Exchange 2010 server is logging throttling policy "over budget" events for RCA, Outlook emails hang in Outbox

I have a SBS2011 server with Exchange 2010 with a few users configured.  I have one user who has about 5 Exchange mailboxes configured in Outlook 2010 as separate Exchange accounts, NOT as "open these additional mailboxes".  This was done to keep the local .ost file(s) smaller.  Normally performance is fine, however periodically during the work day the user experiences an issue which normally manifests itself in an outgoing email hanging in the Outbox for a period of 5-15 minutes.  During this time other users do not experience issues.  It seems that when this happens a MSExchange ADAccess event 2915 is logged saying the user has gone over budget for component RCA.  I'm not sure if the throttling is causing the Outlook issue, or if there is an underlying issue causing the Outlook performance issues and the 2915 event is a symptom, not a cause.  Any thoughts?
CRush1682Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

CRush1682Author Commented:
Here's an example of one of the 2915 events:

Process Microsoft.Exchange.RpcClientAccess.Service.exe (PID=2088). User 'Sid~CONTOSO\User1~RCA~false' has gone over budget '124' times for component 'RCA' within a one minute period. Info: 'Policy:DefaultThrottlingPolicy_cbce1f4f-569b-4e67-a6de-e1108c965915, Parts:RPC:123;'. Threshold value: '100'.
0
CRush1682Author Commented:
More information:

Server is a Dell PowerEdge T110 with 32GB of RAM.  Exchange database is on it's own physical drives.  Antivirus is ESET Mail Security.  No other errors occur around the 2915 event.  All updates and services packs are installed.
0
CRush1682Author Commented:
Here's another 2915 event:

Process Microsoft.Exchange.RpcClientAccess.Service.exe (PID=2088). User 'Sid~CONTOSO\User2~RCA~false' has gone over budget '175' times for component 'RCA' within a one minute period. Info: 'Policy:DefaultThrottlingPolicy_cbce1f4f-569b-4e67-a6de-e1108c965915, Parts:CAS:174;'. Threshold value: '100'.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

CRush1682Author Commented:
Output when running "get-throttlingpolicy"

[PS] C:\Windows\system32>get-throttlingpolicy


RunspaceId                                : e1db662c-22d9-4229-8b89-a6a0597e28b6
IsDefault                                 : True
AnonymousMaxConcurrency                   : 1
AnonymousPercentTimeInAD                  :
AnonymousPercentTimeInCAS                 :
AnonymousPercentTimeInMailboxRPC          :
EASMaxConcurrency                         : 10
EASPercentTimeInAD                        :
EASPercentTimeInCAS                       :
EASPercentTimeInMailboxRPC                :
EASMaxDevices                             : 10
EASMaxDeviceDeletesPerMonth               :
EWSMaxConcurrency                         : 10
EWSPercentTimeInAD                        : 50
EWSPercentTimeInCAS                       : 90
EWSPercentTimeInMailboxRPC                : 60
EWSMaxSubscriptions                       : 5000
EWSFastSearchTimeoutInSeconds             : 60
EWSFindCountLimit                         : 1000
IMAPMaxConcurrency                        :
IMAPPercentTimeInAD                       :
IMAPPercentTimeInCAS                      :
IMAPPercentTimeInMailboxRPC               :
OWAMaxConcurrency                         : 5
OWAPercentTimeInAD                        : 30
OWAPercentTimeInCAS                       : 150
OWAPercentTimeInMailboxRPC                : 150
POPMaxConcurrency                         : 20
[PS] C:\Windows\system32>get-throttlingpolicy


RunspaceId                                : e1db662c-22d9-4229-8b89-a6a0597e28b6
IsDefault                                 : True
AnonymousMaxConcurrency                   : 1
AnonymousPercentTimeInAD                  :
AnonymousPercentTimeInCAS                 :
AnonymousPercentTimeInMailboxRPC          :
EASMaxConcurrency                         : 10
EASPercentTimeInAD                        :
EASPercentTimeInCAS                       :
EASPercentTimeInMailboxRPC                :
EASMaxDevices                             : 10
EASMaxDeviceDeletesPerMonth               :
EWSMaxConcurrency                         : 10
EWSPercentTimeInAD                        : 50
EWSPercentTimeInCAS                       : 90
EWSPercentTimeInMailboxRPC                : 60
EWSMaxSubscriptions                       : 5000
EWSFastSearchTimeoutInSeconds             : 60
EWSFindCountLimit                         : 1000
IMAPMaxConcurrency                        :
IMAPPercentTimeInAD                       :
IMAPPercentTimeInCAS                      :
IMAPPercentTimeInMailboxRPC               :
OWAMaxConcurrency                         : 5
OWAPercentTimeInAD                        : 30
OWAPercentTimeInCAS                       : 150
OWAPercentTimeInMailboxRPC                : 150
POPMaxConcurrency                         : 20
POPPercentTimeInAD                        :
POPPercentTimeInCAS                       :
POPPercentTimeInMailboxRPC                :
PowerShellMaxConcurrency                  : 18
PowerShellMaxTenantConcurrency            :
PowerShellMaxCmdlets                      :
PowerShellMaxCmdletsTimePeriod            :
ExchangeMaxCmdlets                        :
PowerShellMaxCmdletQueueDepth             :
PowerShellMaxDestructiveCmdlets           :
PowerShellMaxDestructiveCmdletsTimePeriod :
RCAMaxConcurrency                         : 20
RCAPercentTimeInAD                        : 5
RCAPercentTimeInCAS                       : 205
RCAPercentTimeInMailboxRPC                : 200
CPAMaxConcurrency                         : 20
CPAPercentTimeInCAS                       : 205
CPAPercentTimeInMailboxRPC                : 200
MessageRateLimit                          :
RecipientRateLimit                        :
ForwardeeLimit                            :
CPUStartPercent                           : 75
AdminDisplayName                          :
ExchangeVersion                           : 0.10 (14.0.100.0)
Name                                      : DefaultThrottlingPolicy_cbce1f4f-569b-4e67-a6de-e1108c965915
DistinguishedName                         : CN=DefaultThrottlingPolicy_cbce1f4f-569b-4e67-a6de-e1108c965915,CN=Global S
                                            ettings,CN=CONTOSO,CN=Microsoft Exchange,CN=Services,CN=Configurati
                                            on,DC=CONTOSO,DC=local
Identity                                  : DefaultThrottlingPolicy_cbce1f4f-569b-4e67-a6de-e1108c965915
Guid                                      : e714da30-2efc-464f-877b-1e238e3a1d8d
ObjectCategory                            : CONTOSO.local/Configuration/Schema/ms-Exch-Throttling-Policy
ObjectClass                               : {top, msExchGenericPolicy, msExchThrottlingPolicy}
WhenChanged                               : 8/13/2013 11:46:36 AM
WhenCreated                               : 8/13/2013 11:46:36 AM
WhenChangedUTC                            : 8/13/2013 3:46:36 PM
WhenCreatedUTC                            : 8/13/2013 3:46:36 PM
OrganizationId                            :
OriginatingServer                         : CONTOSO-SERVER.CONTOSO.local
IsValid                                   : True
0
jrhelgesonCommented:
The user account is keeping too many connections open and/or opening/closing connections to the server at a rate that is rapid enough to be causing himself a denial-of-service.  A single Outlook session talking to a mailbox server generates x-amount of traffic, the rates are set so that if a user is sending 2x, no problem. This user is doing 5x.

I would create a new throttling policy and apply it to the user using the new-throttlingpolicy command.
See also get-help new-throttlingpolicy
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
CRush1682Author Commented:
Could this be explained by normal usage of Outlook with 5 different exchange mailboxes open, or should I be concerned that something else might be going on?  Also is a 5-15 minute period of Outlook not updating be reasonable expectation when someone is being throttled?

What should I configure specifically in the new throttlingpolicy.  I know that there are a few dozen parameters that can be throttled depending on the exact kind of communication, as per:

http://technet.microsoft.com/en-us/library/dd297964(v=exchg.141).aspx

Thanks in advance.
0
jrhelgesonCommented:
Yes, I'd start by doubling the numbers, and applying that one to all his profiles.
0
CRush1682Author Commented:
Update:  No user problems reported after re-configuring the throttling policies so far.  If no problems within 3 days I'll give you full credit for the fix!
0
jrhelgesonCommented:
If you could provide an updated output from get-throttlingpolicy, I'm sure that'll prove helpful for others.
0
CRush1682Author Commented:
Right on!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.