Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
An unexpected error occurred in the Internet Mail Service. Information about this error is stored in the data portion of this event.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
Why are some errors “unexpected”?
What is the role of the Microsoft Exchange Internet Mail Connector service?
Unknown failure - restart of service did not help. Restart of server cured.
This problem can occur if the message has more than 32, 766 (0x7FFE in hexadecimal numbers) recipients defined. The Internet Mail Service uses Messaging Application Programming Interface (MAPI) to create non-delivery report (NDR) messages, and attempts to add the recipients to an NDR message that MAPI is creating. MAPI uses the Emsmdb32.dll file to communicate with the information store, and the Emsmdb32.dll file has a limit of 32, 766 recipients defined for the number of recipients on a single message. See ME272672.
As per ME245565: "Data is being received in blocks from the remote server and each block is being decrypted as it is received. In rare cases, two blocks may be received by the server and read in a single input/output (I/O) operation. In these cases, the second block is not processed. When the next block arrives, the Windows NT security components recognize an issue (absent data) in the encryption stream and return an error of SEC_E_MESSAGE_ALTERED."
ME231737 specifies: "An application or a user may have deleted the Exchsrvr\Imcdata\In directory. When permissions on the C:\Exchsrvr\Imcdata\In directory are not set to Read Only, the directory may be deleted or renamed by any outside agent during Internet Mail Service operation."
|Private comment: Subscribers only. See example of private comment|
|Links: ME272672, ME245565, ME231737|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated