Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1022 Source: MSExchangeISMailboxStore

Logon Failure on database <path of database>. Error: <error code>.
Error -2147221231: From a support forum: I got this error for a user that was not disabled but hidden from the Exchange address lists so ME555420 fix did not apply to it. I did however resolve the issue. I disabled the user from the address list when I first added the Exchange account. I never gave the user time to validate in the directory. Once I made the user visible and let it go through one 15 minute cycle, then re-hid the user from the lists, the errors stopped.
See EV100343 (Exchange 2003 to 2010 Mailbox Migration Error: MapiExceptionLogonFailed).
This was happening to a new Exchange 2007 server for an Archive account we had set up. It turned out that the mailbox defaults of 2GB were being reached, and could not go any further. After we set the mailbox storage quotas to 30GB, it took 10 - 15 minutes for the changes to take effect. Mail flowed normally afterwards.
- Error code: 1144 - From a newsgroup post: "I moved a mailbox from an Exchange 2000 Server to a new Exchange 2003 Server. If a user tried to log on to the recently moved mailbox, error 1144 would be logged. This is because the rule set is replicated separately from the mailbox some time later. After the rule set is replicated, this error disappears".
As per Microsoft: "This event could be seen in several situations. Check the error code in the description section. For example, the error might be MAPI_E_LOGON_FAILED or ecWrongServer or MAPI_E_NO_ACCESS". The following are a few of the possible conditions: for a few of the possible conditions and for troubleshooting tips.

See ME317722, ME326018, and ME839422 for more details on why this event occurs and how can you avoid it.

From a newsgroup post: "If this problem arises when you try to move a mailbox, keep in mind that you cannot move a mailbox if the user account is disabled. If the user is disabled, enable it and wait for AD to replicate. Exchange stores this kind of information in its cache, which by default is updated every two hours. Wait for that to complete and try moving the mailbox again".

I found this error while trying to logon to a users mailbox through Outlook. I checked the exchange serverís application event log and the error I got was that the user account does not have a master account SID. To fix this problem, first I disabled the user account and then removed the Exchange attributes on the account; I then used the exchange system manager MMC and ran the cleanup agent on the mailboxes. Once the userís mailbox is marked with a red cross, you can either purge the mailbox or reconnect the mailbox to an account. Enable the account and then reconnect the userís mailbox to their AD user account and all should be fine.
I changed the security template on my Domain Controller, which disabled the account. I simply removed the mailbox, which deleted all mail, and then recreated the account using AD Users and Computers.
I encountered this error after moving a very large (700+ MB) mailbox from Exchange 5.5 to Exchange 2000. Apparently, some conversion was still taking place for some time after the move was completed and opening the mailbox produced this error. After about 10 minutes, it opened normally. This seems to be related to ME317722.
I found that this error occured if the user account was disabled. I was able to stop the error by deleting the exchange mailbox for the user.
As per Microsoft:
To resolve this issue, manually rebuild the Recipient Update Service (RUS) so that every user object receives the correct attributes. To rebuild the Recipient Update Services follow these steps:
1. Open Exchange System Manager.
2. Click Start, point to Programs, point to Microsoft Exchange, and then click System Manager.
3. Expand Recipients, and then expand Recipient Update Services.
4. In the right pane is a list of all Recipient Update Services, in this pane right-click each Recipient Update Service, one at a time, and then click Rebuild.

See ME273448 and ME326990 for more details.
This event occurs when you move a mailbox from an Exchange Server 5.5 computer to an Exchange 2000. See ME278966.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.