mhdcommunications
asked on
Exchange Server generatin Event ID 9646 every 8 minutes (exactly) for the same user, everyday, all day, only whlie her computer is on.
This is the error that started happening 6/29/09, for ONLY ONE USER, and re-occurs every 8 minutes (EXACTLY 8 minutes). We are using SEP 11 MR1 MP4 (something like that), and it has found no virus on her PC. I also puled her HDD and scanned with Avira, Malwarebytes and F-Secure, all come up with nothing. I also manually searched for viruses and could not find any.
The domain has not been blacklisted, which tells me there is no virus, and there is something else i'm missing. Im running out of ideas. The end-user says they are not sending out mass e-mails, and checking the tracking database, he/she is correct.
The error is below (remember, this repeats every 8 minutes (to the second) from the time she logs in, to the time she leaves.
Event Type: Error
Event Source: MSExchangeIS
Event Category: General
Event ID: 9646
Date: 7/7/2009
Time: 5:29:00 PM
User: N/A
Computer: SERVER
Description:
Mapi session "/o=DOMAIN/ou=First Administrative Group/cn=Recipients/cn=827
For more information, click http://www.microsoft.com/contentredirect.asp.
Management does not like these errors, and wants them gone pronto. Thank you in advance.
The domain has not been blacklisted, which tells me there is no virus, and there is something else i'm missing. Im running out of ideas. The end-user says they are not sending out mass e-mails, and checking the tracking database, he/she is correct.
The error is below (remember, this repeats every 8 minutes (to the second) from the time she logs in, to the time she leaves.
Event Type: Error
Event Source: MSExchangeIS
Event Category: General
Event ID: 9646
Date: 7/7/2009
Time: 5:29:00 PM
User: N/A
Computer: SERVER
Description:
Mapi session "/o=DOMAIN/ou=First Administrative Group/cn=Recipients/cn=827
For more information, click http://www.microsoft.com/contentredirect.asp.
Management does not like these errors, and wants them gone pronto. Thank you in advance.
Glen Knight
Have a look at this MS article: http://support.microsoft.com/kb/830836
I found this information in an article:
-------------
This problem may be caused by a program that integrates with Outlook, with an Outlook add-in, or with a batch file or script that is running against the mailbox.
As a further troubleshooting step, remove or disable any third-party Outlook add-in and antivirus software on the client computer. Then, verify the results of the server again to ensure that these objects are no longer open.
-------------
Was there any new software that integrates with Outlook installed on this PC? I would start disable the plug-ins like the article said, then start disabling services on the computer until you find the one causing it.
Regards,
Rob
-------------
This problem may be caused by a program that integrates with Outlook, with an Outlook add-in, or with a batch file or script that is running against the mailbox.
As a further troubleshooting step, remove or disable any third-party Outlook add-in and antivirus software on the client computer. Then, verify the results of the server again to ensure that these objects are no longer open.
-------------
Was there any new software that integrates with Outlook installed on this PC? I would start disable the plug-ins like the article said, then start disabling services on the computer until you find the one causing it.
Regards,
Rob
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
#If the user does not log to the domain & use her mailbox check if you don't get this event id?
#Check in the applog & I am sure other users would also be getting event id's 9646.
#Check if the user had any outlook-addins please go ahead disable unwanted addins...
The event id 9646 generated in the application log is probably due to the Scalable Networking Pack component in the Service Pack 2 of Windows 2003 server...........
http://msexchangeteam.com/archive/2007/07/18/446400.aspx explains why are we getting these event id's 9646 due to the Broadcom adapters on the Exchange server
Suggestion:-
(1) Update the broadcom adapters to latest driver version.
(2) Install the hotifx as per platform (x86, x64) on all the DC/GC's or exchange server running SP2 for Widnows 2003 server...
(3) If rebooting is an issue of these servers then run Netsh int ip set chimney DISABLED from command-prompt on the DC/GC's as well as Exchange server.
(4)Turn off the Checksum Offloading on NIC's of these servers
#Check in the applog & I am sure other users would also be getting event id's 9646.
#Check if the user had any outlook-addins please go ahead disable unwanted addins...
The event id 9646 generated in the application log is probably due to the Scalable Networking Pack component in the Service Pack 2 of Windows 2003 server...........
http://msexchangeteam.com/archive/2007/07/18/446400.aspx explains why are we getting these event id's 9646 due to the Broadcom adapters on the Exchange server
Suggestion:-
(1) Update the broadcom adapters to latest driver version.
(2) Install the hotifx as per platform (x86, x64) on all the DC/GC's or exchange server running SP2 for Widnows 2003 server...
(3) If rebooting is an issue of these servers then run Netsh int ip set chimney DISABLED from command-prompt on the DC/GC's as well as Exchange server.
(4)Turn off the Checksum Offloading on NIC's of these servers
ASKER
Blackberry wanted to re-install the server software. They said it was damaged beyond repair. They also wanted me to pay $249 to have the issue fixed. Everyone is going to be switching to ActiveSync enabled phones. No more 3rd party software needed to do what most smartphones do natively. Way to go Blackberry.
ASKER
Ignore the comment above - wrong question. Sorry.
ASKER
Removed the Symantec Add-in, and this went away. Re-installed SEP 11 and the add-in stopped causing the issue. Thanks.