none
Event ID 2915: [User] has gone over budget

    Question

  • I'm seeing this error on our Exchange 2010 server event log and trying to figure out why a user would be hitting the server over 100 times in a minute. Every reference i find (including a thread here on TechNet) says to change the max concurrency to null. I don't want to disable throttling, I want to know why these users are hitting the box like this.

     

    ============

    Log Name:      Application

    Source:        MSExchange ADAccess

    Date:          4/7/2011 11:05:14 AM

    Event ID:      2915

    Task Category: General

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      server

    Description:

    Process Microsoft.Exchange.RpcClientAccess.Service.exe (PID=2788). User 'user' has gone over budget '109' times for component 'RCA' within a one minute period. Info: 'Policy:DefaultThrottlingPolicy_82c6efd6-110a-4584-b50c-3f2fb749b0cd, Parts:CAS:108;'. Threshold value: '100'.

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="MSExchange ADAccess" />

        <EventID Qualifiers="49152">2915</EventID>

        <Level>2</Level>

        <Task>1</Task>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2011-04-07T16:05:14.000000000Z" />

        <EventRecordID>141780</EventRecordID>

        <Channel>Application</Channel>

        <Computer></Computer>

        <Security />

      </System>

      <EventData>

        <Data>Microsoft.Exchange.RpcClientAccess.Service.exe</Data>

        <Data>2788</Data>

        <Data>user</Data>

        <Data>109</Data>

        <Data>RCA</Data>

        <Data>Policy:DefaultThrottlingPolicy_82c6efd6-110a-4584-b50c-3f2fb749b0cd, Parts:CAS:108;</Data>

        <Data>100</Data>

      </EventData>

    </Event>

     

    ============

    Anyone found a solution to this yet? Thanks.


    Thursday, April 07, 2011 8:07 PM

Answers

  • What does 'gone over budget' mean ? (is it allowing a percentage overhead or something??)

    it means the same thing as when you've gone over your personal budget - more resources (or $$, for our analogy) are attempting to be used (or spent, analogy again) than are available (AKA the bank is empty). Luckily, you can change this (at least more easily than your bank account) by creating a new throttling policy and assigning this user to the policy (which is better than changing the default policy used by all...)

     

    http://blogs.msdn.com/b/pepeedu/archive/2010/01/13/exchange-2010-client-access-throttling.aspx has the clearest description I've seen that explains the situation you're in. Good luck.


    Missy
    • Marked as answer by Keith Work Tuesday, July 26, 2011 6:11 PM
    Monday, June 20, 2011 4:10 PM

All replies

  • Does he have any Outlook add-ins like synchronization software or some such?
    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
    Thursday, April 07, 2011 10:30 PM
  • Does the user open additional mailboxes?  If so, how many?
    Peter O'Dowd
    Thursday, April 07, 2011 11:01 PM
  • Only add-in is for Live Meeting. And I don't believe the user opens more than one mailbox but that shouldn't be a problem, right? What are you thinking?
    • Proposed as answer by Hakan91 Tuesday, November 08, 2011 9:06 PM
    Monday, April 11, 2011 1:08 PM
  • Hi Keith,

    Which version of Outlook do the user use? Outook 2003 or 2010?

    Please run the cmdlet Get-ThrottlingPolicy | FL RCA* and Get-LogonStatistics "user" | fl applicationid.

    Please check whether the user open multiple shared calendars, has many delegate mailboxes or the account that is used to access multiple Exchange 2010 mailboxes such as a BES service account.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Frank.Wang Friday, April 15, 2011 1:12 AM
    • Unmarked as answer by Keith Work Friday, April 15, 2011 7:35 PM
    • Marked as answer by Jeff RenModerator Wednesday, April 27, 2011 8:04 AM
    • Unmarked as answer by Jeff RenModerator Wednesday, April 27, 2011 9:11 AM
    Wednesday, April 13, 2011 6:46 AM
  • Thanks for the help Frank. The user doesn't have anything unusual as far as activity, shared calendars, delegates, etc. And his account is not used as a service account anywhere.
    [PS] C:\Windows\system32>Get-ThrottlingPolicy | fl RCA*
    RCAMaxConcurrency          : 20
    RCAPercentTimeInAD         : 5
    RCAPercentTimeInCAS        : 205
    RCAPercentTimeInMailboxRPC : 200
    RCAMaxConcurrency          :
    RCAPercentTimeInAD         :
    RCAPercentTimeInCAS        :
    RCAPercentTimeInMailboxRPC :
    [PS] C:\Windows\system32>get-logonstatistics [user] | fl applicationid
    ApplicationId : Client=MSExchangeRPC
    ApplicationId : Client=MSExchangeRPC
    ApplicationId : Client=MSExchangeRPC
    ApplicationId : Client=MSExchangeRPC
    ApplicationId : Client=MSExchangeRPC
    ApplicationId : Client=MSExchangeRPC
    ApplicationId : Client=WebServices;UserAgent=Microsoft+Office+Communicator/3.0

    Friday, April 15, 2011 7:35 PM
  • I got this error for the first time on our Exchange 2010 server and I have been running 2010 for 10 months now.  Happened one time at 7pm last night so probably from home.

    Process w3wp.exe () (PID=3328). User 'Sid~network/user~EWS~false' has gone over budget '1106' times for component 'EWS' within a one minute period. Info: 'Policy:DefaultThrottlingPolicy_73d43045-2e5c-4efc-9369-1ffa5efc89e3, Parts:CAS:1105;'. Threshold value: '100'.

    I ran the code had have the following

    RCAMaxConcurrency          : 20
    RCAPercentTimeInAD         : 5
    RCAPercentTimeInCAS        : 205
    RCAPercentTimeInMailboxRPC : 200
    RCAMaxConcurrency          :
    RCAPercentTimeInAD         :
    RCAPercentTimeInCAS        :
    RCAPercentTimeInMailboxRPC :
    [PS] C:\Windows\system32>get-logonstatistics [user] | fl applicationid
    ApplicationId : Client=CI
    ApplicationId : Client=WebSErvices;UserAgent=MAC OS X/10.6.7 <10J869>; <ExchangeWEbServices/1.3 <61>; ical/4.04 ,<1395.7>
    ApplicationID:  Client=CI
    ApplicationId : Client=WebSErvices;UserAgent=MAC OS X/10.6.7 <10J869><ExchangeWEbServices/1.3 <61>; ical/4.5 ,<1084>
    ApplicationID:  Client=CI
    ApplicationId : Client=WebSErvices;UserAgent=MAC OS X/10.6.7 <10J869><ExchangeWEbServices/1.3 <61>; ical/4.5 ,<1084>
    ApplicationID:  Client=CI
    ApplicationId : Client=WebSErvices;UserAgent=MAC OS X/10.6.7 <10J869><ExchangeWEbServices/1.3 <61>; ical/4.5 ,<1084>

    Ideas?

     

    Friday, May 13, 2011 4:13 PM
  • I'm seeing the same thing for one user in my network.  She normally does access two mailboxes, but in this case its her own mailbox with this error.
    Monday, June 20, 2011 2:54 PM
  • With a bit of analysis, and reading http://technet.microsoft.com/en-us/library/dd297964.aspx

    I can see I have an option to create a second policy for this type of user, but I'm unsure of some things.

    1) The error I get says:

    Process Microsoft.Exchange.RpcClientAccess.Service.exe (PID=2200). User 'Sid~<user>~RCA~false' has gone over budget '179' times for component 'RCA' within a one minute period. Info: 'Policy:DefaultThrottlingPolicy_0281dc8a-9786-4f21-867a-28f8ece41697, Parts:MaxConcurrency:178;'. Threshold value: '100'.

    yet if I do a Get-LogonStatistics <user> I get 69 lines back, suggesting only 69 connections.

    But the Get-ThrottlingPolicy command shows:

    RCAMaxConcurrency                         : 20
    RCAPercentTimeInAD                        : 5
    RCAPercentTimeInCAS                       : 205
    RCAPercentTimeInMailboxRPC                : 200
    CPAMaxConcurrency                         : 20
    CPAPercentTimeInCAS                       : 205
    CPAPercentTimeInMailboxRPC                : 200

     

    So where is the 100 limit coming from ??
    How long do they last for ?

    What does 'gone over budget' mean ? (is it allowing a percentage overhead or something??)

     

    And - how can I disconnect sessions for that specific user?

    She was on Office 2003, and I've now upgraded her to office 2007, hoping that helps, but it still can't connect as the old sessions are still there.

    Monday, June 20, 2011 3:48 PM
  • What does 'gone over budget' mean ? (is it allowing a percentage overhead or something??)

    it means the same thing as when you've gone over your personal budget - more resources (or $$, for our analogy) are attempting to be used (or spent, analogy again) than are available (AKA the bank is empty). Luckily, you can change this (at least more easily than your bank account) by creating a new throttling policy and assigning this user to the policy (which is better than changing the default policy used by all...)

     

    http://blogs.msdn.com/b/pepeedu/archive/2010/01/13/exchange-2010-client-access-throttling.aspx has the clearest description I've seen that explains the situation you're in. Good luck.


    Missy
    • Marked as answer by Keith Work Tuesday, July 26, 2011 6:11 PM
    Monday, June 20, 2011 4:10 PM
  • And - how can I disconnect sessions for that specific user?

    She was on Office 2003, and I've now upgraded her to office 2007, hoping that helps, but it still can't connect as the old sessions are still there.

    You can disable MAPI connections for the user, and then re-enable them to see if that will help.

    set-casmailbox -identity <user name> -MAPIenabled $false

    set-casmailbox -identity <user name> -MAPIenabled $true


    Missy
    Tuesday, June 21, 2011 7:41 PM
  • I just noticed this event occurred on a user mailbox I was configuring access to on a MAC Client (Office 2011).

    I remember I checked "Auto config" in Outlook 2011 but I cancelled it after 2 minutes when I realized auto config didn't worked and then configured the server settings manually. Also there were probable simultaneous connections to the user mailbox from Windows client and an iPhone at the same time.


    Monday, June 27, 2011 12:06 PM
  • Check the iPhone OS verson and be sure it's at the latest version.  The early releases of 4 really beat on the server.
    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
    Monday, June 27, 2011 3:37 PM
  • Check the iPhone OS verson and be sure it's at the latest version.  The early releases of 4 really beat on the server.
    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."


    And I guarantee that Ed has never gone over budget on anything!   :P

     

     

    Monday, June 27, 2011 3:40 PM
    Moderator
  • Check the iPhone OS verson and be sure it's at the latest version.  The early releases of 4 really beat on the server.
    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."


    And I guarantee that Ed has never gone over budget on anything!   :P

     

     


    I would not bet against you there!!
    Missy
    Monday, June 27, 2011 6:38 PM
  • Hello,

    I used to receive event id 2915 with similar error message

    "Process Microsoft.Exchange.RpcClientAccess.Service.exe (PID=2788). User 'user' has gone over budget '109' times for component 'RCA' within a one minute period. Info: 'Policy:DefaultThrottlingPolicy_82c6efd6-110a-4584-b50c-3f2fb749b0cd, Parts:CAS:108;'. Threshold value: '100'".

    Now I still see event id 2915 but with this following message: -

    Any ideas why it has changed?

    Log Name:      Application
    Source:        MSExchange ADAccess
    Date:          7/18/2011 6:18:34 PM
    Event ID:      2915
    Task Category: General
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      casserver.company.com
    Description:
    The description for Event ID 2915 from source MSExchange ADAccess cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

    If the event originated on another computer, the display information had to be saved with the event.

    The following information was included with the event:

    w3wp.exe ()
    2652
    Sid~domain\habe02~OWA~false
    20
    OWA
    Policy:DefaultThrottlingPolicy_ad4c5cd5-f733-49e4-8057-9d11ceaa85f8, Parts:CAS:19;
    10

    The handle is invalid

    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="MSExchange ADAccess" />
        <EventID Qualifiers="49152">2915</EventID>
        <Level>2</Level>
        <Task>1</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2011-07-18T23:18:34.000000000Z" />
        <EventRecordID>726066</EventRecordID>
        <Channel>Application</Channel>
        <Computer>casserver.company.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>w3wp.exe ()</Data>
        <Data>2652</Data>
        <Data>Sid~domain\habe02~OWA~false</Data>
        <Data>20</Data>
        <Data>OWA</Data>
        <Data>Policy:DefaultThrottlingPolicy_ad4c5cd5-f733-49e4-8057-9d11ceaa85f8, Parts:CAS:19;</Data>
        <Data>10</Data>
      </EventData>
    </Event> 


    Raman
    Monday, July 18, 2011 11:32 PM
  • Did you read the link I posted above?
    Missy
    Tuesday, August 30, 2011 7:55 PM
  • Hello MissyKos,

    I did read it and I am aware of throttling policy and I did make the requirement adjustments during the Exchange 2010 setup.

    The error message I am seeing is different with same event id.

    "The description for Event ID 2915 from source MSExchange ADAccess cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer".

    Although, I do not seeing any issues but this event id appears on CAS servers.

    I was wondering if anyone has seen anything similar.

    Thanks,

     

     


    Raman
    Wednesday, August 31, 2011 5:21 PM
  • Does anyone have recommended settings for a throttling policy with thresholds that will not be exceeded for heavy-user profiles that are running Mac Clients?

    We have a large Mac OSX user base, mostly 10.6, some leftover 10.5, and some new testing of 10.7 for future deployment. Clients split between MacMail and Outlook 2011.

    Both clients use Exchange Web Services - we see alot of 2915 MSExchADAccess errors in the application log saying that users have exceeded the throttling policy. I have experimented with an alternate policy, I can find the powershell commands to create, manage, and apply to user for a policy, I just need a resource explaining how these settings work and how to come up with a working throttling policy for mac users.

    Servers are Exchange 2010 SP1 now up to rollup 5.   2 CAS/HT servers using NLB, 2 mailbox servers for 1 DAG, 10 databases.  OS is Windows 2008 R2 Entperise.

    • Proposed as answer by nicowagner Wednesday, January 18, 2012 11:21 AM
    • Unproposed as answer by nicowagner Wednesday, January 18, 2012 11:22 AM
    Wednesday, October 19, 2011 5:36 PM
  • Hi guys,

    I have the same issue couple days ago with same error:
    Process w3wp.exe () (PID=3328). User 'Sid~network/user~EWS~false' has gone over budget '1106' times for component 'EWS' within a one minute period. Info: 'Policy:DefaultThrottlingPolicy_73d43045-2e5c-4efc-9369-1ffa5efc89e3, Parts:CAS:668;'. Threshold value: '100'.

    I did a Get-LogonStatistics "user" | fl applicationid on the powershell comannd and this is the result of the user:

    Creating a new session for implicit remoting of "Get-LogonStatistics" command...


    ApplicationId : Client=CI

    ApplicationId : Client=MSExchangeRPC

    ApplicationId : Client=CI

    ApplicationId : Client=WebServices;UserAgent=Mac OS X/10.7.2 (11C74); ExchangeWebServices/2.0 (123); Mail/5.1 (1251)

    ApplicationId : Client=CI

    ApplicationId : Client=CI

    ApplicationId : Client=WebServices;UserAgent=Mac OS X/10.7.2 (11C74); ExchangeWebServices/2.0 (123); Mail/5.1 (1251)

    ApplicationId : Client=CI

    ApplicationId : Client=MSExchangeRPC;COW=Delegate

    ApplicationId : Client=WebServices;UserAgent=Mac OS X/10.7.2 (11C74); ExchangeWebServices/2.0 (123); Mail/5.1 (1251)

    ApplicationId : Client=CI

    ApplicationId : Client=WebServices;UserAgent=Mac OS X/10.7.2 (11C74); ExchangeWebServices/2.0 (123); Mail/5.1 (1251)

    ApplicationId : Client=CI

    ApplicationId : Client=CI

    ApplicationId : Client=CI

    ApplicationId : Client=CI

    ApplicationId : Client=CI

    ApplicationId : Client=WebServices;UserAgent=Mac OS X/10.7.2 (11C74); ExchangeWebServices/2.0 (123); Mail/5.1 (1251)

    ApplicationId : Client=CI

    This error belongs to one user mailbox on Exchnage 2010 server. It is not a resource or something else it is a normal mailbox user. I get this message like each every 15 minutes on the eventvwr on the exchange 2010 server.

    Kind regards,

    hakan99

    Tuesday, November 08, 2011 9:09 PM
  • Hello Hakan91,

    I'm having the same exact issue as you.  Even with a very similar Get-LogonStatistics.

    Did you figure out what was causing this?

    Thanks so much

     

    Wednesday, January 11, 2012 11:49 PM
  • We have the same problem also !

    There are 300 Mac-Outlook 2011 User which couldn't work.

    They get timeouts and so on.

    A look in the Appl.Log on both CAS/HUB servers (using NLB) shows many 2915 errors like this :

    Process w3wp.exe () (PID=6640). User 'Sid~ASV\AWestpha~EWS~false' has gone over budget '1793' times for component 'EWS' within a one minute period. Info: 'Policy:DefaultThrottlingPolicy_ac259a50-7bf7-4546-b3b7-b2ac80da4fb9, Parts:RPC:1792;'. Threshold value: '100'.

    It seems the reason is the Outlook 2011 version (14.1.3), but we are not sure.

    Wednesday, January 18, 2012 11:29 AM
  • I am seeing the same issue in the eventlog for all Office 2011 users and found a knee-jerk resolution to the issue which I feel needs to be cranked down a bit.  I dont have a user with a 2915 eventlog that has a "has gone over budget '106'" higher than 300.  The eventlog says the default value is 100 but it doesnt say which property is set to 100.  When I look at the policy none of the setting are set to 100.  The URL above recommends setting all EWS and RCA settings to null which I feel is way overkill.  I would like to know which exact setting is causing the eventlog error and set it above the highest value I have seen in the 2915 eventlog messages.  In my case I may set it to 400.

    Has anyone determined which property or properties are causing this issue of the 11 used in the URL above?

    Thanks,

    Mike

     

    Friday, January 27, 2012 11:41 PM
  • We have seen the same issue for all Office 2011 namely Outlook 2011 Mac users.  The only way we have been able to fix this is to set a throttling policy for those users with all EWS policies at unlimited.  Since we were unable to match that 100 number to anywhere even in the default throttling policy.
    Friday, January 27, 2012 11:45 PM
  • So I created a new policy and zero'd out all the EWS and RCA values and applied it to the user having the most issues.  Nothing else has been done to the users machine or Exchange and the user is still reporting the issues.  Did other steps need to be performed on the client or server to kick in the policy?

    I find just about every Office 2011 user in the eventlog at some point with the 2915 error.

    Thanks,

    Mike 

    Sunday, January 29, 2012 6:31 PM
  • I know this is an older thread but it looks like no resolution was ever really determined. Setting all EWS throttling to NULL does not resolve the issue. Was anyone able to figure anything out? I have been nulling things out left and right to no avail.
    Wednesday, October 03, 2012 3:51 PM
  • I believe we ended up setting up a separate policy to handle the users who were seeing this issue like Missy suggested.
    Monday, October 15, 2012 3:45 PM
  • Just an FYI -> MS reported these issues were fixed in EX2k10 - SP2 - RU3

    http://support.microsoft.com/kb/2668900

    How ever EX2k10 - SP2 - RU4, this issue has returned, and the $null policy does not fix the issue

    I will repost once I have validated, a fix action

    sbryson

    Wednesday, November 21, 2012 5:56 PM
  • EX2k10 - SP2 - RU5

    This issue has not been reported in our mail environment since the migration to SP2 RU5

    Monday, February 04, 2013 9:01 PM
  • Same issue here on Exchange 2010 SP3.

    What to do?

    Monday, March 18, 2013 9:49 AM
  • I received the same error soon after setting up Outlook 2011 on a users' MAC book. However, the error was only reported once (so far, this was this morning) and that was soon after all the users mail sync'd with the MAC. Could be a transient error in my case, but wanted to share.
    Thursday, March 28, 2013 7:17 PM
  • We are also seeing this issue.   Subscribing to the forum for feedback.

    Jason Meyer

    Monday, April 08, 2013 2:40 PM