Outlook is losing my email?!? Event ID 9646 (Application Log)

Recently at a client of mine, we had an issue where one users Outlook would continually stop displaying new email. The inbox would show ‘last updated at..’ and would not move on from that time but, Outlook would correctly display ‘Connected’ in the bottom right corner.

If you logged into OWA you could see all the new email and work normally. Usually in that instance we would say, oh well, corrupt OST lets disable cached Exchange mode, and delete the OST, then re-enable the cache.

Or, if the mailbox is small enough, simply disable the cache. On this system however, that didn’t fly. We were puzzled, to say the least, and, I’m not ashamed to admit, totally missed the obvious errors waiting for us in the logs on the Exchange server.

We tried a great many things to solve the issue and became blinkered that the issue was on that single PC. It wasn’t until we swapped out that PC for another, we recorded the same symptoms and i developed a cold sweat and thought, wtf is going on!

I have seen and heard similar stories now from several sources, through twitter, or people contacting me directly. All of these issues were caused by the same thing, and it is an issue that has been around, and had a fix, since Exchange 2003. I am not sure why, in the last few months we have seen a surge in the SMB space, i am wondering if a patch to Outlook is the cause. I have seen this on Outlook 2010 and Exchange 2010, but i have also seen this in a non SBS network running full Exchange 2007 standard, with Outlook 2007.

Some of the symptoms i have seen are:

• Outlook Not Updating
• Emails Disappearing
• Unable to send email
• Errors In Sync Folders

To quickly see if your server is having this problem, you can load up the Event viewer on your server, then filter the Application log for any events with ID 9646.

You may then see an alert like this.

In the example above i limited my server to 250 items of objtFolder in order to simulate the error.

To solve the problem we need to refer to the following Microsoft KB Article.

Symptoms:

Your Microsoft Exchange Server 2003 computer may stop responding to one or more clients. Additionally, an error message that is similar to the following may be logged in the application event log:

Event ID: 9646
Type: Error
Source: MSExchangeIS
Description:
Closing Mapi session "/o=Organization/ou=Administrative Group/cn=Recipients/cn=user" because it exceeded the maximum of 250 objects of type "objMessage".

This article references Exchange 2003, however the same fix applies to Exchange 2007 & 2010.

As shown in the ‘Cause’ section of the KB article, the following values are defaults for Exchange 2003:

Entries in the SP1 & Later column refer to later SPs and Later versions of Exchange

The most common cause of the error i have seen so far is objtFolder exceeding the default limit of 500.

The fix is relatively easy. We just update these limits.

To do that, load up the Registry Editor on your Exchange Server and navigate to..

HKEY_Local_Machine\System\CurrentControlSet\Services\MSExchangeIS\ParametersSystem

You need to create a new Key named ‘MaxObjsPerMapiSession’ and then create DWORD (32bit) entries for each of the settings in the table above that you wish to change.

For example, if my user is exceeding the limit of 500 on objtFolder i would add a new DWORD with a value above 500.

In the above example my DWORD value has a decimal value of 4096. The value in decimal is the limit you are imposing. So in my example i have increased the default from 500 to 4096.

After you have updated this registry key you must restart the Exchange Information Store service to pickup the changes.

Hopefully this will solve you a lot of time if you run into a troublesome Outlook client.

Because i am seeing this more and more often, i would also suggest adding a check for this event on your favourite RMM tool, such as GFI Max so you will be alerted about the problem and don’t even need to worry about troubleshooting outlook when the error occurs.