Sign in
 
Exchange Server TechCenter > Exchange Server Forums > Admin > Determine the Cause of Event ID: 9646
Ask a questionAsk a question
Search Forums:
 

AnswerDetermine the Cause of Event ID: 9646

  • Friday, November 06, 2009 7:53 PMExchangeFTW Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
    Hello-
    I've been getting the following Error Event Logged on my Exchange Server:


    Log Name:      Application
    Source:        MSExchangeIS
    Date:          11/6/2009 11:34:28 AM
    Event ID:      9646
    Task Category: General
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      ExchangeServer.IT.Domain.com
    Description:
    Mapi session "7839a926-1df2-432d-b959-197859f7e15c" exceeded the maximum of 500 objects of type "objtFolder".
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="MSExchangeIS" />
        <EventID Qualifiers="49158">9646</EventID>
        <Level>2</Level>
        <Task>6</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2009-11-06T19:34:28.000Z" />
        <EventRecordID>487020</EventRecordID>
        <Channel>Application</Channel>
     
        <Security />
      </System>
      <EventData>
        <Data>7839a926-1df2-432d-b959-197859f7e15c</Data>
        <Data>500</Data>
        <Data>objtFolder</Data>
        <Binary>5B444941475F4354585D000066000000FF2C3700000000000002580000003A67F01F070000003A67F01F070000003A67F01F02000000BD4420100000000003592010000000000359201000000000AD59201000000000ED4C201000000000FD45201000000000CD6A2010000000000359201000000000</Binary>
      </EventData>
    </Event>

    I'm trying to figure out how I can identify who is using that Mapi Session, and resolve the problem.

    Exchange 2007 Sp1 Enterprise Rollup Update 8
    SCC Cluster.
    Windows 2008 Enterprise Sp1

    Ms Forefront Security Installed.

    Please let me know if you have any suggestions.
    Thanks

    ExchangeFTW
     

Answers

All Replies

  • Friday, November 06, 2009 8:33 PMRajnish R Sharma Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Proposed Answer
    Sign In to Vote
    0
    Sign In to Vote
    Did you get a chance to look into this. I am not sure but probabaly the SMTP logs can help you to detect the user IP address.

    Also can you check the value of the registry HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\ParametersSystem\MaxObjsPerMapiSession\objtFolder and can you try changing this to above 500
    Raj
     
  • Friday, November 06, 2009 10:03 PMAndyD_MVPUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Proposed Answer
    Sign In to Vote
    0
    Sign In to Vote
    Download and install Exmon to help identify clients that are hammering the server.
    Dekstop Search Software can cause this as well.

    http://www.microsoft.com/downloads/details.aspx?FamilyId=9A49C22E-E0C7-4B7C-ACEF-729D48AF7BC9&displaylang=en

     
  • Sunday, November 08, 2009 7:48 PMMilind Naphade Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote

    Seems like you are already running on the recommended value of 500 connections per session. If you are curious to determine the reason why this event ID would appear here I would say it can be in application logs due to many reasons. The event description here is addressing a particular problem about the open folders per session. This can be due to outlook having some add ins installed which monitors mailbox or the outlook itself too. This can also be due to some application that uses MAPI sessions to retrieve emails or works with folders in mailbox.

    And to find out the culprits you should follow Andy's suggestion I believe. Let us know if we can be any help further.

    Milind Naphade | MCTS:M (Exchange 2007 and 2010) | http://www.msexchangegeek.com RSS Feed
     
  • Monday, November 09, 2009 8:06 AMXiu Zhang - MSFTMSFT, ModeratorUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Answer
    Sign In to Vote
    0
    Sign In to Vote

    Hi,

     

    You can run the following cmdlt to find the mailbox.

     

    get-mailbox -ResultSize unlimited | where {$_.ExchangeGuid -eq " 7839a926-1df2-432d-b959-197859f7e15c"}

     

    Also you can use LDP.exe to find the mailbox, detail information you can check the article below:

     

    The description of the event ID 9646 message includes a GUID instead of a recipient name

    http://support.microsoft.com/kb/899663

     

    An Exchange 2007 Server Stops Responding to a MAPI Client

    http://technet.microsoft.com/en-us/library/bb676486.aspx


    Also please verify if you have blackberry or mobility user.
     

    Regards,

    Xiu