Event ID 10018 Access to this mailbox will be restricted to administrative logons for the next six hours

I have an issue with one employee's mailbox where in Outlook 2013 it is showing disconnected from the exchange server.  I tried accessing her email from OWA but it tells me it is unavailable.  When I look on the exchange 2010 server in the logs I see an error, Event ID 10018, Source MSExchangeIS, that states this specific mailbox has been quarantined.  Access to this mailbox will be restricted to administrative logons for the next six hours

I have another error in the logs next to this one, event ID 10027, Source MSExchangeIS, There are 5 RPC requests for this mailbox.  

Everyone else appears to be fine.
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Amit KumarCommented:
Please follow this article to check this issue:

What is Mailbox Quarantine?
Mailbox quarantine is a feature in the Exchange Server 2010 information store. Based on values in the registry, the store detects a mailbox or mailboxes that have the potential to or have caused the store to crash and quarantines them for specific period. The mailboxes that have the potential to crash the store are called Poisoned mailboxes.

Also check if your Exchange is running on Exchange 2010 SP2 and using SCOM as well. So as suggested by Microsoft please upgrade your exchange SP level to SP3. Please refer this guide.
PDISAuthor Commented:
Thank you for your quick response.  I had read that article but it's not really telling me how to troubleshoot the issue to keep it from happening.  I am running Exchange 2010 sp3 rollup 8-v2, I apologize, I should have included that in the initial question.
Amit KumarCommented:

This is something you will have to working with your storage and performance of Exchange server, mailbox get quarantined because of data corruption. You can find value how much time particular mailbox got quarantined by registry. You can go through with these articles


Isolating the Poison Mailbox

There are several types of events for which the Exchange store tags a mailbox as a potential threat:
If a thread doing work for that mailbox fails
If there are more than five threads in that mailbox that haven't made progress for a long time
A mailbox that's a potential threat is tagged, along with a count of how many times it has been tagged. This information is stored in the registry. The Exchange store also keeps timestamp information about when the mailbox was identified as a potential threat.

During a database mount, the Exchange store reads the time that the mailboxes were identified as potential threats. If more than two hours has elapsed, the registry key for the mailbox is deleted. The advantage of keeping this information in the registry is that in a high availability environment, it's replicated by the cluster database. Even during an Exchange store failover, the other computers have this information. The registry subkey that’s used to isolate the poison mailbox is HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeIS\<Server Name>\Private-{db guid}\QuarantinedMailboxes\{mailbox guid}. The keys for this path are CrashCount and LastCrashTime.

The settings for the amount of failures that lead to quarantining a mailbox and also for the amount of time that a mailbox should stay quarantined are stored in the MailboxQuarantineCrashThreshold and MailboxQuarantineDurationInSeconds keys in the HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeIS\<Server Name>\Private-{db guid} subkey.
The default values for these keys are three failures for MailboxQuarantineCrashThreshold and 21,600 seconds (six hours) for MailboxQuarantineDurationInSeconds.

Acting on the Poison Mailbox

By default, if a mailbox is identified as causing a failure or deadlock three times within two hours, the Exchange store tags it as quarantined in the registry. No access is allowed to the mailbox unless the OPEN_AS_ADMIN flag is passed. None of the Exchange processes (for example, content indexing or the Mailbox assistants) are allowed to log on. The QuarantineState and QuarantineTime registry keys keep track of whether the mailbox is quarantined. If the mailbox hasn't caused any failures in the last two hours and isn't quarantined, the registry path for the mailbox is cleaned up by the Exchange store. If a mailbox has been quarantined for longer than the MailboxQuarantineDurationInSeconds value since it’s LastCrashTime value, it's released from quarantine automatically.

Resetting the Quarantined Mailbox

When the cause of the poison mailbox has been identified and corrected, the registry key for the quarantined mailbox should be reset manually by deleting it. However, if this manual step is forgotten, the Exchange store automatically resets quarantined mailboxes six hours after the quarantined flag was set. If the issue isn't debugged and fixed within that time period, this may lead to another set of failures before the mailbox or message is quarantined again.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Email Servers

From novice to tech pro — start learning today.