Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9175 Source: MSExchangeAdmin

Level
Description
The MAPI call 'OpenMsgStore' failed with the following error: The attempt to log on to the Microsoft Exchange Server computer has failed. The MAPI provider failed. Microsoft Exchange Server Information Store ID no: 8004011d-0512-00000000
Comments
 
I noticed this error on an Exchange 2003 that had one mailbox store and one public folder store. Almost all public folder instances were replicated to another server except one. When running 'Move All Replicas' this error would pop up. The solution was to let the mailbox store use this public folder store as its default PF store (mailbox store \ properties \ General tab \ Default public store).
You may see this event if you modify the default permissions on mailbox stores and public folder stores in Exchange 2000 Server or in Exchange Server 2003. See ME328229 for additional information on this situation.
I received this error when the account was disabled but did not have the “Associated External Account” right set. Setting it allowed the mailbox to move.
As per Microsoft: "This event can have several causes and the ID number in the Description section of the event will be the only difference between the events. Depending on what the underlying cause of the problem is, the ID number will vary". See MSEX2K3DB for more details on this event.

From a newsgroup post: "Before moving users, stop the ADC service and stop any antivirus software".

See ME278888 for additional information on this event.
This event can also occur if the user account is disabled in Active Directory. This event should also be accompanied by Event ID 9548 from source MSExchangeIS. Once I enabled the account, I was able to move the mailbox.


This error will also appear if the mailbox store is not mounted.
This can also occur if your mail server object is missing under the security tab of the mail store properties. We received this error message when we were practicing disaster recovery in an isolated environment. After we did a restore of the full mail db, we could not get the stores to mount. Once I added our mail server object to the ACL of the Security tab of the store, all was well.
This also happens when running Norton/Symantec Antivirus Corporate/Enterprise and it is not configured properly. If it is set to scan the whole server without excluding the Exchange directories, Norton Antivirus deletes/quarantines “Exx.log” files. This all seems to be from MyDoom. Have had to Hard Repair four Exchange 200x servers already as Norton Antivirus deleted the log file since it was set to delete not to quarantine. You must exclude all the Exchange directories and the M: drive.
As per Microsoft: "These errors are reported because Move Mailbox cannot log on to the system attendant mailbox. The system attendant has a mailbox on each server, usually on the default mailbox store". There are several Microsoft articles with information about this event: ME264413, ME288598, ME317338, ME326990.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...