Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 5 Source: MSExchangeES

Source
Level
Description
An unexpected MAPI error occurred. Error returned was [<error code>].
Comments
 
- Error: 0x8004010f - See ME259578, ME281683 and the link to "The Secrets of Exchange Server Scripting and Routing".
- Error: 0x80040154 - See ME270855.
- Error: 0x80004005 - See ME314148.

See MSEX2K3DB for additional information about this event.
We had this error on an Exchange 2003 server. All the information about this errors on TechNet only apply to 2000 and 5.5. We still tried several solutions. In the end, we changed the MSExchangeES service to run on the account that has full access on Exchange. After that, a new public folder was created in the exchange manager under Events Root, named EventConfig_servername.
We already were aware of the fact that this folder was missing, but did not find a way to create it. In ME265397, it is written that this directory should be created automatically if there is none, but that did not happen as long as MSExchangeES was running under the system account.
We encountered this problem on multiple Exchange 2003, but only if Exchange 2000 was installed before.
- Error: 0x80004005 - This error on an Exchange 5.5 server could mean that for some reasons a system admin changed the service accounts for the Exchange services. For some reason the event service needs the service account it was installed with. Change this account back, and start the service again. All the other services can remain under the new service account.
- Error: 0x80004001 - See ME236170.
- Error: 0x80040107 - See ME190993.
- Error: 0x80004005 - See ME285021 and ME299676.
- Error: 0x80040110 - See ME814245.

ME867641 provides information on fixing this problem for various error codes.

From a newsgroup post: "The Exchange Event Service (MSExchangeES) will not run properly using the LocalSystem account. It needs to be run with an account that has Full Exchange Administrator permissions. You probably don't even need the Exchange Event Service, unless you need to use Exchange 5.5 compatible event scripts. This is the only reason the Event Service is even included. If you're not running 5.5 event scripts, then just leave the Event Service set to manual startup and let it remain stopped".
Error 0x80040154 signifies that there is an unregistered .dll file. To resolve this issue, reregister the Event Service .dll files using regsvr32; to do so, follow these steps:
- Go to the command prompt, and change directories to the Exchsrvr\bin subdirectory.
- Enter the following command:
  regsvr32 <dll name>
(where <dll name> is the name of the .dll file (such as "Scripto.dll").
- Run the command on the following .dll files:
* Scripto.dll
* Ss.dll
* Esconf.dll



Error: 0x80040154 = "Class not registered" - This error signifies that there is an unregistered .dll file. See ME270677 on how and what files need to be re-registered.
Error: 0x8004010f = "An object could not be found.". See ME289969 for one instance one this can occur.
From a newsgroup post: "I just started receiving the same error, immediately after installing the latest store.exe hotfix (the Sept. 27th hotfix) ME248838. Uninstalling the event service, reinstalling it, and applying service packs and hotfixes again solved the problem."
Error: 0x80004001 = No additional info
Error: 0x80004005 = "Unspecified error" - This error may occur if you starting the Exchange Event service, but you haven't configured the Messages and Status in the Exchange System Manager. You must configure it an restart the Exchange Event service.
Error: 0x80004005 = ME265397, ME182082 and ME192174.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...