Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 12002 Source: MSExchangeIS

Source
Level
Description
Error <error code> occurred while processing message <> from 'Postmaster'.
Comments
 
- Error code: 8004011B-820003A2 - Several newsgroup posts suggest that hotfix ME829093 solves this issue.
- Error code: FFFFFBFE-8200036D - See ME826134.
- Error code: 8000FFFF-80000000 - See ME829093, ME829047, and ME838414.
- Error code: 80040305-80000000 - See ME833607.

As per Microsoft: "These events are generated when messages in the user's mailbox fail to be converted. This can happen when antivirus programs strip off attachments from messages. The 12002 events are generated when a user with these messages in their mailbox, logs on to the server to access their mail". See MSEX2K3DB for more details on this event.
I started to receive this error after a series of hurricanes in Florida. I was constantly rebooting and shutting down the Exchange server to avoid ungraceful shutdowns and power failures. Somehow this lead to a corruption within the installation of Exchange. Reinstalling SP3 for Exchange 2000 and all the hotfixes fixed this problem in my case.
This error comes with users being unable to open attachments in their emails. I checked the security settings that are being propagated by group policy and the security settings assigned in the exchange public folder - no error there. I was able to open the attachments of older emails. Doing a proper re-install of SP3 for Exchange worked for me.
This was caused on my system by a single large email that was sent out but was way over the users mailbox limits. Exchange closed the mailbox and the email became "traped". The fix was simple, deleted the email, for some reason this took quite a long time. No services shutdown or reboot was required.


I have had this happen ever since SP3 Exchange 2000 patch. The problem is the mail client either outlook or Owa will not delete the email. It says unknown error when you try to delete it. I port the users email to a pst file and then delete the mailbox. Make sure you verify the pst file before you delete the mailbox. I then recreate a mailbox for the user setup outlook on client again and import the pst file.

Also this error may have something to do with antivirus scanning M:\drive or database stores corrupting email. See ME298924 and ME328841.
The e-mail that was causing the problem was SPAM. When viewing the e-mail from OWA the subject contained question marks and binary symbols. Stopping all antivirus software on the exchange server that hosts the mailbox allowed me or the enduser to delete the message from either OWA or the Outlook client.
I have had this problem for about 6 months and have finally resolved it with some help from Microsoft Consulting Services:

Cause: It appears that this error is caused by some form of corrupt email in the Information Store.

Fix: Give your user account the Exchange Services or Exchange Domain Servers groups. Please note you need to remove yourself from Domain Admins or Administrators as these accounts are explicitly denied access to users mailboxes. See ME262054 for more info.

Once you have done this you need to search your M drive of your mail server for text containing the originating email address contained in the event log.

Once found use your email client, either Web Access or Outlook to open the offending mailbox and delete the message. Do not delete the file directly from Windows Explorer, use the mail client.

Please note your company might have some security issues around your ability to access the users mailbox, but then you could always get the user to delete the offending message.
Restarted my information store, and that seemed to correct the problem. For now.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...