Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9549 Source: MSExchangeIS

Source
Level
Description
An ambiguous SMTP proxy was found on 0x2 mailboxes in the DS. The store cannot map this SMTP proxy to a unique Mailbox GUID.
Comments
 
As per Microsoft: "This event is caused by having duplicate proxies (someone@microsoft.com for example) on two or more objects. Administrators should determine which proxies have duplicates and remove those that are incorrect". See MSEX2K3DB and the link to "Veritas Support Document ID: 273237" for details on this issue.

From a newsgroup post: "I agree with you that this issue is mostly caused by duplicated system mailboxes. I therefore suggest use the following steps to troubleshoot the issue:
1. Try to delete the duplicated object.
a. Start ADUC snap-in.
b. Click View menu, and select Advanced Features.
c. Expand the Microsoft Exchange System Objects container.
d. Verify if there are duplicated systemmailboxes. If so, please alter the duplicated one which starts with CNF:xxxxxxx.
e. Go to ESM and expand the mailbox store. Right-clicking the Mailboxes icon, select Run Cleanup Agent, and then purge the duplicated one.
f. Clear the current application log and reboot the server.

2. Rebuild the mailbox store in problem.
a. Create a new mailbox store on the server.
b. Move all mailboxes from the original store to the new mailbox store that you created in step one.
c. Remove the original mailbox store.
This new mailbox store has a SystemMailbox object created after the new mailbox store has mounted for the first time. However, if the store that you want to replace contains a very large number of mailboxes, or if the server is running Microsoft Exchange 2000 Server Standard Edition or Microsoft Exchange Server 2003, this method may not be sufficient. For additional information, see ME316622".
See ME286792 and ME926094 for a situation in which this event occurs.
See ME318774 for an article on how to detect and remove duplicate SMPT proxy addresses.
As per Microsoft: "The same SMTP proxy address has been assigned to more than one object in Microsoft Windows 2000 Active Directory". Search for an event 9514 witch indicates which objects have the same SMTP address. See ME269498 for more details.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...