We help IT Professionals succeed at work.

Exchange Event ID 1020 error

We keep getting the following error and the server it is referencing is no longer an Exchange server and has not been for awhile. Any assistance would be appreciated:

Log Name:      Application
Source:        MSExchange Store Driver
Date:          3/10/2015 6:54:09 AM
Event ID:      1020
Task Category: MSExchangeStoreDriver
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Titan.donald.com
Description:
The store driver couldn't deliver the public folder replication message "Folder Content Backfill

Response (APOLLO-IS@dwma.com)" because the following error occurred: Property validation failed.

Property = [{00020329-0000-0000-c000-000000000046}:'Keywords'] Categories
Error = Element 0 in the multivalue property is invalid...
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchange Store Driver" />
    <EventID Qualifiers="49156">1020</EventID>
    <Level>2</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-03-10T10:54:09.000Z" />
    <EventRecordID>287296</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Titan.donald.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>"Folder Content Backfill Response (APOLLO-IS@donald.com)"</Data>
    <Data>Property validation failed. Property =

[{00020329-0000-0000-c000-000000000046}:'Keywords'] Categories
Error = Element 0 in the multivalue property is invalid..</Data>
  </EventData>
</Event>
Comment
Watch Question

First question: Have you removed this server from the replication list for your public folders? The error message seems to indicate that the server is still on the replication list, but because it doesn't exist any more as an Exchange server, the replication message can't be delivered of course.

Author

Commented:
We did recently remove this server from the replication list. It was a Domain Controller that we made a member server now.  How do we update Exchange to this fact?
You can check the event viewer on the Exchange server for event ID 2080 to make sure the topology has been updated correctly.

Author

Commented:
I am sorry I should have written that we removed it from the replication list as far as a Domain Controller, not from the replication list for the public folders. Where exactly do we do that in Exchange 2010?
You can do it from the EMS or the EMC:

Using the shell, you want to navigate to the scripts folder (C:\Program Files\Microsoft\Exchange Server\V14\Scripts) and then run the following command for each top level folder:

.\RemoveReplicaToPFRecursive.ps1 –Server Exch2010 –TopPublicFolder \ –ServerToRemove OldServer

Using the management console, navigate to the public folders (Toolbox\Public Folder Management Console) and connect to the current server.  Then for each top level public folder, right click and go to Properties. On the Replication tab, remove the old server name.

Author

Commented:
"Using the management console, navigate to the public folders (Toolbox\Public Folder Management Console) and connect to the current server.  Then for each top level public folder, right click and go to Properties. On the Replication tab, remove the old server name."

I try doing this but when I try each top level public folder and right clicking, there isn't a Properties option. There is for the "Default Public Folders" above them and when I go to the Replication tab, there is just the current Exchange server listed only.
Sorry - it's a little bit non-intuitive.  In the left-hand panel, you have to select the Default Public Folders, and then right-click in the right-hand panel to see the Properties in the drop-down menu, like so:

See Properties of top-level public folders

Author

Commented:
It is okay. I did that though and it still only has the "current" Exchange server listed under the Replication tab.
OK, I assume you mean that the old server isn't on that list any more.  Check your message queue and delete any outstanding undelivered messages pertaining to public folder replication.  Then see if they come back again and post back with the results.

The next step, if that doesn't work, would be to edit AD using adsiedit.msc to get rid of any remaining traces of the older server as an Exchange server.

Author

Commented:
Right, the old server isn't list on that list any more. Okay, I am checking the message queue concerning public folder replication.

Author

Commented:
There were not any outstanding outstanding undelivered messages pertaining to public folder replication in the message queue.

Author

Commented:
It sounds like this is what is going on so if I go to this path and I delete the old object it should clear up? Should I see our current Exchange server in there?

http://blogs.technet.com/b/littusdsouza/archive/2012/09/13/public-folder-replication-between-exchagne-2007-and-exchange-2010-fails-with-1020-events.aspx
I haven't seen that particular article before, but it describes the cause and resolution for an Exchange 2003 to 2010 migration situation.  If that fits your configuration and the server that is causing the trouble was an Exchange 2003 server, then that article is exactly correct.  If the server you removed was an Exchange 2010 server, then you need to look for it in the "Exchange Administrative Group ([GUID])" container:

ADSIEdit Exchange

Author

Commented:
It does fit our configuration and I did it remove it but now we are getting:

Log Name:      Application
Source:        MSExchange ADAccess
Date:          3/12/2015 1:47:27 PM
Event ID:      2937
Task Category: Validation
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      Hermes.dwma.com
Description:
Process w3wp.exe () (PID=6844). Object [CN=Postmaster,OU=Users,OU=IT,OU=DWMA Departments,DC=dwma,DC=com]. Property [HomeMTA] is set to value [dwma.com/Configuration/Deleted Objects/Microsoft MTA
DEL:26bb8460-5062-4fdc-bcbe-62501478ee26], it is pointing to the Deleted Objects container in Active Directory. This property should be fixed as soon as possible.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchange ADAccess" />
    <EventID Qualifiers="32768">2937</EventID>
    <Level>3</Level>
    <Task>6</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-03-12T17:47:27.000Z" />
    <EventRecordID>288332</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Hermes.dwma.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>w3wp.exe ()</Data>
    <Data>6844</Data>
    <Data>CN=Postmaster,OU=Users,OU=IT,OU=DWMA Departments,DC=dwma,DC=com</Data>
    <Data>HomeMTA</Data>
    <Data>dwma.com/Configuration/Deleted Objects/Microsoft MTA
DEL:26bb8460-5062-4fdc-bcbe-62501478ee26</Data>
  </EventData>
</Event>
Looks like this has something to do with the MTA...I'm not an expert on this, but try looking at the solutions posted here:

http://www.eventid.net/display-eventid-2937-source-MSExchange%20ADAccess-eventno-10881-phase-1.htm

Author

Commented:
Okay, thank you for the link.