Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 3005 Source: ServerActiveSync

Unexpected Exchange mailbox Server error: Server: [mt-exch-02.marketech.loc] User: [<email address>] HTTP status code: [400]. Verify that the Exchange mailbox Server is working correctly.
Here is what worked for me after all else failed:
1. Open IIS Manager
2. Go to Websites
3. Right click on "Default web site"
4. Select "Properties".
5. On the web site tab select "Advanced"
6. Under "Multiple identities for this website" select "Default Entry" and then select "Edit".
7. IP address: (All Unssigned), TCP port:80, Host Header Value: "Blank"
8. Select "Ok".
9. Restart IIS Admin Service. (Open command prompt, type "iisreset" and hit enter)
In our case, we had to disable RPC over HTTP for our Outlook 2003 user. The user did hit his quota limit, but Outlook would not update its quota info until after we reconnected to Exchange 2003 with RPC over HTTP disabled.  After the resync with the server, we renabled RPC over HTTP and all was well again.  

The user was on our local network while we did this, rather than at his remote location. I would suppose that other measures, deleting and recreating his mailbox would have worked, too (offload Outlook items to a PST file first).
I was getting this on 2 users several times an hour, filling up my event log. We had  Exchange 2003 on Server 2003. One of the users  was synchronizing with an iPhone with no trouble, the other could not get Active Sync to work on the iPhone. I checked the solutions listed here with no success. So I backed up the user's email into a PST file, then completed deleted the user's Exchange account. Next I deleted the email profile on their computer and then created a new Exchange account and copied the backed up PST file into the new mailbox. The problem was solved. Perhaps I did not need to delete the email profile but I wanted to be sure I was not bringing any problem data in.
In my case the problem was that in the IIS 6.0 Manager, with Exchange 2003, the Default website's hostheader for port 80 didn't have the correct DNS distinguished name. I had to add the distinguished name for port 80 after which the iPhone 4 successfully connected to the mailserver using SSL (443).
In principle, this should open an explorer view of the contents of the NON_IPM_SUBTREE for the user in question. When I looked here for a user that worked he had a Microsoft-Server-Activesync folder with a subfolder PocketPC which in turn had subfolders for the device ID's that had sync'd. The users that wouldn't work did not have these folders (presumably they are normally auto-created on first sync). I clicked new and created the Microsoft-Server-Activesync folder and now that user syncs.

This what fixed it for me on two different 2003 servers:
1. Apply fix ME817379
2. If the Exchange virtual directory is in a website that has a binding with NO header then do not do anything. Otherwise, create another instance of this (exchange-oma) virtual directory in a website with a binding with no header.
In my case, ME886757 helped solving the problem (information about a hotfix available).
HTTP status code: [422] - See ME817379.
This error can also be generated if the user mailbox is full. I got this error every few minutes with reference to a specific user's mailbox. I increased the user's mailbox limit and asked the user to clean up, then restored original limit. See also EV100051 (about HTTP code 507).
I've this problem after adding a ip alias to my Exchange. When I deactivated the network card, the system worked well. The fis is to add in the virtual directory used by active sync server the new ip adress of the server in the computer authorized.
I called Microsoft and together figured out the resolution to my issue. It turns out it is directly related to the Primary email address change that we performed on 11/30/2006.
Microsoft Case# SRX061212601631

Through testing determined the problem is related to changing the Primary email address on a users mailbox. Per Microsoft a GUID is assigned to the Primary email address and is used with ActiveSync. So even if you change the Primary email address back to the original email address it still has a new GUID.

The resolution steps for this issue are:
1. First set the Primary email address of the users mailbox.
2. On the Mobile Device (MDA) open ActiveSync. Click Menu Options. Select the Exchange Server config then click Delete. This will remove the Server Source from ActiveSync. All your email will be removed from the Mobile device Calendar and Contacts will remain.
3. Then Click Menu Configure Server. Proceed with configuring your server options as you would when setting up a new user. On your first Sync you will get an error click Sync again and you will be prompted to accept the server policy settings just click ok. (we are pushing mobile device policies from the Exchange server)
4. Delete an email from your Mobile Device then Sync. Verify that the email is removed from mailbox in Outlook.

I found this on EV100052.
We got this event when using an iPhone and trying to send an email via exchange 2003. It stopped after removing the Domain Name in iPhone Exchange Settings leaving the field completely empty.
Removed this error message by removing all host headers from the Default Website in IIS. Go to Properties for the default Website for IIS:
- Click on ''website'' tab.
- Click on ''advanced'' next to IP Address.
- Remove all headers except an entry for ''Default 80'' with no host header value.
See ME926144 for a hotfix from Microsoft.

In my case, this problem has been solved by selecting "All Unassigned" in Default Web Site -> IIS Admin.
I started getting this error and mobile phones would not sync anymore after adding alias IP addresses to the server. After removing the alias IP addresses the error went away and mobile phones could sync with the Exchange server again.
In my case, these errors started when I implemented the use of host headers on my IIS web sites. I have two web sites on the Exchange server and started using host headers to distinguish them. To fix the issue I created an identity with a blank host header on the site hosting Exchange.
This issue may occur if one or more following conditions are true:

1. The authentication method is incorrect for the virtual directories that are used by Microsoft ActiveSync.
2. The application name points to an incorrect entry in the Outlook Mobile Access virtual directory.
3. The application name points to an incorrect entry in the Microsoft-Server-ActiveSync virtual directory.
4. An incorrect application pool is associated with the virtual directories that are used by ActiveSync.

See ME937635 for information on solving this problem.
The meaning of this error depends on the HTTP Status Code it contains. 507 could mean that the users Mailbox is over its quota, which can cause a problem for Active Sync to save information in a hidden mailbox folder.
This issue can appear if the security settings on the Virtual Directories are altered. Verify that the following settings are enabled for the front-end and back-end servers.

Front-end Exchange Server:

Default Web Site:  Basic Authentication
ExAdmin: Integrated Authentication
Exchange:  Basic Authentication
ExchWeb:  Anonymous
Active Sync:  Basic Authentication
OMA:  Basic Authentication (note: Default domain must be “\”)
Public:  Basic Authentication.

Back-end Exchange Server:

Default Web Site:  Anonymous, Integrated Authentication
ExAdmin: Integrated Authentication
Exchange:  Integrated Authentication, Basic Authentication
ExchWeb:  Anonymous
Active Sync:  Basic Authentication
OMA:  Anonymous, Integrated Authentication
Public:  Anonymous, Integrated Authentication.
This solved our problem:

1. Right click on the virtual directory and click properties
2. Uncheck "Enable anonymous access" in Authentification method
3. Synchronize your PPC.
I got this event every 15 minutes on my Exchange 2003 system. The source of the error was a user's smartphone which was configured to use ActiveSync to synchronize with the Exchange Server. The smartphone had the Exchange server name and user credentials, but was not synchronizing successfully.  We decided to prevent the smartphone from using ActiveSync to sync with the server, and that eliminated the 3005 errors. Instead, the smartphone syncs using IntelliSync which came bundled with it.
For the past week or so, I have upgraded my domain to Windows 2003 native. My DCs were all previous running Windows 2000. The exchange server was running 2003 exchange on a 2000 server operating system. I upgraded my system to 2003 all of them without a hitch. I then installed SP2 for Exchange 2003. Everything seemed to work aside from ActiveSync. The weird thing is it worked half the time and the other half it did not. I would get an Active Sync HTTP_500 error on my palm and an EventID 3005 from source ActiveSync "Verify Exchange is working properly" on the server end.
For the past week, I have dedicated most of my time trying to fix this problem. I have tried every KB article I could find and every registry hack you could think of. I finally broke down and spent 100 bucks to contact Microsoft about the issue I noticed several other people on groups experienced. I figured I would post this to anyone else that might have this same problem with ActiveSync.

1. Open up Systems Manager (Start -> All Programs -> Microsoft Exchange Systems Manager).
2. Look for the "Servers" folder and drill down.
3. If you have a Front-End/Back-End (FE/BE) scenario like me you will have to do this fix to both machines.
4. Drill down to the server you want and then to "Protocols HTTP Exchange Virtual Server".
5. Once you have drilled down there, right click on the "Microsoft-Server-ActiveSync" and click Delete.
6. Right click on the "Exchange Virtual Server", click New, and then Virtual Directory.
7. Under Microsoft-Server-ActiveSync -> "Exchange Path" click "Exchange ActiveSync".
8. Then OK out of it.

Give it a shot, this worked for me.

This problem is usually attributed to an Exchange situation involving excessive items in the users’ calendar. Refer to ME842541 for hotfix.
This is an Exchange 2003 Pocket PC Server Activesync error.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.