB ID> between time period check if exists-Test-ReplicationHealth
4082 Error MSExchangeRepl The replication network manager encountered an error while monitoring events. Error: Microsoft.Exchange.Cluster.Replay.ClusterNetworkNullSubnetException: Cluster network check if exists – Test-ReplicationHealth
4110 Error MSExchangeRepl The Microsoft Exchange Replication service has suspended log replay on database <DB ID> because the current copy queue length of 16 exceeds the threshold of 12. Replay will automatically be resumed when the queue length falls below 5 check queues and DB replicas
4112 Warning MSExchange ADAccess Process <PROCESS><PID>. AD Session operation failed on DC <DC> because this server is not suitable at the moment. DomainController value set on the session instance: <DESCRIPTION> No action needed if not frequent, might be caused by patching
4401 Error MSExchangeRepl Microsoft Exchange Server Locator Service failed to find active server for database ‘<DB GUID> Error: An Active Manager operation failed. Error: Invalid Active Manager configuration. check DAG status and cluster service
4999 Error MSExchange Common Watson report about to be sent for process id: <PID>,<SERVICE>,<INFO> Check if log is frequent
5004 Warning MSExchange Mid-Tier Storage User mailbox <USER> has exceeded the calendar logging quota. Calendar logging has been stopped for the mailbox until more space becomes available. No action needed or increase log space for mailbox (Set-Mailbox)
6004 Error MSExchange Common ADDriverLogs: Failed to write logs because of the error: Access to the path ‘Microsoft.Exchange.Store.Worker.exe__<NO>.LOG’ is denied.. no direct action needes, check log path, disk space and file lock
7024 Error Service Control Manager The Cluster Service service terminated with the following service-specific error: check health of DAG
7024 Error Service Control Manager The <SERVICE> service terminated with the following service-specific error: <ERROR> Check mentioned service and affected servers
7031 Error Service Control Manager service named in event ID terminated unexpectedly check service and repair according Technet articles of particular service
7031 Error Service Control Manager The Microsoft Exchange Diagnostics service terminated unexpectedly. It has done this <number> time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. No action needed if service is running
7032 Error Service Control Manager The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the <Service Name> service, but this action failed with the following error:<type> check service restart according Technet articles
8015 Warning Microsoft-Windows-DNS-Client The system failed to register host (A or AAAA) resource records (RRs) for network adapter–with settings:——           Adapter Name : <Description> Check DNS server connection timeouts, manually register network adapter by using ipconfig /registerDNS
8020 Warning Microsoft-Windows-DNS-Client The system failed to register host (A or AAAA) resource records (RRs) for network adapter–with settings:——           Adapter Name : <Description> Check DNS server connection timeouts, manually register network adapter by using ipconfig /registerDNS
8538 Warning MSExchangeIS The archive mailbox <MAILBOX GUID> on database <MDB GUID> has exceeded the maximum archive mailbox size. The user cannot copy or move items into the archive mailbox. All message retention actions that move items to the archive mailbox will fail, and the primary mailbox may contain items with expired retention tags until the archive mailbox is within the maximum size limit. The mailbox owner should be notified about the condition of the archive mailbox. info only – increase quota
9037 Error MSExchange Assistants Service MSExchangeMailboxAssistants. An exception was encountered while processing a RPC. Method: Execute, Exception: <Exceprion> check mailbox Assistants based on Exception type (usually unknown database which occurs while DB was removed and IS service not restarted yet)
9646 Error MSExchangeIS Mapi session <Recipient> with client type <client type> exceeded the maximum of 250 objects of type <Object type e.g. Message>. check limits for each mailbox servers – must be several times more than users located on mailbox server, check limits for MAPI (messages opened per folder)
10006 Error MSExchange Mid-Tier Storage Active Manager Client experienced an AD timeout trying to lookup object <GUID> check availability of domain controllers (patching ETC)
10015 Warning MSExchange Mid-Tier Storage Active Manager Client already doing query for object ‘<Objeckt GUID>’ on another thread, however this thread didn’t complete in 100 msec. no direct action needed, check DAG status
10022 Warning MSExchangeMailboxAssistants The archive mailbox <Description> exceeded the archive warning quota <size> info only – increase quota, let user delete some content
10025 Warning MSExchangeMailboxAssistants Processing of the current batch of items in mailbox <Description> failed. The expiration action is ‘MoveToArchive Connected to Event ID 10022 – folders cannot be moved to archive while quota exceeded
10027 Error MSExchangeIS The archive mailbox <Description> exceeded   the Recoverable Items Warning Quota. Please remove items from Recoverable Items or increase the Recoverable Items Warning Quota and Recoverable Items Quota. If the Recoverable Items Quota is exceeded, the user will be unable to delete items from the mailbox. info only – increase quota
10028 Error DCOM The description for <ID> in Source ‘DCOM’ cannot be found. The local computer may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them. The following information is part of the <description> check correct registry entries for event log mentioned in the event log message https://msdn.microsoft.com/en-us/library/windows/desktop/aa363661(v=vs.85).aspx
14021 Error MSExchange MailTips Group metrics generation was interrupted. <Description> Check group if it has corrupted membership or delegate values, restart OAB generation server (Exchange 2010) or check if generation of group matric in arbitration mailbox is not skipped due to constantly high server workload https://technet.microsoft.com/en-us/library/jj674302(v=exchg.150).aspx
14035 Error MSExchange MailTips Process Microsoft.Exchange.InfoWorker.Common.Delayed`1[System.String]: MailTips query failed for mailbox <MAILBOX><DESCRIPTION> No action if not frequent
22004 Warning MSExchangeTransport The periodic heartbeat to primary server <Transport service FQDN> failed. check connectivity to servers and shadow redundancy (safety net) functionality
24001 Error MSExchange CalendarRepairAssistant Calendar repair assistant related description <SMTP> check CRA logs for mentioned mailbox
36887 Error SChannel A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 70. no action needed https://ficility.net/2013/10/21/exchange-2013-exchange-2010-windows-server-2012-schannel-event-id36888-1203-tlsssl-error-the-root-cause/
36888 Error SChannel A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 1203. no action needed https://ficility.net/2013/10/21/exchange-2013-exchange-2010-windows-server-2012-schannel-event-id36888-1203-tlsssl-error-the-root-cause/
Advertisements

Windows Server 2012+ and net-framework-core package installation error (unable to locate source files)

I have faced a problem with net-Framework-core package installation. As you probably know, this package is deprecated, but still available, when you specify source. It can be installed by command

Add-WindowsFeature net-Framework-core -Sources <path to Windows Server 2012 installation media>\Sources\SxS

If that doesnt work, you should check several things:

  • Is the installation media from the same build as current OS (should be)
  • Isnt it corrupted
  • Sometimes it is helpful to map installation media on another server and use UNC path instead of local
  • In my case problem was in Windows Update Services setting. The registry key stated, no automatic update is possible and WUS is used for updates.

Solution: Locate registry key below, change value to “0” and install net Framework core feature. After done, change back to “1” – if still no go, change value to 0 and reboot server prior to install.

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]

“UseWUServer”=dword:00000001

“NoAutoUpdate”=dword:00000001

 

KPCS is finalist in Microsoft Awards 2014 wordwide!

I am proud to announce, that company I work for KPCS.CZ is second worldwide in Server platform implementation projects category. Besides this nice placement we won 3 categories in Czech Republic and once we are finalist.

So total 5 awards within 1 year! What the great success!

More here:

http://www.digitalwpc.com/Awards/Pages/Home.aspx#fbid=jO4-P7IA4sY

http://www.kpcs.cz

 

 

 

Multiple SPF records for one domain can cause problems in e-mail delivery

I have found, that on of my customer domains have problem to send messages outside their environment. Some messages got stuck in queue for several hours / days without any reason to do so. SMTP traffic was OK to most of other domains, but some had problem. I suspect, that the reason was more SPF TXT records for single domain. Example:

domain.com TXT="v=SPF1 mx host1.domain1.com ~all"
domain.com TXT="v=SPF1 mx host2.domain2.com ~all"
domain.com TXT="v=SPF1 mx host3.domain3.com ~all"

RFC 4408 stays, that no multiple SPF records should be available:

3.1.2.  Multiple DNS Records: A domain name MUST NOT have multiple records that would cause an
authorization check to select more than one record.  See Section 4.5
for the selection rules.

Explanation is quite logical. If there is more than one SPF record, permanent error is returned.

4.5.  Selecting Records
   Records begin with a version section:
   record           = version terms *SP
   version          = "v=spf1"
   Starting with the set of records that were returned by the lookup,
   record selection proceeds in two steps:
   1. Records that do not begin with a version section of exactly
      "v=spf1" are discarded.  Note that the version section is
      terminated either by an SP character or the end of the record.  A
      record with a version section of "v=spf10" does not match and must
      be discarded.

   2. If any records of type SPF are in the set, then all records of
      type TXT are discarded.
   After the above steps, there should be exactly one record remaining
   and evaluation can proceed.  If there are two or more records
   remaining, then check_host() exits immediately with the result of
   "PermError".
   If no matching records are returned, an SPF client MUST assume that
   the domain makes no SPF declarations.  SPF processing MUST stop and
   return "None".

Well. The cause of this “implementation” is, that some messages from domain containing wrong SPF record to domain with SPF check might be lost (-All) or delayed. I am going to investigate this further. If you have some experience with similar problem, please let me know.

VPN Client fails to enable virtual adapter in W8

If you have W8 and use VPN or AnyConnect client like me, you could face the following issue.

22- 10- 2013 20-35-3422- 10- 2013 20-35-59It could be known issue regarding to the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CVirtA as well as selected checkbox “Allow other network users to conned through this computers Internet connection” in my case due to Hyper-V Virtual Switch.

22- 10- 2013 20-50-29

The history of email

I just read a nice article about the history of email. Unfortunatly this article is written in Czech:

But if you are interest in this topic you have a lot of alternatives in English. Just for example:

Comodo Antispam Gateway

I was looking for free Antispam GW for my lab and I came accross Comodo Antispam Gateway. It is free for 1 domain and 10 users.

Sign up for free license is here:

Why to use this GW?

  • Easy configuration
  • Access via Admin interface
  • Quarantine, blocklist, whitelist  – all accessible with free license
  • AD synchronization newly created also for free license!

Few screen shots:

Admin interface:

Admin_comodo

Quarantine settings: Quarantine_settings

Incoming spam detection settings: Spam_detection settings