locked
Event ID 9646 and options RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    The PA in our company keeps getting locked out of her outlook account, usually just after we have a network outage (we've some issues with a router).

    I get 9646 logged and System Manager shows a bunch of sessions open for her account (>32)

    Her PC doesn't have any search tools, doesn't have any plugins I dont recognise (just KAV and Apple)

    How do I:

    - Kill off the stale sessions  (and no restarting the Store isn't an option)
    - Find out how long these sessions last

    I'm not sure why shes having so many open. I thought it was supposed to be one per Outlook client ?

    She does access other peoples mailboxes and calendars, so do they open seperate sessions ?

    Its Exchanage 2003 Standard (latest SP2? I think), shes using Outlook 2007

    Tuesday, April 5, 2011 12:08 PM

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote

    Other things can cause opening many sessions, users docking and undocking from laptops, network connectivity issues or incorrect settings (though if its just one user I would doubt)

    1. You can use tcpview, launch it on the Exchange server and kill her session.

    2. These sessions will last for 2hrs

    You can reduce the windows keepalive registry key to lower the threshold below 2hrs

    3. No opening other sessions do not count towards her sessions. If other users are opening her mailbox then it will count towards her sessions. The tcpview will also yeild more information as to if other IP sources (other users) are opening her mailboxes.

    How to get rid of 9646 events

    http://blogs.technet.com/b/jeff_stokes/archive/2008/11/25/how-to-get-rid-of-9646-events.aspx

    James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com
    Tuesday, April 5, 2011 1:10 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Other things can cause opening many sessions, users docking and undocking from laptops, network connectivity issues or incorrect settings (though if its just one user I would doubt)

    1. You can use tcpview, launch it on the Exchange server and kill her session.

    2. These sessions will last for 2hrs

    You can reduce the windows keepalive registry key to lower the threshold below 2hrs

    3. No opening other sessions do not count towards her sessions. If other users are opening her mailbox then it will count towards her sessions. The tcpview will also yeild more information as to if other IP sources (other users) are opening her mailboxes.

    How to get rid of 9646 events

    http://blogs.technet.com/b/jeff_stokes/archive/2008/11/25/how-to-get-rid-of-9646-events.aspx

    James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com
    Tuesday, April 5, 2011 1:10 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi adrianmarsh,

    Any updates?

    Frank Wang

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com  

     

    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Wednesday, April 6, 2011 8:25 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    I'm liking the tcpview method so at least I have a way of cleaning up a bit.
    Wednesday, April 6, 2011 8:39 AM