Re: Excessive Event ID 9646 in Exchange 2003

Tech-Archive recommends: Fix windows errors by optimizing your registry

That's a much better answer that goes to determining root cause and fixing
it. A 9646 can be logged if the message limits, attachment limits, or
session limits are exceeded. In the original post, it was session limits
that were exceeded. The steps for using ESM to view open attachments, open
messages, and logins, should indeed help indicate which clients are
experiencing the issue. In this case, it's the logins we're worried about.

In addition to applications (desktop search, blackberry, etc), outlook
add-ins, or scripts, network connectivity issues can also cause you to
exceed the session object limit if the session is lost and an new one
established mutiple times within the session timeout period. Don't rule out
connectivity in your searce for the source. I have seen this happen mostly
in situations where there is a VPN client used to access the protected
network or someone has mucked around with the MTU size.


"Terence Liu [MSFT]" <v-terliu@xxxxxxxxxxxxxxxxxxxx> wrote in message
news:e494lkj5HHA.4200@xxxxxxxxxxxxxxxxxxxxxxxxx
Hello Jason,

Thank you for your reply.

This issue occurs because of a limit on the number of items that clients
can open. By default, this limit is set to 100 for attachments and 250 for
messages.

To determine which item from the following list is causing these items to
remain open in the client:

A program
An Outlook add-in
A script or batch file

To determine what user or set of users may be reaching this upper limit,
follow these steps:

1. Click Start, point to All Programs, point to Microsoft Exchange, and
then click System Manager.
2. If Administrative Groups is listed, expand Administrative Groups, and
then expand First Administrative Group. If Administrative Groups does not
appear, go to step 3.
3. Expand Servers, expand your Exchange computer, expand First
Administrative Group, and then expand Mailbox Store.
4. Click Logons, click the View menu, and then click Add/Remove Columns.
5. In the Available columns dialog box, click Open Messages, and then
click Add.
6. In the Available columns dialog box, click Open Attachments, click
Add,
and then click OK.
7. Click Logons, click the Action menu, click Export list, type the name
of the Mailbox Store in the Save As dialog box, and then click Text (Comma
Delimited)(*.csv) and Save in the Save as type drop-down box.
8. Repeat this process for each Mailbox Store.


After the data is collected, follow these steps: .
1. Open the files in Microsoft Excel.
2. Sort each column.

Then, compare each column with the default values that are listed in
Knowledge Base article 830829. If any user is reaching these limits, we
recommend that you visit that user's computer to determine what the user
may be doing to cause these objects to remain open.

Your Exchange Server 2003 computer may stop responding after a MAPI client
opens more than the default value of certain server objects
http://support.microsoft.com/?id=830829

As mentioned previously, this problem may be caused by a program that
integrates with Outlook, with an Outlook add-in, or with a batch file or
script that is running against the mailbox.

As a further troubleshooting step, remove or disable any third-party
Outlook add-in and antivirus software on the client computer. Then, verify
the results of the server again to ensure that these objects are no longer
open.

I hope these steps will give you some help.

Thanks and have a nice day!

Best regards,

Terence Liu(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check
the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In
doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no
rights.

--------------------
| Date: Thu, 23 Aug 2007 14:31:47 -0500
| From: Jason <jerdmann83@xxxxxxxxxxxxxxxx>
| Reply-To: jerdmann83@xxxxxxxxxxxxxxxx
| User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
| MIME-Version: 1.0
| Subject: Re: Excessive Event ID 9646 in Exchange 2003
| References: <OeGZ4TE5HHA.4880@xxxxxxxxxxxxxxxxxxxx>
<O8OudSI5HHA.5844@xxxxxxxxxxxxxxxxxxxx>
<OMVM9ON5HHA.2108@xxxxxxxxxxxxxxxxxxxx>
<nG2Hh6S5HHA.6140@xxxxxxxxxxxxxxxxxxxxxx>
<eENmELb5HHA.3900@xxxxxxxxxxxxxxxxxxxx>
| In-Reply-To: <eENmELb5HHA.3900@xxxxxxxxxxxxxxxxxxxx>
| Content-Type: text/plain; charset=ISO-8859-1; format=flowed
| Content-Transfer-Encoding: 7bit
| Message-ID: <exT9$wb5HHA.5980@xxxxxxxxxxxxxxxxxxxx>
| Newsgroups: microsoft.public.exchange.admin
| NNTP-Posting-Host: fw01.tradingtechnologies.com 65.199.113.40
| Lines: 1
| Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP04.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.exchange.admin:40965
| X-Tomcat-NG: microsoft.public.exchange.admin
|
| Yeah, I agree. Why arbitrarily increase the maximum number of MAPI
| sessions per user? Wasn't this limit introduced to help prevent DoS
| issues on the Exchange server?
|
| John Fullbright wrote:
| > That raises the limit and does not necessarially address the core
issue.
| > Sounds like a workaround.
| >
| >
| > "Terence Liu [MSFT]" <v-terliu@xxxxxxxxxxxxxxxxxxxx> wrote in message
| > news:nG2Hh6S5HHA.6140@xxxxxxxxxxxxxxxxxxxxxxxxx
| >> Hello Jason,
| >>
| >> Thank you for posting here, and thanks for Thierry's inputs.
| >>
| >> According to your description, I understand that you get event error
9646
| >> about MSExchangeIS on your SBS. If I have misunderstood the problem,
| >> please
| >> don't hesitate to let me know.
| >>
| >> Based on my research, I suggest we try the following steps to see if
we
| >> can
| >> resolve this issue:
| >>
| >> 1. On the Exchange 2003 computer, click Start, click Run, type
regedit in
| >> the Open box, and then click OK.
| >> 2. Locate and then click the following registry key:
| >>
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\Parameters
| >> System
| >> 3. On the Edit menu, point to New, and then click Key.
| >> 4. Type MaxObjsPerMapiSession , and then press ENTER.
| >> 5. For each object type that is listed in the event ID 9646 message
(in
| >> the "Symptoms" section of this article, the example object types are
| >> objtMessage and objtAttachment), follow these steps:
| >>
| >> a. On the Edit menu, point to New, and then click DWORD Value.
| >> b. Type the object name (for example, type objtMessage ), and then
press
| >> ENTER.
| >> c. Press ENTER again to open the Edit DWORD Value dialog box, type
500 in
| >> the Value data box, and then click OK.
| >>
| >> 6. Close Registry Editor.
| >>
| >> If you use Outlook 2007 to connect your Exchange server, please
perform
| >> the
| >> steps in the following KB:
| >> Event ID 9646 is logged in the application event log of your Exchange
| >> Server 2003 computer when a client opens many MAPI sessions
| >> http://support.microsoft.com/?id=842022
| >>
| >> I hope these steps will give you some help.
| >>
| >> Thanks and have a nice day!
| >>
| >> Best regards,
| >>
| >> Terence Liu(MSFT)
| >>
| >> Microsoft CSS Online Newsgroup Support
| >>
| >> Get Secure! - www.microsoft.com/security
| >>
| >> =====================================================
| >> This newsgroup only focuses on SBS technical issues. If you have
issues
| >> regarding other Microsoft products, you'd better post in the
corresponding
| >> newsgroups so that they can be resolved in an efficient and timely
manner.
| >> You can locate the newsgroup here:
| >> http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
| >>
| >> When opening a new thread via the web interface, we recommend you
check
| >> the
| >> "Notify me of replies" box to receive e-mail notifications when there
are
| >> any updates in your thread. When responding to posts via your
newsreader,
| >> please "Reply to Group" so that others may learn and benefit from
your
| >> issue.
| >>
| >> Microsoft engineers can only focus on one issue per thread. Although
we
| >> provide other information for your reference, we recommend you post
| >> different incidents in different threads to keep the thread clean. In
| >> doing
| >> so, it will ensure your issues are resolved in a timely manner.
| >>
| >> For urgent issues, you may want to contact Microsoft CSS directly.
Please
| >> check http://support.microsoft.com for regional support phone
numbers.
| >>
| >> Any input or comments in this thread are highly appreciated.
| >> =====================================================
| >>
| >> This posting is provided "AS IS" with no warranties, and confers no
| >> rights.
| >>
| >> --------------------
| >> | Date: Wed, 22 Aug 2007 10:47:24 -0500
| >> | From: Jason <jerdmann83@xxxxxxxxxxxxxxxx>
| >> | Reply-To: jerdmann83@xxxxxxxxxxxxxxxx
| >> | User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
| >> | MIME-Version: 1.0
| >> | Subject: Re: Excessive Event ID 9646 in Exchange 2003
| >> | References: <OeGZ4TE5HHA.4880@xxxxxxxxxxxxxxxxxxxx>
| >> <O8OudSI5HHA.5844@xxxxxxxxxxxxxxxxxxxx>
| >> | In-Reply-To: <O8OudSI5HHA.5844@xxxxxxxxxxxxxxxxxxxx>
| >> | Content-Type: text/plain; charset=ISO-8859-1; format=flowed
| >> | Content-Transfer-Encoding: 7bit
| >> | Message-ID: <OMVM9ON5HHA.2108@xxxxxxxxxxxxxxxxxxxx>
| >> | Newsgroups: microsoft.public.exchange.admin
| >> | NNTP-Posting-Host: fw01.tradingtechnologies.com 65.199.113.40
| >> | Lines: 1
| >> | Path:
TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP02.phx.gbl
| >> | Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.exchange.admin:40799
| >> | X-Tomcat-NG: microsoft.public.exchange.admin
| >> |
| >> | No, there's no virus or anything like that. Everything else runs
just
| >> | fine. As I stated before, this error occurs for every one of our
users
| >> | at some point, so it's not as though one user is abusing his email
| >> | privileges or has an infected machine.
| >> |
| >> | Any other ideas? Thanks.
| >> |
| >> | Thierry Frache wrote:
| >> | > Hi Jason,
| >> | >
| >> | > http://support.microsoft.com/kb/830836 Event ID 9646 is logged
when
| >> you
| >> try
| >> | > to send many messages in Exchange Server 2003
| >> | >
| >> | > Are you sure your computers are not infected by a virus or
something
| >> like
| >> | > that ? Check (and enable if needed) the message tracking to try
to
| >> identify
| >> | > if the messages are sent to the Internet.
| >> | >
| >> | > Thierry
| >> | >
| >> | > "Jason" <jerdmann83@xxxxxxxxxxxxxxxx> wrote in message
| >> | > news:OeGZ4TE5HHA.4880@xxxxxxxxxxxxxxxxxxxxxxx
| >> | >> We have been experiencing nonstop Event ID 9646's on our
Exchange
| >> server.
| >> | >> They occur roughly once every 10 minutes or so, and there's no
| >> pattern
| >> to
| >> | >> the users it occurs from that I can see. All of our desktops
are
on
| >> a
| >> | >> VLAN; the Exchange server is on a separate VLAN. There's no
firewall
| >> or
| >> | >> anything between the desktops and Exchange.
| >> | >>
| >> | >> We are running Exchange Server 2003 SP2 with a mix of Outlook
2003
| >> and
| >> | >> 2007 clients, all on Win XP Pro SP2. The Exchange server is
running
| >> Win
| >> | >> 2k3 SP1.
| >> | >>
| >> | >> This is the error we're seeing.
| >> | >>
| >> | >> Event Type: Error
| >> | >> Event Source: MSExchangeIS
| >> | >> Event Category: General
| >> | >> Event ID: 9646
| >> | >> Date: 8/10/2007
| >> | >> Time: 8:57:07 AM
| >> | >> User: N/A
| >> | >> Computer: <ExchangeServer>
| >> | >> Description:
| >> | >> Mapi session
"/O=SomeOU/OU=SomeOtherOU/cn=Recipients/cn=SomeUser"
| >> exceeded
| >> | >> the maximum of 32 objects of type "session".
| >> | >>
| >> | >> For more information, click
| >> http://www.microsoft.com/contentredirect.asp.
| >> | >>
| >> | >> For more information, see Help and Support Center at
| >> | >> http://go.microsoft.com/fwlink/events.asp.
| >> | >>
| >> | >> I've read that people have seen this exact problem when clients
are
| >> | >> connecting to Exchange from a remote site through a Netscreen
| >> firewall, if
| >> | >> that helps. However, we don't have a firewall between our
Exchange
| >> server
| >> | >> and the users, just a Cisco switch. Any ideas on what could be
| >> causing
| >> | >> this? Thanks!
| >> | >
| >> | >
| >> |
| >>
| >
| >
|



.

Relevant Pages

  • Re: Vista / office 2007 - companyweb
    ... I have tested it with a freshly installed client and it works fine. ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ... folder still opens fine without password. ...
    (microsoft.public.windows.server.sbs)
  • Re: Vista / office 2007 - companyweb
    ... "This folder cannot be opened in Internet Explorer - You can view this folder ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ... folder still opens fine without password. ...
    (microsoft.public.windows.server.sbs)
  • RE: Outlook 2003 Attachments while connected to Windows 2003 SBS S
    ... An e-mail message attachment opens as read-only if you open the attachment ... Microsoft Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ... When opening a new thread via the web interface, we recommend you check the ...
    (microsoft.public.windows.server.sbs)
  • Re: RWW question - SBS2003 Standard
    ... just feel free to post in the newsgroup. ... Microsoft CSS Online Newsgroup Support ... please understand that all RWW sessions relies on both ... If yes, the RDP session will not be opened in IE, instead, it ...
    (microsoft.public.windows.server.sbs)
  • Re: Vista / office 2007 - companyweb
    ... opens fine. ... In Microsoft Windows Explorer, ... Set the Companyweb site to Anonymous and Windows Integrated in IIS, ... This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)