DOCUMENT:Q259578 06-AUG-2002 [exchange] TITLE :XADM: Event ID 11/1023 Appear When Starting Exchange Event Svc PRODUCT :Microsoft Exchange PROD/VER:winnt:5.5 OPER/SYS: KEYWORDS:exc55 ====================================================================== ------------------------------------------------------------------------------- The information in this article applies to: - Microsoft Exchange Server, version 5.5 ------------------------------------------------------------------------------- SYMPTOMS ======== Event ID 11 is logged in the application event log soon after you start the Microsoft Exchange Event Service. Event ID 1023 is logged immediately after the Event Service starts. It may take approximately one minute for the Event ID 11 to appear in the application event log. In some cases, the Event 1023 and (or) 11 does not appear at all. The circumstances under which one or more of the events is not generated are listed in the "More Information" section of this article. The events look similar to the following: Event ID: 1023 Source: MSExchangeIS Private Type: Failure Audit Category: Logons Description: Domain\ServiceAccount was validated as /o=ORG1/ou=mysite/cn=Configuration/cn=Servers/cn=MBS-MAIL-03/cn=Microsoft System Attendant but was unable to log on to /o=ORG1/ou=mysite/cn=Recipients/cn=user-3. Event ID: 11 Source: MSExchangeES Type: Error Category: General Description: A fatal error (0x8004011d) occurred in an IExchangeEventSink while processing message [Subject = "xxx"]. CAUSE ===== The events are harmless and are generated when you delete a mailbox or public folder without first removing a published Event Script from the mailbox or public folder. For example, if you publish a script to the inbox of a mailbox, and you delete the mailbox without first removing the published script, Exchange continues attempting to monitor the inbox of this non-existent mailbox. Every time that you start the Event Service, Exchange searches the inbox of the non-existent mailbox. This causes the Event ID 11 and 1023 to occur. RESOLUTION ========== To resolve this issue: - Remove and re-install the Exchange Event Service. -or- - Use the Mdbvu32 program from the Exchange 5.5 CD-ROM to access the Event Config folder for the server where the Event Service is installed. From the Event Config folder, remove the published scripts and the references to the non-existent folders where the scripts were originally published. Mdbvu32.exe can be found on the Exchange 5.5 CD-ROM in the Server\Support\Utils\I386 directory. You can run the tool directly from the CD-ROM or you can copy the following files to a specific directory and run Mdbvu32 from that directory: Mdbvu32.exe, Propvu32.dll, Statvu32.dll, Tblvu32.dll, Xvport.dll To keep the events from occurring, two types of messages must be deleted from the Event Config folder. One message contains the name of the folder where the script was published, and the other message contains the name given to the Agent that is running the script in this folder. Follow the steps below to purge the information in the Event Config folder which is causing the Event ID 11 to be generated. This tool can be run from any NT machine as long as the Microsoft Outlook client is installed: 1. Log on to the NT server with the Exchange Service Account. 2. Create an Outlook profile that logs on to a mailbox that resides on the Exchange Server computer on which the Event Service is installed. Also, in the Exchange Server Administrator program, go to Folders, System Folders, Events Root, EventConfig_Servername (where servername is the name of the server that the event service resides on). Highlight this folder, click File, and then click Properties. On the General tab, click the Client Permissions button. You must now assign the mailbox you chose Owner permissions for to the folder. 3. Double-click the Mdbvu32.exe program, and click OK to the MAPILogonEx(MAPI_LOGON_UI) prompt that appears. 4. Choose the appropriate Outlook profile to use, and click OK. 5. From the MDB Viewer Test Application window, choose MDB\Open Message Store. 6. Highlight Public Folders, and then click Open. 7. Choose MDB\Open Root Folder, and click OK to the three error messages that appear. 8. Double-click NON_IPM_SUBTREE under Child Folders. 9. Double-click Events Root under Child Folders. 10. Click OK to the two error messages that appear. 11. Double-click EventConfig Server_Name under Child Folders. 12. Under Messages in Folder, you see the Display Names of the Agents/Scripts and the folders where these scripts were published. For example, if a script was published to the inbox of a mailbox, and the Agent/Script was given the name of MB AGENT, you see the information listed as follows under Messages in Folder. If the script was published to a public folder, you would see the name of the public folder rather than "\Inbox": \Inbox MB AGENT 13. If a script was published to the inbox of more than one mailbox, you see multiple instances of "\Inbox." Also, if you have more than one Agent/Script with the same name, you see more than one instance of this Agent name in the list. To find out which entries belong to the non-existent mailbox, you must double-click each entry to determine which mailbox it belongs to. 14. Double-click the public folder name or name of the mailbox folder such as "\Inbox" in the list. Under Message Properties, look for a hexadecimal value of "0x3FF8." This value lists the Display Name of the mailbox being referenced. If the Display Name matches the Display Name of the deleted mailbox, choose Close, make sure the highlight is still on the selection that you wish to delete, click the drop-down arrow next to Call Function, choose the lpFld-> DeleteMessages() option, click the Call Function button, and then click OK. The "\Inbox" entry should disappear from the list. Follow the same procedures above for finding and deleting the Agent/Script entry which references the deleted mailbox or public folder. 15. To exit Mdbvu32, continue to choose Close until the MDB Viewer Test Application window is displayed. Close this window, click OK to the lpMDB->StoreLogoff() prompt, and then click OK to the very next prompt. If you purge all items that reference the non-existent public folder or mailbox, the Event ID 11 and 1023 will no longer occur. MORE INFORMATION ================ The Event ID 1023 only appear when a script has been published to a mailbox that is then deleted. The 1023 event is generated as a result of the System Attendant attempting to log in to the private information store of the deleted mailbox. In some cases, when a public folder has been deleted without first removing the script, the Event ID 11 will sometimes occur only once, not at all, or only the following event may be logged in the application log: Event ID: 5 Source: MSExchangeES Type: Error Category: General Description: An unexpected MAPI error occurred. Error returned was (0x8004010f). Additional query words: Event ID 5 ====================================================================== Keywords : exc55 Technology : kbExchangeSearch kbExchange550 kbZNotKeyword2 Version : winnt:5.5 Issue type : kbprb ============================================================================= THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. Copyright Microsoft Corporation 2002.