Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 917 Source: ESEBACKUP

Source
Level
Description
Information Store (2212) A remote (TCP/IP) based streaming backup was attempted. This functionality has been disabled by default settings.
Comments
 
I noticed the comment below regarding this being relevant to Server 2003 only (not 2008). I just had to Add this key to an SBS 2008 box. We use a product called Asigra and without this key added, a "Pipe has ended" error occurs, and an event ID 917 ESE Backup is logged. So I guess it is applicable to Windows Server 2008 editions as well.
This "feature" was introduced in Exchange 2007 SP1. From the release notes:

As part of the continuing Microsoft security initiatives, Exchange 2007 SP1 introduces a behavior change that is designed to reduce the attack surface on your Exchange messaging system. This change directly affects remote streaming backups. In the RTM version of Exchange 2007, remote streaming backup was enabled by default. This default configuration is less secure because it allows anyone in the domain who has sufficient backup rights to back up an Exchange server. Moreover, data that is backed up remotely is not encrypted, and backups are frequently performed over a public, client-accessible network.

In compliance with the Microsoft "Secure by Default" initiative, in Exchange 2007 SP1 the remote streaming functionality is disabled by default. A manual override in the form of the following registry value must be enabled to restore this functionality:

Caution:  
Incorrectly editing the registry can cause serious problems that may require you to reinstall your operating system. Problems resulting from editing the registry incorrectly may not be able to be resolved. Before editing the registry, back up any valuable data.  

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\ParametersSystem
Name: Enable Remote Streaming Backup
Type: DWORD
Value:  0 = default behavior (remote backup disabled), 1 = remote backup enabled

- If this key doesn''t exist, create it.

Important:  
This registry key override is for computers that are running Windows Server 2003. Windows Server 2008 does not support remote streaming backup and restore operations.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\ParametersSystem
Name: Enable Remote Streaming Backup
Type: DWORD
Value: 0 = default behavior (remote backup disabled) 1 = remote backup enabled

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...