Event ID : 1205

Issue : An attempt to create a mailbox failed. Insufficient permissions, a Jet error, or a memory error may have caused the problem.

Event Source : MSExchangeIS Mailbox Store

Cause : This Error event indicates that a mailbox for the user account specified in the event description could not be created.
This event may occur when moving the mailbox from one mailbox database to another mailbox database. One or more of the following conditions may occur.

1. The mailbox for this user already exists in the mailbox tombstone table.
2. The user account specified in the event description was deleted but the changes were not replicated to all the domain controllers in Active Directory.
3. There are logical corruptions in the database.

You may also see an Error event 1022 in the Application log.

Description : Failed to create the mailbox of "{mailbox name}" with error "{error code}".

Action Required :

• Try creating a mailbox again. Use the error returned to help determine a course of action.
• Review the event log for related entries.
• If this error occurred during a move mailbox operation, make sure that the move was successful.
• If not, try to move the mailbox again. Make sure both the source and target mailbox database stores are in Mounted state.

Event ID : 454 , 494

Issue : Hard page faults on exchange database, database can be down or can go down.

Event Source : ESE

Cause :
This behavior occurs because the Extensible Storage Engine (ESE) attempts to bring all databases in a storage group to a consistent state during recovery. To accomplish this, ESE keeps track of all databases in the log files for the storage group. If a database is missing, ESE returns the error -1216, and does not start the storage group.
Event ID 454 is a generic event that indicates a problem either with a restore operation or with the recovery of an Exchange 2000 Information Store database. Generally, Event ID 454 means that Exchange 2000 has determined that:

• Files in the database's running set are missing.
• Files in the database's running set have been replaced with different versions.
• Files in the database's running set are corrupted.

Description : Information Store (976) Database recovery/restore failed with unexpected error Error Number -1216.

Action Required :

1. To resolve this problem, either locate the missing databases and move them to the appropriate folders, or restore the missing databases from backup.
2. If the missing database was deleted or lost, restore the missing database from a backup. While you are restoring this database, you can mount and access the other databases in the storage group by completing the following steps:

• Run eseutil /r Log Base Name /I. This allows ESE to take the databases that are present to a consistent state while ignoring the missing databases. After you run this command, any databases that are not present will require restoring from backup. You can specify the location of the log files with the /l option and the location of system files with /s option.
• Mount the databases in the storage group that are now present and consistent.
• Allow the users on the running database to access their mail.

Ref.Link :

1. http://support.microsoft.com/kb/810198
2. http://support.microsoft.com/kb/823168

Event ID : 447

Issue : Outlook will not open for end-users. The information store terminated abnormally .

Event Source: ESE

Cause : This problem is frequently caused by a hardware failure or by antivirus scanning of the database file directory. Event ID 447 indicates that the logical database structure has become corrupted. This may occur for one or more of the following reasons:

1. Disk caching has not committed transactions to the hard disk and the server has stopped responding (crashed).
2. Incorrect log files were replayed during a database restoration.
3. The server has a defective hard disk controller.
4. Database log files have been removed that were not fully committed to the database.

E.g.
Information Store (nnnn) A bad page link (error -338) has been detected in a B-Tree (ObjectId: 70950, PgnoRoot: 157120) of database e:\Program Files\exchsrvr\mdbdata\priv1.edb (157120 => 296404, 296403).

Action Required :
If you receive these errors in your application log, it is best if you restore from an online backup as soon as you can.The restore must be performed by using a backup that was created before this error occurred. In a worst-case scenario where no good backup exists, you may have to do a hard repair by running the "eseutil.exe /p" command (original database is preserved). After the hard repair, do an offline defragmentation of the database by running the "eseutil /d" command, and then run the " isinteg -fix " command (Repair information store.) on the database.This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

Ref Link:

http://support.microsoft.com/kb/810190/en-us

Event ID : 478

Issue : The streaming database specified in the message is corrupted.

Event Source: ESE

Cause : When you perform an online backup of a storage group, a mailbox store, or a public folder store, the operation may be unsuccessful.

Description : This Warning event indicates that the streaming database specified in the message is corrupted.The .edb and .stm files may be out of sync. An older copy of the .stm file may be in use, and the checksum table in the .edb file is therefore out of date. A program may have altered the .stm file without updating the checksums in the .edb file. There could be problems with the hard disk subsystem or controllers of the system.
E.g.
Information Store (308) The streaming page read from the file "C:\Program Files\Exchsrvr\
mdbdata\prv1.stm" at offset 130646016 (0x0000000007c98000) for 4096 (0x00001000) bytes faled verification due to a page checksum mismatch. The expected checksum was 18463398 (0x000000000af895a6) and the actual checksum was 184063406 (0x000000000af95ae). The read operation will fail with error -613 (0xfffffd9b). If this condition persists then please restore the database from a previous backup.

Action Required :
Take full exchange database backup if database is online, if successfull then restore same from backup immediately, if back is failing then take offline backup of database and perform following.

1. Repair database using eseutil /p
2. defrag database using eseutil /d
3. Run isinteg -s -fix -test alltests

OR

If exchange version is enterprise then move all mailboxes to new database and repair old database.
Ref.Link :

http://support.microsoft.com/kb/314917/en-us

"We have observed physical errors on the database. It is strongly recommended to repair the database. We will be performing following activities on the server :

1. Repair database using eseutil /p
2. Defrag database using eseutil /d
3. Run isinteg -s -fix -test alltests

Ref.Link :

1. http://support.microsoft.com/?id=318429
2. http://support.microsoft.com/?id=814891
3. http://support.microsoft.com/kb/840013/en-us

Event ID : 205

Issue : Microsoft Exchange server that logged this event is not connected to the local area network.

Event Source: MSExchange Common

Cause : This Error event indicates that the Microsoft Exchange server that logged this event is not connected to the local area network. This event may occur when the network adapter installed on this server is either disabled or not working.

Description : No DNS servers could be retrieved from network adapter. Check if the computer is connected to a network and Get-NetworkConnectionInfo returns any results.

Action Required :
To resolve this error, make sure that the server that logged this event is connected to the local area network.
Additionally, make sure that the following Exchange Management Shell cmdlet returns the IP address of one or more DNS servers.
Command : Get-NetworkConnectionInfo

Event ID : 1503

Issue : Outlook Mobile Access users cannot access their mailboxes on a heavily-loaded Exchange Server 2003 computer.

Event Source: MSExchangeOMA

Cause : On a heavily-loaded Microsoft Exchange Server 2003 computer, users in your organization may not be able to access their mailboxes by using Microsoft Outlook Mobile Access.
In this scenario, an Outlook Mobile Access user may receive an error message that is similar to the following:
" A system error has occurred, please see your system administrator. "

This problem may occur if Exchange Server 2003 is running on a Microsoft Windows 2000-based computer. In this scenario, virtual memory fragmentation may occur if Exchange Server 2003 is under a heavy load. You may experience this problem during stress-testing of your Exchange Server environment.

Description : An unknown error occurred while processing the current request: Exception of type System.OutOfMemoryException was thrown.Outlook Mobile Access users cannot access their mailboxes on a heavily-loaded Exchange Server 2003 computer.

Action Required : To work around this problem, restart the World Wide Web Publishing service on the Exchange Server computer.

Ref Link:
http://support.microsoft.com/kb/842119/en-us

Event ID : 9549

Issue : Not able to send email to a perticular mailbox OR not able to open mailbox using OWA.

Event Source: MSExchangeIS

Cause : This issue may occur if another account exists that has the same e-mail address. The same SMTP proxy address has been assigned to more than one object in Microsoft Windows 2000 Active Directory. Event 9514 indicates which objects have the same SMTP address.

In Exchange 2000, you may experience one of the following symptoms:

1. When you try to send a message, you receive a non-delivery report (NDR) that includes an "ambiguous recipient" error message or a Simple Mail Transfer Protocol (SMTP) delivery status notification code 5.1.4.
2. You receive the following message when you add a proxy address to a user account:
   This e-mail address already exists in this organization. ID no. c10312e7 Microsoft Active Directory - Exchange Extension.

Description: An ambiguous SMTP proxy user1@domain.com was found on 0x2 mailboxes in the DS. The store cannot map this SMTP proxy to a unique Mailbox GUID.

Action Required :

1. To resolve this issue, locate the user account that has an ambiguous address or an address that already exists (to find the address, view the E-mail Addresses tab in the user account properties), and then change one or more of the accounts so that they do not have the same e-mail address.To locate the user account that has an ambiguous address or an address that already exists, use either of the methods that are described in this section.
2. To resolve this problem, find the objects that have duplicate SMTP addresses using event 9514, and then modify the SMTP address.

Ref Link:
http://support.microsoft.com/kb/286792/en-us

http://support.microsoft.com/kb/269498/en-us

Event ID : 1233

Issue : suspected issue on Exchange server.

Event Source: MSExchangeIS

Cause : The following warning message may be logged in the Application event log of an Exchange 2000 Server computer, and users may not be able to log on unless you restart the server.

Description : An error occurred. Function name or description of problem: {name} Error: {error code} .suspected issue on Exchange server.

Action Required : Rebooting server is a work around for this problem.Kindly Check with the On-Site Engg.

Event ID : 9559

Issue : Low disk space on the Exchange Information Store Drive.

Event Source: MSExchangeIS

Cause : This event is logged along with event id 482 & 9411 in the Application log. This problem can be caused by low disk space on the Exchange Information Store Drive.

Description : The log disk is full for storage group "First Storage Group". Attempting to unmount all databases in this storage group.There is not enough space on the disk.

Action Required : Please try to free some space in Exchange Drive and try to mount the Exchange store and restart the Exchange System Attendant to resolve the issue.

Ref Link: http://support.microsoft.com/kb/555425/en-us

Event ID : 9567

Issue : This error appears when Exchange AV is failing to scan mailbox objects.

Event Source: MSExchangeIS

Cause : This event can occur if the Exchange Server is running an antivirus application and there are problems with the application.

Description : Unexpected error (error code) occurred in "(function name)".
E.g. Unexpected error 0x8004010f occurred in "EcVirusScanOneMessage".
This error appears when Exchange AV is failing to scan mailbox objects.

Action Required : Its recommended to run logical repair of database after taking full backup of exchange database.
Command : ISINTEG -s ServerName -fix -test alltests .

Event ID : 12800

Issue : VM Fragmentation issue. Message conversion failed because there is not enough available memory.

Event Source: MSExchangeIS

Cause : In situations where virtual memory is heavily fragmented, message processing problems and message conversion problems may occur. Users may experience performance issues and may not be able to access their messages. Repeated occurrences of the following event in the application event log, where each occurrence is logged several seconds after the last occurrence, indicate extreme virtual memory fragmentation.This issue occurs if the attachment in the e-mail message is corrupted.

Description : Message processing failed because there is not enough available memory (<message id>).

Action Required : Run Microsoft Exchange Best Practices Analyzer (ExBPA) tool to check this issue. It is highly recommended that you restart all Exchange services to correct this issue.Use System Monitor and Performance Logs and Alerts to measure memory usage and optimize performance. You may also need to stop other running applications and remove unused files and applications from the server's disk.

Ref.Link : http://support.microsoft.com/kb/912068

Event ID : 9582

Issue : VM Fragmentation issue.

Event Source: MSExchangeIS

Cause : Virtual memory fragmentation is a condition where virtual memory is available for a process, but none of the virtual memory blocks that are available are of a significant size. Memory fragmentation occurs over time because of the varying size of memory allocations and the varying lifetimes of each allocation. When you scale a server to handle more users and larger loads, the server may run low on virtual memory in the Microsoft Exchange Information Store process (Store.exe). When this issue occurs, event ID 9582 events are logged to the application event log.

Description : "VM Fragmentation issue" .The Virtual memory necessary to run your Exchange server is fragmented in such a way that normal operation may begin to fail.The server reaches less than 16 MBs of contiguous virtual address space.When this error occurs, the performance of the Exchange Server decreases.

Action Required : Run Microsoft Exchange Best Practices Analyzer (ExBPA) tool to check this issue. It is highly recommended that you restart all Exchange services to correct this issue.

Ref.Link : http://support.microsoft.com/kb/324331

Event ID : 1000

Issue : Outlook will not open because system attendant service is down.

Event Source: Microsoft Exchange Server

Cause : When you restart a computer that is running Microsoft Exchange Server 2003, the Microsoft Exchange Information Store service stops unexpectedly for several minutes.Outlook will not open because system attendant service is down.

Description : Faulting application store.exe, version xxxx, stamp xxxx, faulting module xxxx, version xxxx .
This problem occurs because the Microsoft Exchange Information Store service incorrectly calculates the offset value at the end of the header (EOH) for corrupted messages. This behavior causes an access violation.

Action Required :

1. Apply Microsoft Exchange Server 2003 Service Pack 1.
2. Apply IIS Stack Overflow Vulnerability Patch
3. Shut down Exchange and IIS. Rename the "...\mailroot\vsi 1" directory, create a new one and restart the services. This will eliminate any spam, or corrupt messages from the queues.

Ref.Link :
http://support.microsoft.com/kb/935468

Event ID : 2007

Issue : XADM: Information Store Returns OM_get Errors .

Event Source: MSExchangeIS Mailbox Store

Cause : When the Microsoft Exchange Connector for Lotus Notes is heavily used, the 2007 event ID messages may be logged in the Exchange 2000 application log.

Description : om_get returned error 0x14 on database First Storage Group\Mailbox Store ServerName For more information, click http://search.support.microsoft.com/search/?adv=1.

Action Required : Connect to server and check mail flow and mail queue. if problem found then then apply latest service pack for Microsoft Exchange 2000 Server.

Ref Link:
http://support.microsoft.com/kb/306268/en-us
http://support.microsoft.com/kb/297481/en-us

Event ID : 9690

Issue : Exchange Database size exceeded its Limit, database will be dismounted immediately.

Event Source : MSExchangeIS Mailbox Store

Description : Exchange store '': The logical size of this database (the logical size equals the physical size of the .edb file and the .stm file minus the logical free space in each) is GB. This database size has exceeded the size limit of GB.
This database will be dismounted immediately.

Action Required : To reduce the size of the database, consider doing the following:
1) Delete mailbox or public folder data that you do not need. For example, ask your users to delete items in their mailboxes or delete public folder data that is not needed.
2) Move mailboxes or public folders from the database to a different database.
3) Take offiline Backup.
4) perform an offline defragmentation with the Eseutil.exe utility (the eseutil /d command) against the .edb database file.

Ref.Link :
http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Exchange&ProdVer=6.5.7638.0&EvtID=9690&EvtSrc=MSExchangeIS+Mailbox+Store

Event ID : 9689

Issue : Exchange Database size reached its Limit, database will dismount anytime.

Event Source : MSExchangeIS Mailbox Store

Description : Exchange store '<storage group name>': The logical size of this database (the logical size equals the physical size of the .edb file and the .stm file minus the logical free space in each) is <number> GB. This database size is approaching the size limit of <number> GB.
If the logical size of this database is not reduced to less than the maximum size limit, this database will be dismounted the next time a database size check is performed.

Action Required : To reduce the size of the database, consider doing the following:
1) Delete mailbox or public folder data that you do not need. For example, ask your users to delete items in their mailboxes or delete public folder data that is not needed.
2) Move mailboxes or public folders from the database to a different database.
3) Take offiline Backup.
4) perform an offline defragmentation with the Eseutil.exe utility (the eseutil /d command) against the .edb database file.

Work Around: How to increase Exchange database size for 1 GB Extension.
Add the Temporary DB Size Limit Extension registry entry to the computer that is running Exchange 2003 Standard Edition or Exchange 2000 Standard Edition:
a. Open Registry Editor.
To do this, click Start, click Run, type regedit in the Open box, and then click OK.
b. Locate the following key in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\\Private-
c. On the Edit menu, point to New, and then click DWORD Value.
d. Type Temporary DB Size Limit Extension, and then press ENTER.
e. Double-click Temporary DB Size Limit Extension.
f. Type 1 in the Value data box, click Decimal in the Base box, and then click OK.
g. Close Registry Editor.

Ref.Link :
http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Exchange&ProdVer=6.5.7638.0&EvtID=9689&EvtSrc=MSExchangeIS+Mailbox+Store&LCID=1033

Event ID : 9688

Issue : Exchange database reaching its license limit.

Event Source : MSExchangeIS Mailbox Store , MSExchangeIS Public Store

Description : Exchange store '<storage group name>': The logical size of this database (the logical size equals the physical size of the .edb file and the .stm file minus the logical free space in each) is <number> GB. This database size is approaching the size limit of <number> GB.
If the logical database size exceeds the maximum size limit, it will be dismounted on a regular basis.

Action Required : To reduce the size of the database, consider doing the following:
1) Delete mailbox or public folder data that you do not need. For example, ask your users to delete items in their mailboxes or delete public folder data that is not needed.
2) Move mailboxes or public folders from the database to a different database.
3) Take offiline Backup.
4) perform an offline defragmentation with the Eseutil.exe utility (the eseutil /d command) against the .edb database file.

Ref.Link : http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Exchange&ProdVer=6.5.7638.0&EvtID=9688&EvtSrc=MSExchangeIS+Mailbox+Store&LCID=1033

Event ID : 1042

Issue : Metabase Update failed to read the Configuration namespace property from the domain controller.

Event Source: MSExchangeMU

Cause : This event indicates that Exchange was not able to read the configuration namespace property from any domain controller. The error code in the event may vary, depending on why Exchange was not able to read the configuration namespace property. One of the more common values is 0x80040a01. This event frequently occurs when the topology discovery process in Directory Service Access (DSAccess) fails. Some reasons that the topology discovery process in DSAccess fails include intermittent or faulty network connectivity, DNS problems, or permissions problems.This problem occurs if the RootVer registry value is invalid.

Description : Metabase Update failed to read the Configuration namespace property from the domain controller. Error code is 80040a01.

Action Needed : Review events in the event log that were logged before this event. There will probably be Error events pertaining to DSAccess failures, network connectivity failures, and so on. Focus on resolving the problems indicated by the earlier Error events. Running DCDiag and NetDiag may be useful in resolving this problem.
1) Check IIS service is running on server.
2) Run Exchange Best Practise Analyzer tool to check configuration issue.

Ref.Link :
http://support.microsoft.com/kb/906154

Event ID : 1009

Issue : Suspected issue with IIS metabase running on exchange server.

Event Source: MSExchangeMU

Cause : This issue may occur if there is corruption of the Microsoft Internet Information Services (IIS) metabase on the Exchange 2000 Server computer. Corruption of the IIS metabase may occur for a variety of reasons, including the following:
1. The SystemRoot\System32\Inetsrv folder was scanned by an antivirus agent.
2. The Exchange 2000 Server computer is affected by hardware issues.
3. The Exchange 2000 Server computer was affected by a power outage.

You cannot start the Microsoft Exchange services on your Microsoft Exchange 2000 Server computer. When the Microsoft Exchange System Attendant service tries to start, the following events are logged in the application event log:

Description : Failed to access the metabase, error code is 80080005 (Server execution failed). or
Failed to access the metabase, error code is 80090006 (Invalid Signature).
Suspected issue with IIS metabase running on exchange server.

Action Needed :
1) Check IIS service is running on server.
2) Run Exchange Best Practise Analyzer tool to check configuration issue.
3) Restore the Metabase.bin file from backup

Ref Link:
http://support.microsoft.com/kb/314294/
http://support.microsoft.com/?id=831393

Event ID : 8231

Issue : Exchange Recipient Update Service does not stamp proxy addresses in Exchange 2000 Server and in Exchange Server 2003.

Event Source: MSExchangeAL

Cause : The Microsoft Exchange 2000 Server or Microsoft Exchange Server 2003 Recipient Update Service does not create proxy addresses (e-mail addresses) for newly mail-enabled users or public folders when the computer that is running Exchange is in an Exchange mixed-mode environment. An Exchange mixed-mode environment includes Exchange Server 5.5 and Exchange 2000 Server or Exchange Server 2003.

Description : Recipient Update Serivce not stamping email address on newly created mailboxes.
Permanent failure reported by policy group provider for 'CN=Recipient Policies,CN=Name,CN=MicrosoftExchange,CN=Services,CN=Configuration,DC=Name,DC=com':'MAD.EXE', error=8000ffff. Taking provider offline.

Action Required : To resolve this issue, either manually copy the missing .dll file from an existing Exchange Server 5.5 computer, or disable that particular address type so that the Recipient Update Service no longer tries to load the .dll file.

Ref Link:
http://support.microsoft.com/kb/288807/en-us
http://support.microsoft.com/kb/286356/en-us

Event ID : 8331

Issue : Users do not appear in the Global Address List.

Event Source : MSExchangeAL

Cause : On a computer that is running Microsoft Exchange Server 2003 and that has more than one logical processor, you may find that Active Directory updates from Exchange 2003 no longer work correctly. The Recipient Update Service does not configure all the Exchange attributes for the user accounts. As a result, these users may not appear in the Global Address List or may not be able to connect to their Exchange mailboxes.
When you click Check Name while configuring Exchange e-mail accounts in Microsoft Outlook, you may receive an error message that is similar to the following: The name could not be resolved. The name could not be matched to a name in the address list.

Description : The service threw an unexpected exception which was caught at Drive:\Titanium\Dsa\Src\Lra\Abv_dg\Lservagent.cpp(4511)

Action Required : To work around this problem, restart the appropriate service. For example, if the source of the event ID error message that is logged to the application event log is listed as MSExchangeAL, restart the System Attendant service.To resolve this problem, obtain the latest service pack for Exchange Server 2003.

Ref.Link : http://support.microsoft.com/kb/837444

Event ID : 8260

Issue : Cannot access Address List configuration information

Event Source : MSExchangeAL

Cause : The Recipient Update Service is configured to use a Windows domain controller that was demoted. When the Recipient Update Service tries to query the Windows domain controller for an update, it cannot contact it.
Note -This event can also be logged under normal conditions, when the Kerberos ticket for the server temporarily expires. This is especially likely when only one Windows global catalog server is available. Recovery from Kerberos ticket expiration typically occurs very quickly.

Description : Could not open LDAP session to directory ' ' using local service credentials. Cannot access Address List configuration information. Make sure the server ' ' is running.

Action Required : If you determine that the issue was caused by the demotion of a Windows domain controller, you can resolve this issue by following these steps:
1. Open Exchange System Manager.
2. Expand the Recipients container, and then click Recipient Update Services.
3. Double-click each Recipient Update Service, and then change the Windows domain controller setting to the new Windows domain controller in the domain.

Ref.Link : http://support.microsoft.com/kb/272552

Event ID : 8026

Issue : Exchange failing to establish connectivlity with domain controllers.

Event Source : MSExchangeAL

Cause : After you run dcpromo to demote a Windows domain controller (DC) in your domain, the Microsoft Exchange 2000 Server or Microsoft Exchange Server 2003 MSExchangeAL service starts to log events 8026 and 8260 every 10 minutes.

Description : LDAP Bind was unsuccessful on directory for distinguished name ''. Directory returned error: []

Action Required : Connect to exchange and verify connectivity to Domain Controllers, run netdiag tool to verify connectivlity and secure channel .

Ref.Link : http://support.microsoft.com/kb/272552

Event ID : 1031

Issue: One of the System Attendant's task is blocked.

Event Source: MSExchangeSA

Cause :This problem occurs if the RootVer registry value is invalid.
This problem may also occur in the following scenarios:
1. When you remove Active Directory from the domain controller, the ASPNET security account is removed. Therefore, the metabase update service may not be able to start. Additionally, several events that are mentioned in the "Symptoms" section may be logged in the Application log. To resolve this problem, reinstall Exchange Server 2003.
2. When there is a permissions issue, several events that are mentioned in the "Symptoms" section may be logged in the Application log. To resolve this problem, run the Exchange Server 2003 Setup program by using the /domainprep switch, as in the following example:
drive:\setup\i386\setup /domainprep

Description : One of the System Attendant's task is blocked.This problem occurs if the RootVer registry value is invalid.

Action Required :
If the computer is running the Microsoft .NET Framework 1.1, set the RootVer registry value to 1.1.4322.0. To do this, follow these steps:
1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ASP.NET
3. Double-click the RootVer value, type 1.1.4322.0 in the Value data box, and then click OK.
4. Quit Registry Editor.

Ref.Link : http://support.microsoft.com/kb/906154/en-us

Event ID : 9188

Issue : Microsoft exchange System Attendant failed to read the membership of group .

Event Source : MSExchangeSA

Cause : This behavior occurs because the security group object that is specified in the error message is no longer in the Users container, which is where Exchange Server expects the object to be.

Description : Microsoft Exchange System Attendant failed to read the membership of group 'cn=Exchange Domain Servers,cn=Users,dc=your domain'. Error code '80072030'.

Action Required :
Please check whether the local computer is a member of the group. If it is not, stop all the Microsoft Exchange services, add the local computer into the group manually and restart all the services.
To resolve this behavior, move the security group that is specified in the error message back to the Users container.

Ref.Link : http://support.microsoft.com/kb/294176

Event ID : 9097

Issue : The MAD Monitoring thread was unable to connect to WMI .

Event Source : MSExchangeSA

Cause : This issue can occur if the Microsoft Exchange 2000 Server namespace or the Microsoft Exchange Server 2003 namespace has become unregistered in Microsoft Windows Management Instrumentation (WMI) on the system.

Description : The MAD Monitoring thread was unable to connect to WMI, error '0x8004100e'.

Action Required :
Kindly Check with the On-Site Engg.
WMI database was corrupted after a partition filled up. First, the WMI database needs to be rebuild:
- net stop winmgmt
- cd %windir%\system32\wbem
- ren repository repository.old
- net start winmgmt

Ref.Link : http://support.microsoft.com/kb/288590

Event ID : 9098

Issue : This issue may occur if the workflow event sink, Cdowfevt.dll, is not correctly registered.

Event Source: MSExchangeSA

Description : The MAD Monitoring thread was unable to read its configuration from the DS(Directory Service), error '0x80041010' .This issue may occur if the workflow event sink, Cdowfevt.dll, is not correctly registered.

Action Required : Make sure that the version of Cdowfevt.dll is 6.0.4418.43.
Register Cdowfevt.dll Manually:
1. Click Start, and then click Run.
2. In the Open box, type cmd, and then click OK.
3. Make sure that the component that failed is installed. For example , the Wbemcons.mof file and the Wbemcons.dll file should be installed during Windows installation.
4. At the command prompt, type the following text, and then press ENTER:
c:\winnt\system32\wbem\mofcomp.exe -n:root\cimv2\applications\exchange ""c:\winnt\system32\wbem\component_name""
Kindly Check with the On-Site Engg.

Ref.Link:
1. http://support.microsoft.com/kb/326011
2. http://support.microsoft.com/kb/296095

Event ID : 9539

Issue : Exchange store has dismount.

Event Source : MSExchangeIS Mailbox

Cause :
In a storage group with two or more databases, and where each database is on a separate physical hard disk, all the databases in the storage group are dismounted if one hard disk fails.This issue occurs if one of the databases in a storage group is not available.According to Microsoft, this event is logged when a store is dismounted. This can be caused by an administrative action inside of Exchange System Manager (ESM). Additionally, this could be due to a problem where the drive has filled up or the database exceeded the 16-GB size limit .

Description : Exchange store has dismount.
The Microsoft Exchange Information Store database "First Storage Group\Public Folder Store (Server_Name)" was stopped.

Action Required :
If Harddisk failed then replace the failed hard disk and restore the missing database from a backup to the new hard disk.Kindly contact On-Site Technician to solve this issue and try to mount the Exchange store.

Ref Link: http://support.microsoft.com/kb/812452

Event ID : 9175

Issue : The information store Service is not running.

Event Source: MSExchangeSA

Cause:
This issue can occur if the information store is not running. When the information store is stopped and the System Attendant is still running, the System Attendant keeps the MAPI session active. This issue can also occur if a mailbox store failed to mount.

Description :
We have observed an event which indicates that the Exchange Store is currently dismounted. Outlook client tries to query Information Store and store does not respond because it is down OR information store service is not started.

Action Required :
This issue can occur if the information store is not running. When the information store is stopped and the System Attendant is still running, the System Attendant keeps the MAPI session active. This issue can also occur if a mailbox store failed to mount.
To resolve this issue, verify that the information store is running. If the store is not running, attempt to start it. If the information store is running, and the event is still logged, verify that the mailbox stores are mounted. If they are not mounted, attempt to mount them.

Ref. Link: http://support.microsoft.com/kb/262456/en-us

Event ID : 9186

Issue : System Attendant has detected that the local computer is not a member of group.

Event Source: MSExchangeSA

Cause :
The Exchange Server computer's distinguished name has been changed. When System Attendant starts, it caches the distinguished name of the local computer. The Exchange Server computer's distinguished name changes when it is moved from one organizational unit to another organizational unit. The new distinguished name is different from the distinguished name that is in the cache. Therefore, System Attendant logs event ID 9186 and 9187 messages.

Description: Microsoft Exchange System Attendant has detected that the local computer is not a member of group 'cn=Exchange Domain Servers,cn=Users,dc=microsoft,dc=com'.System Attendant is going to add the local computer into the group. The current members of the group are 'CN=SERVERNAME,OU=NEWOU,DC=microsoft,DC=com; '.

Action Required :
Method 1
Restart System Attendant to refresh the cached value.
Note You must restart the following services that depend on the System Attendant service:
1.Microsoft Exchange Information Store
2.Microsoft Exchange Message Transfer Agent (MTA) Stacks
3.Microsoft Exchange Event
4.Microsoft Exchange Internet Message Access Protocol, Version 4rev1 (IMAP4)
5.Microsoft Exchange Post Office Protocol version 3 (POP3)
Method 2
If your Exchange Server computer is not listed, follow these steps:
1.Remove the Exchange Server computer account from the Exchange Domain Servers group.
2.Add the Exchange Server computer account back.
3.Restart System Attendant.

Ref.Link : http://support.microsoft.com/kb/271335

Event ID : 1005

Issue: GC on network is not responding.

Event Source: MSExchangeSA

Cause :
This behavior can occur if the .dll listed in the event ID message is either absent or corrupted.Event ID 2059 and 1005 Messages Occur and System Attendant Is Unable to Start .

Description : We have observed that GC on network is not responding, the possible reason may be:This behavior can occur if the .dll listed in the event ID message is either absent or corrupted. The file name.dll is required but cannot be loaded, error 'c007007f'

Action Required :To resolve this behavior, replace the absent or corrupted .dll with the appropriate .dll that is available on the Release to Manufacturer CD-ROM, or the .dll that is available on your latest service pack. These files are typically located in the Exchsrvr\Bin folder.

Ref. Link : http://support.microsoft.com/kb/295620/en-us