locked
Exchange 2007 SP3 default quota issue RRS feed

  • Question

  • This is an odd one.

    We use Exchange 2007 SP3 running on Server 2003 R2, the domain is 2008 R2.

    We have a default mailbox size limit of 900MB (issue warning) 1GB (stop sending) 1.25GB (stop send and receive). This has been in place since before I started working here 8 months ago. Until yesterday we had no reason to look at this in too much detail, we have plenty of storage and have only ever had issues with log files filling up previously.

    However, yesterday afternoon we suddenly had over 130 mailboxes unable to send or receive, others unable to send and a number of users got warnings that they were close to their limit. Some of the ones unable to send or receive have the default quota set yet had mailboxes almost double the upper limit. It's as if the rule had never applied then suddenly decided to enforce itself.

    Additionally, some of the executive level users, as standard they have a manually set quota, were included in the default rule.

    Initially I thought someone was doing a cleanup and had changed the settings on these accounts, but Exchange and AD both show no amendments to any of these accounts in the last 36 hours, so it was not that.

    The scan for mailbox size is set to run once a day at 01:00, given we are in the Central time zone (GMT -6 hours, though we have already moved the clocks forward so we are 5 hours behind for the moment)) even if we take it that the 01:00 is UTC it should not have run until 20:00 Central, the sudden enforcement of the quota happened at around 15:00 so that doesn't explain it either.

    No patches or updates have been installed on the Exchange servers this month, the servers have not rebooted and we did not failover to the secondary server.

    Does anyone have any idea what could have caused this? I have some very unhappy executives and senior managers who want an answer I can't give them right now....

    Tuesday, March 18, 2014 2:45 PM

Answers

  • So, which are you more concerned with: the fact that quotas may have been altered, or what it was that filled the mailboxes?

    If it's with modifications to the AD, I think the first order of business would be to review who has permission to make such modifications. Maybe forcing everyone to change their password would be a good thing (and enforcing a strong password policy in the process).

    If it's "what filled the mailboxes", I'll ask the question again: what filled the mailboxes? You can examine individual mailboxes or use the message tracking logs as a starting point.


    --- Rich Matheisen MCSE&I, Exchange MVP

    Wednesday, March 19, 2014 10:08 PM

All replies

  • So what was it that filled the mailboxes? Surely you looked to see if there was something common to all of them!

    When something like this happens it's very often a rule in someone's mailbox that created a mail loop. In your case it may be one involving a DL that has lots of people in it.

    You should also know that mailbox quotas are not enforced when the message being sent is a "system" message (e.g. a NDR).


    --- Rich Matheisen MCSE&I, Exchange MVP

    Wednesday, March 19, 2014 2:19 AM
  • We checked sent and received mail and found nothing that would trigger this. Further investigation found users who should have the default quota were well over the limit (up to 80% over the upper limit) and were sending/receiving fine until late Monday afternoon, people who had previously had a manually set quota, set because they have a higher volume of mail because of their job role, were suddenly set to have the default quota.

    Wednesday, March 19, 2014 2:16 PM
  • So, which are you more concerned with: the fact that quotas may have been altered, or what it was that filled the mailboxes?

    If it's with modifications to the AD, I think the first order of business would be to review who has permission to make such modifications. Maybe forcing everyone to change their password would be a good thing (and enforcing a strong password policy in the process).

    If it's "what filled the mailboxes", I'll ask the question again: what filled the mailboxes? You can examine individual mailboxes or use the message tracking logs as a starting point.


    --- Rich Matheisen MCSE&I, Exchange MVP

    Wednesday, March 19, 2014 10:08 PM