Event 5000 | Application | Error | MSExchange Management Application | All Events

Question

We have a client who has a SBS 2011 Std SP1 running MSExchange 2010.  Recently we moved their locally hosted email to Office 365 and shut off all off the MSExchange services as none of them are necessary for the client anymore.
Since the migration, we have been receiving the error in the title.  Below is the full error.
Log: Application
Type: Error
Event: 5000
Agent Time: 2015-04-07 03:01:44Z
Event Time: 07:00:12 AM 7-Apr-2015 UTC
Source: MSExchange Management Application
Category: AdminAuditLog
Username: N/A
Computer: Servername.Domain.local
Description: Failed to save admin audit log for this cmdlet invocation.
Organization: 
Log content:
Subject: NT AUTHORITY\SYSTEM (DataCollectorSvc) : Update-SafeList
Body:
Cmdlet Name: Update-SafeList
Object Modified: Domain.local/MyBusiness/Users/SBSUsers/Admin Assistant Modified Object Resolved Name: Admin Assistant
Parameter: Identity = Domain.local/MyBusiness/Users/SBSUsers/Admin Assistant
Caller: NT AUTHORITY\SYSTEM (DataCollectorSvc)
Succeeded: False
Error: Microsoft.Exchange.Data.Storage.ConnectionFailedTransientException: Cannot open mailbox /o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=DWSSERVER/cn=Microsoft System Attendant. ---> Microsoft.Mapi.MapiExceptionNetworkError:
MapiExceptionNetworkError: Unable to make connection to the server. (hr=0x80040115, ec=-2147221227)\nDiagnostic context:\n    ......\n    Lid: 10648   dwParam: 0x6D9      Msg: EEInfo: Generating
component: 2\n    Lid: 14744   dwParam: 0x6D9      Msg: EEInfo: Status: 1753\n    Lid: 9624    dwParam: 0x6D9      Msg: EEInfo: Detection location: 501\n   
Lid: 13720   dwParam: 0x6D9      Msg: EEInfo: Flags: 0\n    Lid: 11672   dwParam: 0x6D9      Msg: EEInfo: NumberOfParameters: 4\n    Lid: 8856   
dwParam: 0x6D9      Msg: EEInfo: prm[0]: Unicode string: ncacn_ip_tcp\n    Lid: 8856    dwParam: 0x6D9      Msg: EEInfo: prm[1]: Unicode string: Servername.domain.local\n   
Lid: 12952   dwParam: 0x6D9      Msg: EEInfo: prm[2]: Long val: -1527653632\n    Lid: 12952   dwParam: 0x6D9      Msg: EEInfo: prm[3]: Long val: 382312662\n   
Lid: 59505   StoreEc: 0x824     \n    Lid: 36081  \n    Lid: 52465   StoreEc: 0x80040115\n    Lid: 60065  \n    Lid: 33777   StoreEc: 0x80040115\n   
Lid: 59805  \n    Lid: 52209   StoreEc: 0x80040115\n    Lid: 56583  \n    Lid: 52487   StoreEc: 0x80040115\n    Lid: 19778  \n    Lid: 27970  
StoreEc: 0x80040115\n    Lid: 17730  \n    Lid: 25922   StoreEc: 0x80040115\r\n   at Microsoft.Mapi.MapiExceptionHelper.InternalThro...
We are going to rebuild them a new server soon, but we would like to stop the event alerts.  Please assist.

Answer 1

Ryan
Can we get your event viewer logs?  Have you run a malwarebytes scan?  I cant find anything about that application other than on malware forums, what is it?
Please provide us with your Event Viewer administrative logs by following these steps:
Click Start Menu
Type eventvwr into Search programs and files (do not hit enter)
Right click eventvwr.exe and click Run as administrator
Expand Custom Views
Click Administrative Events
Right click Administrative Events
Save all Events in Custom View As...
Save them in a folder where you will remember which folder and save as Errors.evtx
Go to where you saved Errors.evtx
Right click Errors.evtx -> send to -> compressed (zipped) folder
Upload the .zip file to Onedrive or a file sharing service and put a link to it in your next post
If you have updated to win 8.1 and you get the error message "the system cannot find the file specified" it is a known problem.  The
work around is to edit the registry.  If you are not comfortable doing this DONT.  If you are, backup the key before you do
Press Win+"R" and input regedit
Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels. Delete "Microsoft-Windows-DxpTaskRingtone/Analytic"
Wanikiya and Dyami--Team Zigzag