none
Exchange 2013 organization prep fails RRS feed

  • Question

  • Hi,

    I'm in the middle of preparing AD and extending the schema for an Exchange server 2013 installation and I'm getting the bellow error. My question are, what type of key do I have to create, on which server(the one I'm using to prepare the organization) and what value should I add? Is this even supported?

    Event ID:      2866

    Task Category: Security

    Level:         Error

    Keywords:      Classic

    User:          <redacted>

    Computer:      <domain controller>

    Description:

    While logging audit events for the following object, the directory service reached the maximum number of audit events that could be cached in memory at any given time. As a result of reaching this limit, the operation was aborted.

     

    Maximum number of audit events that can be cached: 17000

     

    Distinguished name of object:

    CN=View-Only Configuration,CN=Roles,CN=RBAC,CN=<company>,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=<domain>,DC=ca

     

    Generally this occurs if there are a large number of changes being performed on attributes that require auditing. An example of such an operation could be deleting the membership of a large group, where the ‘member’ attribute is being audited.

     

    Additional Data From the Audit Event Attribute name or old distinguished name:

    msExchRoleEntries

     

    Attribute value or new distinguished name:

    c,Get-PublicFolderClientPermission.

    Microsoft.Exchange.Management.PowerShell.E2010,Debug,DomainController,ErrorAction,

    ErrorVariable,Identity,OutBuffer,OutVariable,Server,User,Verbose,WarningAction,WarningVariable

     

    User Action

    (1) Check that an excessive number of object creation, modification, move, rename or undelete operations are not being performed.

    (2) Check that an excessive amount of auditing is not enabled.  For example, confirm that auditing is not configured for more attributes than is necessary.

    (3) If necessary, increase the size of the audit queue by increasing the ‘Maximum Audit Queue Size’ registry parameter.

    Thank you.

    Friday, December 13, 2019 11:17 AM

Answers

  • Thanks for that, I found the same article but to add a bit more value to it:

    a DWORD 32-bit value has to be created in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NTDS\Parameters with the name Maximum Audit Queue Size and decimal value, in my case, I've used 150000.

    The key has to be created on the domain controller that's used to prepare the organization, most probably on the schema master or check the exchange setup logs.

    I have never seen that error thrown in 20 years of Prepping the forest for Exchange! Hopefully that works for you. 
    Friday, December 13, 2019 1:00 PM
    Moderator

All replies