RE: Exchange 2013 log

Hi,
In Exchange 2013 environment, can we check if a message was sent from phone or computer? or can any log display sender's ip address?
Thanks,
Edmond

If you look at the messages in the SentItems folder of the Mailbox then you can use the  x-ms-exchange-organization-originalclientipaddress property to get the IPAddress of the sending client eg here's one example of using that http://gsexdev.blogspot.com.au/2012/10/geolocating-users-last-send-location.html
Depending on the type of phone being used sometimes they will leave tell tale marks eg my Samsung phone always set the MessageId to <[email protected]>
but this is device dependant.
Cheers
Glen

Similar Messages

  • Exchange 2013 log list

    Can someone point me to a complete list of all of the Exchange 2013 logs that can be enabled? Trying to find information on what logs are enabled, and what information each log contains.
    Thx,
    Jeff

    Hi Jeff,
    Thank you for your question.
    There are many logs we could enable it for our troubleshooting, for example:
    Transport logs included agent log, connectivity log, protocol log and so on, we could refer to the following link:
    https://technet.microsoft.com/en-us/library/dd302434(v=exchg.150).aspx
    We could learn about mailbox audit logging by the following link:
    https://technet.microsoft.com/en-us/library/ff459237(v=exchg.150).aspx
    We could refer to the following link to learn more various of logs:
    http://blogs.technet.com/b/rischwen/archive/2013/02/21/exchange-2013-logging-and-space-requirements.aspx
    If there are any questions regarding this issue, please be free to let me know.
    Best Regard,
    Jim
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
    Jim Xu
    TechNet Community Support

  • Need help regarding the location of Exchange 2013 Logs for parsing

    Hi, I am trying to create reports based on the logs that are created on my exchange server. I am using
    exchange 2013. My problem is that I cannot handle every log, and instead want specific types of logs.
    I need help finding the specific locations of the following types of logs (If they even exist), so that I can parse them and use them effectively:
    Audit Logs (Mailbox logons, Mailbox permission changes, Mailbox property changes,
    Exchange store changes)
    Mail Report Logs (Mailbox size and growth, Mailbox storage growth, Enabled users, Expired and Soon-to-Expire Mailboxes)
    Exchange Traffic Reports (Details on size and amount of messages sent and recieved, Internet traffic [to and from], Traffic between exchange users)
    I understand this might sound like a huge undertaking, but any help that can be provided would be appreciated.
    Again, I need information on the locations of these types of logs on the exchange server, so that I can parse them. Collecting them all and searching through them is not practical for my available resources.
    Thanks,
    Matt

    Audit Logs (Mailbox logons, Mailbox permission
    changes, Mailbox property changes, Exchange
    store changes) ---- these are two type of logs, 1. mailbox audit logs and that is stored in each mailbox under dumpster
    http://technet.microsoft.com/en-us/library/ff461930(v=exchg.150).aspx however you need to
    enable
    it for individual mailboxes... 2. admin audit log, this is stored into a system mailbox dumpster.... http://technet.microsoft.com/en-us/library/dd335052(v=exchg.141).aspx
    Mail Report Logs (Mailbox size and growth, Mailbox
    storage growth, Enabled users, Expired and Soon-to-Expire Mailboxes) ---- there isn't any specific log for this, you would need to create some time of script to collect this every day for you and store it somewhere... This is a good start... http://www.stevieg.org/2011/06/exchange-environment-report/
    Exchange Traffic Reports (Details on size and
    amount of messages sent and recieved, Internet traffic [to and from], Traffic between exchange users) ----- This you can get from message tracking log... http://technet.microsoft.com/en-us/library/bb124375(v=exchg.150).aspx

  • Exchange 2013 - Logging folder - huge size

    friends i have exchange 2013 SP1... my logging folder is growing like anything .. can some one advise the best practices around it .. i am not sure how i can clean this ... same is happening with inetpub log .. is this related???.. in few months its around
    22 GB ...
    Please advise
    Thanks
    Happiness Always
    Jatin

    This is by design due to the architectural changes in the product. However have seen cases where it caused issues. you can:
    Move Logging folders to another drive in Exchange 2013 via Powershell: 
    http://social.technet.microsoft.com/wiki/contents/articles/22479.move-logging-in-exchange-2013-via-powershell.aspx 
    Or alternatively you can disable some of the tasks under Windows\PLA in the Task Scheduler Manager.
    You can also do a clean-upand delete some of the files older than a specified day.
    Get-ChildItem 'C:\Program Files\Microsoft\Exchange Server\V15\Logging','C:\inetpub\logs' -Directory | get-childitem -Include '*.log' -Recurse | ? LastWriteTime -lt (Get-Date).AddDays(-XX) | Remove-Item 
    CK

  • Exchange 2013 logging event 15004 daily 5-10 times per day causing email delay?

    Observing following event in the Servers (3 Servers having multi role with Exchange 2013 CU5)
    Log Name:      Application
    Source:        MSExchangeTransport
    Date:          15/10/2014 3:20:16 PM
    Event ID:      15004
    Task Category: ResourceManager
    Level:         Warning
    Keywords:      Classic
    User:          N/A
    Computer:      SERVER.COM
    Description:
    The resource pressure increased from Medium to High.
    The following resources are under pressure:
    Version buckets = 203 [High] [Normal=80 Medium=120 High=200]
    Physical memory load = 92% [limit is 94% to start dehydrating messages.]
    The following components are disabled due to back pressure:
    Inbound mail submission from Hub Transport servers
    Inbound mail submission from the Internet
    Mail submission from Pickup directory
    Mail submission from Replay directory
    Mail submission from Mailbox server
    Mail delivery to remote domains
    Content aggregation
    Mail resubmission from the Message Resubmission component.
    Mail resubmission from the Shadow Redundancy Component
    The following resources are in normal state:
    Queue database and disk space ("C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Queue\mail.que") = 61% [Normal] [Normal=95% Medium=97% High=99%]
    Queue database logging disk space ("C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Queue\") = 75% [Normal] [Normal=95% Medium=97% High=99%]
    Private bytes = 2% [Normal] [Normal=71% Medium=73% High=75%]
    Submission Queue = 0 [Normal] [Normal=2000 Medium=4000 High=10000]
    Temporary Storage disk space ("C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Temp") = 75% [Normal] [Normal=95% Medium=97% High=99%]
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="MSExchangeTransport" />
        <EventID Qualifiers="32772">15004</EventID>
        <Level>3</Level>
        <Task>15</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-10-15T09:50:16.000000000Z" />
        <EventRecordID>36645321</EventRecordID>
        <Channel>Application</Channel>
        <Computer>SERVER.COM</Computer>
        <Security />
      </System>
      <EventData>
        <Data>Medium</Data>
        <Data>High</Data>
        <Data>
    The following resources are under pressure:
    Version buckets = 203 [High] [Normal=80 Medium=120 High=200]
    Physical memory load = 92% [limit is 94% to start dehydrating messages.]
    The following components are disabled due to back pressure:
    Inbound mail submission from Hub Transport servers
    Inbound mail submission from the Internet
    Mail submission from Pickup directory
    Mail submission from Replay directory
    Mail submission from Mailbox server
    Mail delivery to remote domains
    Content aggregation
    Mail resubmission from the Message Resubmission component.
    Mail resubmission from the Shadow Redundancy Component
    The following resources are in normal state:
    Queue database and disk space ("C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Queue\mail.que") = 61% [Normal] [Normal=95% Medium=97% High=99%]
    Queue database logging disk space ("C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Queue\") = 75% [Normal] [Normal=95% Medium=97% High=99%]
    Private bytes = 2% [Normal] [Normal=71% Medium=73% High=75%]
    Submission Queue = 0 [Normal] [Normal=2000 Medium=4000 High=10000]
    Temporary Storage disk space ("C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Temp") = 75% [Normal] [Normal=95% Medium=97% High=99%]
    </Data>
      </EventData>
    </Event>
    Manju Gowda

    hi manju.. this is because of your resource utilization being very high. please check below two links to check the logs and take appropriate actions
    http://exchangeserverpro.com/exchange-transport-server-back-pressure/
    http://technet.microsoft.com/en-us/library/bb201658%28v=exchg.150%29.aspx
    Mark as useful or answered if my replies helped you solving your query.
    Thanks, Happiness Always
    Jatin
    Skype: jatider2jatin, Email: [email protected]

  • Exchange Server 2013 Logs Out of Control

    I have a fairly new install of Exchange Server 2013 running in full production. Everything has been great except for the high level of log files that are generated on a daily basis. I am able to truncate the Transaction logs everyday with a Server Backup,
    but that still does not help me with the other constantly growing log files in C:\Program Files\Microsoft\Exchange Server\V15\Logging. Is there any way to set these to automatically purge after a set amount of days? I have found resources that discuss setting
    up a powershell script that will delete everything after a set amount of days, but I want to know if anything in Exchange 2013 will allow me to do this. I am getting tired of expanding my VM disk. Any help would be greatly appreciated. 

    Unfortunately Exchange 2013 creates alot of log files that it does not clean up on it's own.  While there isn't a way to tell Exchange to clean up the files after X number of days, there is a very helpful script someone else has already written that does
    the work for you. He has 2 versions, 1 that you have to put on each individual server (I like that one in case I lose the server I put the script on) or 1 that you can run on 1 server that takes care of all of your Exchange Servers.
    http://www.c7solutions.com/2013/04/removing-old-exchange-2013-log-files-html
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread

  • Exchange 2013 database dismounts unexpectedly

    Errors logged on Exchange 2013:
    Log Name:      Application
    Source:        MSExchangeIS
    Date:          12/09/2013 8:22:28 AM
    Event ID:      1001
    Task Category: General
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      
    Description:
    Microsoft Exchange Server Information Store has encountered an internal logic error. Internal error text is (Unable to apply maintenance insert, index corruption?
    Log Name:      Application
    Source:        MSExchangeIS
    Date:          12/09/2013 8:22:29 AM
    Event ID:      1002
    Task Category: General
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      
    Description:
    Unhandled exception (Microsoft.Exchange.Diagnostics.ExAssertException: ASSERT: Unable to apply maintenance insert, index corruption?
    Log Name:      Application
    Source:        MSExchange Common
    Date:          12/09/2013 8:22:37 AM
    Event ID:      4999
    Task Category: General
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      
    Description:
    Watson report about to be sent for process id: 11204, with parameters: E12, c-RTL-AMD64, 15.00.0712.024, M.E.Store.Worker, M.E.S.Storage.LazyIndexing, M.E.S.S.L.LogicalIndex.HandleIndexCorruptionInternal, M.E.Diagnostics.ExAssertException, 213a, 15.00.0712.000.
    ErrorReportingEnabled: True
    KB2846288 appeared to be related but we are already on CU2:
    Name                : XXXXXXXX
    Edition             : Standard
    AdminDisplayVersion : Version 15.0 (Build 712.24)
    Anyone else?
    Ramu V Ramanan

    Randomly approx once per week. Always on the same mailbox database. 
    Drives have plenty of space, memory and pagefile are fine.
    Log Name:      Application
    Source:        MSExchangeIS
    Date:          7/05/2014 11:46:53 a.m.
    Event ID:      1001
    Task Category: General
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:     
    Description:
    Microsoft Exchange Server Information Store has encountered an internal logic error. Internal error text is (Unable to apply maintenance insert, index corruption?
    Log Name:      Application
    Source:        MSExchangeIS
    Date:          7/05/2014 11:46:53 a.m.
    Event ID:      1002
    Task Category: General
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      
    Description:
    Unhandled exception (Microsoft.Exchange.Diagnostics.ExAssertException: ASSERT: Unable to apply maintenance insert, index corruption?
    Log Name:      Application
    Source:        MSExchangeIS
    Date:          7/05/2014 11:46:53 a.m.
    Event ID:      1013
    Task Category: General
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      
    Description:
    The mailbox with mailboxguid "xxxxxxxxxxxxxx" caused crash or resource outage on database (GUID="xxxxxxxxxxxxxxx")
    Log Name:      Application
    Source:        MSExchange Common
    Date:          7/05/2014 11:46:53 a.m.
    Event ID:      4999
    Task Category: General
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:     
    Description:
    Watson report about to be sent for process id: 18108, with parameters: E12, c-RTL-AMD64, 15.00.0775.038, M.E.Store.Worker, M.E.S.Storage.LazyIndexing, M.E.S.S.L.LogicalIndex.HandleIndexCorruptionInternal, M.E.Diagnostics.ExAssertException, 213a, 15.00.0775.008.
    ErrorReportingEnabled: False

  • Seemingly successful install of Exchange 2013 SP1 turns into many errors in event logs after upgrade to CU7

    I have a new Exchange 2013 server with plans to migrate from my current Exchange 2007 Server. 
    I installed Exchange 2013 SP1 and the only errors I saw in the event log seemed to be long standing known issues that did not indicate an actual problem (based on what I read online). 
    I updated to CU7 and now lots of errors have appeared (although the old ones seem to have been fixed so I have that going for me). 
    Currently the Exchange 2013 server is not in use and clients are still hitting the 2007 server.
    Issue 1)
    After each reboot I get a Kernel-EventTracing 2 error.  I cannot find anything on this on the internet so I have no idea what it is.
    Session "FastDocTracingSession" failed to start with the following error: 0xC0000035
    I did read other accounts of this error with a different name in the quotes but still can’t tell what this is or where it is coming from.
    Issue 2)
    I am still getting 5 MSExchange Common 106 errors even after reregistering all of the perf counters per this page:
    https://support.microsoft.com/kb/2870416?wa=wsignin1.0
    One of the perf counters fails to register using the script from the link above.
    66 C:\Program Files\Microsoft\Exchange Server\V15\Setup\Perf\InfoWorkerMultiMailboxSearchPerformanceCounters.xml
    New-PerfCounters : The performance counter definition file is invalid.
    At C:\Users\administrator.<my domain>\Downloads\script\ReloadPerfCounters.ps1:19 char:4
    +    New-PerfCounters -DefinitionFileName $f
    +    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo         
    : InvalidData: (:) [New-PerfCounters], TaskException
        + FullyQualifiedErrorId : [Server=VALIS,RequestId=71b6bcde-d73e-4c14-9a32-03f06e3b2607,TimeStamp=12/18/2014 10:09:
       12 PM] [FailureCategory=Cmdlet-TaskException] 33EBD286,Microsoft.Exchange.Management.Tasks.NewPerfCounters
    But that one seems unrelated to the ones that still throw errors. 
    Three of the remaining five errors are (the forum is removing my spacing between the error text so it looks like a wall of text - sorry):
    Performance counter updating error. Counter name is Count Matched LowFidelity FingerPrint, but missed HighFidelity FingerPrint, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The
    exception thrown is : System.InvalidOperationException: The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
       at System.Diagnostics.PerformanceCounter.InitializeImpl()
       at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
    Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
       at System.Diagnostics.Process.GetProcessById(Int32 processId)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
    Performance counter updating error. Counter name is Number of items, item is matched with finger printing cache, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The exception thrown
    is : System.InvalidOperationException: The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
       at System.Diagnostics.PerformanceCounter.InitializeImpl()
       at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
    Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
       at System.Diagnostics.Process.GetProcessById(Int32 processId)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
    Performance counter updating error. Counter name is Number of items in Malware Fingerprint cache, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The exception thrown is : System.InvalidOperationException:
    The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
       at System.Diagnostics.PerformanceCounter.InitializeImpl()
       at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
    Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
       at System.Diagnostics.Process.GetProcessById(Int32 processId)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
    Issue 3)
    I appear to have some issues related to the healthmailboxes. 
    I get MSExchangeTransport 1025 errors for multiple healthmailboxes.
    SMTP rejected a (P1) mail from 'HealthMailbox23b10b91745648819139ee691dc97eb6@<my domain>.local' with 'Client Proxy <my server>' connector and the user authenticated as 'HealthMailbox23b10b91745648819139ee691dc97eb6'. The Active Directory
    lookup for the sender address returned validation errors. Microsoft.Exchange.Data.ProviderError
    I reran setup /prepareAD to try and remedy this but I am still getting some.
    Issue 4)
    I am getting an MSExchange RBAC 74 error. 
    (Process w3wp.exe, PID 984) Connection leak detected for key <my domain>.local/Admins/Administrator in Microsoft.Exchange.Configuration.Authorization.WSManBudgetManager class. Leaked Value 1.
    Issue 5)
    I am getting MSExchange Assistants 9042 warnings on both databases.
    Service MSExchangeMailboxAssistants. Probe Time Based Assistant for database Database02 (c83dbd91-7cc4-4412-912e-1b87ca6eb0ab) is exiting a work cycle. No mailboxes were successfully processed. 2 mailboxes were skipped due to errors. 0 mailboxes were
    skipped due to failure to open a store session. 0 mailboxes were retried. There are 0 mailboxes in this database remaining to be processed.
    Some research suggested this may be related to deleted mailboxes however I have never had any actual user mailboxes on this server. 
    If they are healthmailboxes or arbitration mailboxes that might make sense but I am unsure of what to do on this.
    Issue 6)
    At boot I am getting an MSExchange ActiveSync warning 1033
    The setting SupportedIPMTypes in the Web.Config file was missing. 
    Using default value of System.Collections.Generic.List`1[System.String].
    I don't know why but this forum is removing some of my spacing that would make parts of this easier to read.

    Hi Eric
    Yes I have uninstalled and reinstalled Exchange 2013 CU7 for the 3<sup>rd</sup> time. 
    I realize you said one issue per forum thread but since I already started this thread with many issues I will at least post what I have discovered on them in case someone finds their way here from a web search.
    I have an existing Exchange 2007 server in the environment so I am unable to create email address policies that are defined by “recipient container”. 
    If I try and do so I get “You can't specify the recipient container because legacy servers are detected.”
     So I cannot create a normal email address policy and restrict it to an OU without resorting to some fancy filtering. 
    Instead what I have done is use PS to modify extensionAttribute1 (otherwise known as Custom Attribute 1 to exchange) for all of my users. 
    I then applied an address policy to them and gave it the highest priority. 
    Then I set a default email address policy for the entire organization. 
    After reinstalling Exchange all of my system mailboxes were created with the internal domain name. 
    So issue number 3 above has not come up. 
    For issue number one above I have created a new thread:
    https://social.technet.microsoft.com/Forums/office/en-US/7eb12b89-ae9b-46b2-bd34-e50cd52a4c15/microsoftwindowskerneleventtracing-error-2-happens-twice-at-boot-ex2013cu7?forum=exchangesvrdeploy
    For issue number four I have posted to this existing thread where there is so far no resolution:
    https://social.technet.microsoft.com/Forums/exchange/en-US/2343730c-7303-4067-ae1a-b106cffc3583/exchange-error-id-74-connection-leak-detected-for-key?forum=exchangesvradmin
    Issue number Five I have managed to recreate and get rid of in more than one way. 
    If I create a new database in ECP and set the database and log paths where I want, then this error will appear. 
    If I create the database in the default location and then use EMS to move it and set the log path, then the error will not appear. 
    The error will also appear (along with other errors) if I delete the health mailboxes and let them get recreated by restarting the server or the Health Manager service. 
    If I then go and set the retention period for deleted mailboxes to 0 days and wait a little while, these will all go away. 
    So my off hand guess is that these are caused by orphaned system mailboxes.
    For issue number six I have posted to this existing thread where there is so far no resolution:
    https://social.technet.microsoft.com/Forums/exchange/en-US/dff62411-fad8-4d0c-9bdb-037374644845/event-1033-msexchangeactivesync-warning?forum=exchangesvrmobility
    So for the remainder of this thread we can try and tackle issue number two which is the perf counters. 
    The exact same 5 perf counter were coming up and this had been true each time I have uninstalled and reinstalled Exchange 2013CU7. 
    Actually to be more accurate a LOT of perf counter errors come up after the initial install, but reloading the perf counters using the script I posted above reduces it to the same five. 
    Using all of your suggestions so far has not removed these 5 remaining errors either.  Since there is no discernible impact other than these errors at boot I am not seriously bothered by them but as will all event log errors, I would prefer
    to make them go away if possible.

  • Can no longer log into ECP on Exchange 2013

    I am no longer able to log into my Exchange 2013 SP1 ECP site.   Here are a few items to consider:
    Installed replacement UC on 5/7/14.  Configured services POP, IMAP, SMTP, IIS. Removed IIS from existing UC which still had 6 days of life.  Both certs identical.  I did no further changes for this new cert other than install it through ECP.
    "Old" cert died 5/13/14 @ 8a.  New cert took over without any problems.  
    Continued to use ECP through close of business 5/14/14.  Late on 5/14/14 I attempted to log into ECP remotely thru a VPN to migrate users from our Exch 2007 server.  Could not access ECP.
    When I attempt to access ECP, I enter <domain>\<username> and password.  When I hit "enter" or "sign in", the page flashes and the password field is empty.
    I am still able to log into OWA
    I cannot log into ECP using the server name, localhost or cert name.
    Currently using default settings of FBA and Basic authentication
    UC is correctly bound to both front and backend of IIS (443, 444)
    Everything else is working correctly for the Exchange site.  I have been continuing my migrations through Powershell.  I just can't log into ECP.
    I created a new Exchange Admin user only to find I still could not log into ECP.
    Short Version:  I was able to login and then, after a four hour stretch, I was not able to login.  No errors on the web page or Event logs.  Exchange is routing mail correctly.
    I have scoured the web for that past couple of days looking for a solution but the issues I find are throwing up a web page with an error of some sort.  Since I'm not experiencing that issue, I'm a bit stumped.  I'm no expert, but I'm not a novice.
     Since 2013 is a new rebuild, I thought it best to ask for a little assistance.  Any advice/assistance would be appreciated.

    You might consider rebuilding the ECP virtual directory:
    http://technet.microsoft.com/en-us/library/ff629372.aspx
    With the EMS, procedure should be the same for Exchange 2010 and 2013.
    Since you state that everything else is working, other virtual directories included (OWA for ex.), it's most likely something with the ECP virtual directory.
    But even before that, I would try to look at the (rather cryptic) IIS logs and see if you cannot find any useful information there:
    http://social.technet.microsoft.com/Forums/exchange/en-US/935eeb5b-d996-4933-9cbd-0347ebad801d/how-can-i-view-exchange-iis-logs?forum=exchange2010
    There were some ideas in this thread but i think you may have seen it already?
    http://social.technet.microsoft.com/Forums/exchange/en-US/1736b5ab-e69b-4637-aa59-f2d9bd54ead2/unable-to-access-exchange-2013-eacecp-webpage?forum=exchangesvrdeploy
    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

  • Exchange 2013 Window Backup failure - fails to clean up log files - error FFFFFFFC

    Hello,
    We currently have an Exchange 2013 - Exchange 2007 coexistence setup.
    1x Windows Server 2008 R2 with Exchange 2007 CAS/HUB
    1x Windows Server 2008 R2 with Exchange 2007 MBX
    1x Windows Server 2008 R2 with Exchange 2013 CU 3 (all roles)
    Since our current backup solution (Symantec Backup Exec 2010 R3) does not support backing up Exchange 2013 CU3 databases, we are using the builtin Windows Backup feature to backup the Exchange 2013 CU3 databases.
    This has functioned for a while, until all of a sudden, the log files are not cleared anymore, causing our log disk to fill up.
    Our Exchange 2013 server looks like this:
    C: Windows + Exchange installation
    D: Databases
    E: Database Log Files
    F: Archive Databases
    G: Archive Database Log Files
    S: Dedicated backup volume
    The backup is scheduled to run every day at 21:00 hours, performing a full VSS backup of D:,E:,F: and G: to the volume S:
    Windows backup log says the backup completed with exceptions, leaving the Exchange logs untouched and filling the drive.
    The Windows Backup Command Line tools are NOT installed since they are not compatible with Exchange 2013.
    In the eventvwr we can see the following error:
    The Microsoft Exchange Replication service VSS Writer (Instance a33ec440-7f12-4c50-806b-1bc5ceaf8aad) failed with error FFFFFFFC when processing the backup completion event.
    The command VSSADMIN LIST WRITERS displays the following:
    Writer name: 'Microsoft Exchange Writer'
       Writer Id: {76fe1ac4-15f7-4bcd-987e-8e1acb462fb7}
       Writer Instance Id: {cf84a907-76dc-428c-90e0-c18a3f9db493}
       State: [1] Stable
       Last error: Retryable error
    Restarting the Microsoft Exchange Replication (MSExchangeRepl) clears the writer error, same with a reboot, however the error comes backup after the next backup.
    Any thoughts on how to resolve this issue?
    Thanks.

    Hello,
    Here is a blog for your reference.
    http://blogs.technet.com/b/timmcmic/archive/2012/03/11/exchange-and-vss-my-exchange-writer-is-in-a-failed-retryable-state.aspx
    If there is any useful information after you change the logging to expert, please free let me know.
    Cara Chen
    TechNet Community Support

  • Ms-exchange 2013 audit logs retrieving in csv format not working?

    I need help regarding pulling specific information from exchange 2013. The information pertains to mail-exchange audit logs. The exchange in my environment is ms-exchange 2013. Steps performed so far are:-
    **step#1**
        Create test Environment on Exchange Server 2010 and Active Directory:
        Two Mailboxes for testing (with dummy email messages) (i.e., test-mailbox-1, test-mailbox-2)
        Two Active Directory Accounts for testing (testAcct01, testAcct02)
        Assign Permission to Test Mailboxes: Owner of Email Box test-mailbox-1: testAcct01, Owner of Email Box test-mailbox-2: testAcct02
    **step 2**
        Enable Mailbox Auditing on the test-mailbox-1:
        Use EMS to enable mailbox auditing on mailbox: test-mailbox-1
        Commands: 
        o Set-Mailbox -Identity "test-mailbox-1" -AuditDelegate Copy,Create,FolderBind,HardDelete,Move,MoveToDeletedItems,SendAs,SendOnBehalf,SoftDelete,Update -AuditEnabled $true
        o Set-Mailbox -Identity "test-mailbox-1" -AuditAdmin Copy,Create,FolderBind,HardDelete,MessageBind,Move,MoveToDeletedItems,SendAs,SendOnBehalf,SoftDelete,Update -AuditEnabled $true
        Note: You must have permission for Organization Management and Record Management if you want to enable mailbox auditing.
    **step#3**
        Verify that the Mailbox Auditing is Successfully enabled for mailbox: test-mailbox-1:
         Use EMS to verify the settings of mailbox auditing
        Command:
        o Get-Mailbox "test-mailbox-1" | Format-List *audit*
    **step#4**
        Verify that the Mailbox Auditing is Successfully enabled for mailbox: test-mailbox-1:
        Use EMS to verify the settings of mailbox auditing
        Command:
        o Get-Mailbox "test-mailbox-1" | Format-List *audit*
    **step#5**
        Perform  test activities on mailbox “test-mailbox-1” using account id: testAcct02
        For Example: Access Inbox folder, move items from one folder to another folder, delete items, read messages, send email using SendAs and SendOnBehalf, create new folder, copy email items etc. 
    **step#6**
        Perform test activities on mailbox “test-mailbox-1” using “Administrator” Account.
        For Example: Access Inbox folder, move items from one folder to another folder, delete items, read messages, send email using SendAs and SendOnBehalf, create new folder, copy email items etc.
    **step#7**
        Use EMS Cmdlet to retrieve Mailbox audit logs for mailbox “test-mailbox-1”
        Command:
        o Search-MailboxAuditLog -Identity test-mailbox-1 -LogonTypes Admin,Delegate –ShowDetails -StartDate mm/dd/2014 -EndDate mm/dd/2014 | Export-Csv “c:\test-Audit-Results.csv”
        o New-MailboxAuditLogSearch "Admin and Delegate Access" -Mailboxes " test-mailbox-1" -LogonTypes Admin,Delegate -StartDate mm/dd/2014 -EndDate mm/dd/2014 -StatusMailRecipients [email protected]
    I'm unable to go past step#7, as I see nothing in csv file. I don't know why is this? any help.

    Hi,
    I will perform these steps in my lab and paste the result.
    Beg your patient waiting.
    Thanks
    Mavis
    Mavis Huang
    TechNet Community Support

  • After upgrade to Exchange 2013 CU6 Application log flooded with Performance counter updating error 106 for Time in Resource per second

    After upgrading to CU6 for Exchange 2013, the Application event log is flooded with MSExhange Common error 106: Performance counter updating error. Counter name is Time in Resource per second, category name is MSExchange Activity Context Resources. Optional
    code: 2. Exception: The exception thrown is : System.InvalidOperationException: Instance 'ad-powershell-defaultdomain' already exists with a lifetime of Process.  It cannot be recreated or reused until it has been removed or until the process using it
    has exited.
       at System.Diagnostics.SharedPerformanceCounter.FindInstance(Int32 instanceNameHashCode, String instanceName, CategoryEntry* categoryPointer, InstanceEntry** returnInstancePointerReference, Boolean activateUnusedInstances, PerformanceCounterInstanceLifetime
    lifetime, Boolean& foundFreeInstance)
       at System.Diagnostics.SharedPerformanceCounter.GetCounter(String counterName, String instanceName, Boolean enableReuse, PerformanceCounterInstanceLifetime lifetime)
       at System.Diagnostics.SharedPerformanceCounter..ctor(String catName, String counterName, String instanceName, PerformanceCounterInstanceLifetime lifetime)
       at System.Diagnostics.PerformanceCounter.InitializeImpl()
       at System.Diagnostics.PerformanceCounter.get_RawValue()
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.get_RawValue()
    Last worker process info : System.ArgumentException: Process with an Id of 4776 is not running.
       at System.Diagnostics.Process.GetProcessById(Int32 processId)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
    Processes running while Performance counter failed to update:
    14256 winlogon
    15748 powershell
    6524 Microsoft.Exchange.UM.CallRouter
    5904 w3wp
    584 lsass
    780 LogonUI
    4324 MSExchangeFrontendTransport
    6292 Microsoft.Exchange.Store.Worker
    2744 WmiPrvSE
    576 services
    3136 MonitoringHost
    12568 svchost
    1360 hostcontrollerservice
    8648 WmiPrvSE
    1752 SMSvcHost
    1160 spoolsv
    1356 sftracing
    9528 TiWorker
    10444 explorer
    2732 w3wp
    14908 WmiPrvSE
    3124 Microsoft.Exchange.Store.Worker
    4696 Microsoft.Exchange.Store.Service
    4892 MSExchangeMailboxAssistants
    12208 w3wp
    15740 powershell
    2128 WMSvc
    748 rundll32
    8232 w3wp
    8400 svchost
    3700 MonitoringHost
    15716 powershell
    5864 MSExchangeThrottling
    2908 w3wp
    4088 Microsoft.Exchange.EdgeSyncSvc
    5660 scanningprocess
    2292 wuauclt
    5656 umservice
    6044 scanningprocess
    4076 noderunner
    1908 MSExchangeHMHost
    2892 Microsoft.Exchange.AntispamUpdateSvc
    3876 noderunner
    3676 MSExchangeMailboxReplication
    15732 powershell
    2096 svchost
    7096 UMWorkerProcess
    516 winlogon
    908 svchost
    1296 HealthService
    1492 svchost
    2824 w3wp
    12324 dwm
    1560 ForefrontActiveDirectoryConnector
    304 smss
    10820 w3wp
    8464 svchost
    888 Microsoft.Exchange.ContentFilter.Wrapper
    5024 msexchangerepl
    488 wininit
    8564 taskhostex
    5272 Microsoft.Exchange.ServiceHost
    3832 noderunner
    10088 w3wp
    480 csrss
    7920 conhost
    872 svchost
    5992 scanningprocess
    4808 msdtc
    8352 dllhost
    860 TrustedInstaller
    4008 rundll32
    4400 conhost
    656 svchost
    9828 w3wp
    1832 noderunner
    4392 MSExchangeHMWorker
    1828 mqsvc
    700 svchost
    1628 Microsoft.Exchange.Diagnostics.Service
    3596 w3wp
    2220 Microsoft.Exchange.Directory.TopologyService
    1820 MSExchangeDelivery
    7532 MSExchangeTransport
    13372 svchost
    832 svchost
    9696 conhost
    8316 svchost
    1580 dllhost
    3980 Microsoft.Exchange.RpcClientAccess.Service
    8788 VSSVC
    5948 MSExchangeTransportLogSearch
    2992 MSExchangeDagMgmt
    10632 csrss
    1216 fms
    3776 rundll32
    5356 MSExchangeSubmission
    7908 EdgeTransport
    11576 w3wp
    1600 inetinfo
    1008 svchost
    416 csrss
    808 svchost
    7608 w3wp
    1588 updateservice
    4148 Microsoft.Exchange.Search.Service
    640 w3wp
    796 dwm
    2568 SMSvcHost
    1188 svchost
    4 System
    3484 rdpclip
    0 Idle
    Performance Counters Layout information: A process is holding onto a transport performance counter. processId : 15716, counter : time in resource per second Value=30 SpinLock=0 Lifetime=Type: 1 ProcessId: 15716 StartupTime: 130608376318179644, currentInstance
    : ad-powershell-defaultdomain(95CC324A) RefCount=1 SpinLock=0 Offset=38216, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 15716, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 15716 StartupTime: 130608376318179644, currentInstance : mb-powershell-defaultdomain(CC014C00)
    RefCount=1 SpinLock=0 Offset=37888, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 15716, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 15716 StartupTime: 130608376318179644, currentInstance : rpca-powershell-defaultdomain(4598AFAF)
    RefCount=1 SpinLock=0 Offset=37560, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 3596, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 3596 StartupTime: 130608368805385179, currentInstance : rpca-w3wp-msexchangemapimailboxapppool(E28F3117)
    RefCount=1 SpinLock=0 Offset=37232, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 3596, counter : time in resource per second Value=86 SpinLock=0 Lifetime=Type: 1 ProcessId: 3596 StartupTime: 130608368805385179, currentInstance : mb-w3wp-msexchangemapimailboxapppool(F9439F58)
    RefCount=1 SpinLock=0 Offset=36904, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 3596, counter : time in resource per second Value=301 SpinLock=0 Lifetime=Type: 1 ProcessId: 3596 StartupTime: 130608368805385179, currentInstance : ad-w3wp-msexchangemapimailboxapppool(35491652)
    RefCount=1 SpinLock=0 Offset=36576, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 10088, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 10088 StartupTime: 130608368435182301, currentInstance : rpca-w3wp-msexchangemapifrontendapppool(2C7F2005)
    RefCount=1 SpinLock=0 Offset=36248, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 10088, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 10088 StartupTime: 130608368435182301, currentInstance : mb-w3wp-msexchangemapifrontendapppool(BE5C2DAA)
    RefCount=1 SpinLock=0 Offset=35920, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 10088, counter : time in resource per second Value=50 SpinLock=0 Lifetime=Type: 1 ProcessId: 10088 StartupTime: 130608368435182301, currentInstance : ad-w3wp-msexchangemapifrontendapppool(C0FDFAE0)
    RefCount=1 SpinLock=0 Offset=35592, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 640, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 640 StartupTime: 130608368405334576, currentInstance : rpca-w3wp-msexchangeowacalendarapppool(8F10D1B5)
    RefCount=1 SpinLock=0 Offset=35264, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 640, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 640 StartupTime: 130608368405334576, currentInstance : mb-w3wp-msexchangeowacalendarapppool(2D8C9EBA)
    RefCount=1 SpinLock=0 Offset=34936, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 640, counter : time in resource per second Value=75 SpinLock=0 Lifetime=Type: 1 ProcessId: 640 StartupTime: 130608368405334576, currentInstance : ad-w3wp-msexchangeowacalendarapppool(D845E230)
    RefCount=1 SpinLock=0 Offset=34608, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 12208, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 12208 StartupTime: 130608368146087354, currentInstance : rpca-w3wp-msexchangeautodiscoverapppool(6DABF262)
    RefCount=1 SpinLock=0 Offset=34280, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 12208, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 12208 StartupTime: 130608368146087354, currentInstance : mb-w3wp-msexchangeautodiscoverapppool(D1C6EF4D)
    RefCount=1 SpinLock=0 Offset=33952, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 12208, counter : time in resource per second Value=1002 SpinLock=0 Lifetime=Type: 1 ProcessId: 12208 StartupTime: 130608368146087354, currentInstance : ad-w3wp-msexchangeautodiscoverapppool(FD072087)
    RefCount=1 SpinLock=0 Offset=33624, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 11576, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 11576 StartupTime: 130608368080143532, currentInstance : rpca-w3wp-msexchangeecpapppool(57806648)
    RefCount=1 SpinLock=0 Offset=33296, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 11576, counter : time in resource per second Value=204 SpinLock=0 Lifetime=Type: 1 ProcessId: 11576 StartupTime: 130608368080143532, currentInstance : mb-w3wp-msexchangeecpapppool(E27E6507)
    RefCount=1 SpinLock=0 Offset=32968, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 11576, counter : time in resource per second Value=1804 SpinLock=0 Lifetime=Type: 1 ProcessId: 11576 StartupTime: 130608368080143532, currentInstance : ad-w3wp-msexchangeecpapppool(B648688D)
    RefCount=1 SpinLock=0 Offset=32640, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 10820, counter : time in resource per second Value=64 SpinLock=0 Lifetime=Type: 1 ProcessId: 10820 StartupTime: 130608368364391554, currentInstance : ad-w3wp-msexchangeoabapppool(CC31A917)
    RefCount=1 SpinLock=0 Offset=32312, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 10820, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 10820 StartupTime: 130608368364391554, currentInstance : mb-w3wp-msexchangeoabapppool(58D0A79D)
    RefCount=1 SpinLock=0 Offset=31984, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 10820, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 10820 StartupTime: 130608368364391554, currentInstance : rpca-w3wp-msexchangeoabapppool(8149E8D2)
    RefCount=1 SpinLock=0 Offset=31656, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 7608, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7608 StartupTime: 130608367931073979, currentInstance : rpca-w3wp-msexchangeowaapppool(4AA799E7)
    RefCount=1 SpinLock=0 Offset=31328, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 7608, counter : time in resource per second Value=792 SpinLock=0 Lifetime=Type: 1 ProcessId: 7608 StartupTime: 130608367931073979, currentInstance : mb-w3wp-msexchangeowaapppool(C3953468)
    RefCount=1 SpinLock=0 Offset=31000, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 7608, counter : time in resource per second Value=2537 SpinLock=0 Lifetime=Type: 1 ProcessId: 7608 StartupTime: 130608367931073979, currentInstance : ad-w3wp-msexchangeowaapppool(160BE662)
    RefCount=1 SpinLock=0 Offset=30672, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5904, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5904 StartupTime: 130608367955918049, currentInstance : rpca-w3wp-msexchangepowershellapppool(3CF18BF)
    RefCount=1 SpinLock=0 Offset=30344, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5904, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5904 StartupTime: 130608367955918049, currentInstance : mb-w3wp-msexchangepowershellapppool(A686C810)
    RefCount=1 SpinLock=0 Offset=30016, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5904, counter : time in resource per second Value=2178 SpinLock=0 Lifetime=Type: 1 ProcessId: 5904 StartupTime: 130608367955918049, currentInstance : ad-w3wp-msexchangepowershellapppool(9E48CD5A)
    RefCount=1 SpinLock=0 Offset=29688, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 3832, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 3832 StartupTime: 130608365723574632, currentInstance : rpca-noderunner-contentenginenode1(316BF6E3)
    RefCount=1 SpinLock=0 Offset=29360, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 3832, counter : time in resource per second Value=1148 SpinLock=0 Lifetime=Type: 1 ProcessId: 3832 StartupTime: 130608365723574632, currentInstance : mb-noderunner-contentenginenode1(2EE8286C)
    RefCount=1 SpinLock=0 Offset=29032, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 3832, counter : time in resource per second Value=322 SpinLock=0 Lifetime=Type: 1 ProcessId: 3832 StartupTime: 130608365723574632, currentInstance : ad-noderunner-contentenginenode1(61591E6)
    RefCount=1 SpinLock=0 Offset=28704, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 8232, counter : time in resource per second Value=73 SpinLock=0 Lifetime=Type: 1 ProcessId: 8232 StartupTime: 130608367954980517, currentInstance : ad-w3wp-msexchangepowershellfrontendapppool(FAEFA1B4)
    RefCount=1 SpinLock=0 Offset=28376, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 8232, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 8232 StartupTime: 130608367954980517, currentInstance : mb-w3wp-msexchangepowershellfrontendapppool(34B9187E)
    RefCount=1 SpinLock=0 Offset=28048, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 8232, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 8232 StartupTime: 130608367954980517, currentInstance : rpca-w3wp-msexchangepowershellfrontendapppool(E1115251)
    RefCount=1 SpinLock=0 Offset=27720, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 9828, counter : time in resource per second Value=909 SpinLock=0 Lifetime=Type: 1 ProcessId: 9828 StartupTime: 130608367291344391, currentInstance : ad-w3wp-msexchangerpcproxyapppool(99BB8ED6)
    RefCount=1 SpinLock=0 Offset=27392, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 9828, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 9828 StartupTime: 130608367291344391, currentInstance : mb-w3wp-msexchangerpcproxyapppool(B190F21C)
    RefCount=1 SpinLock=0 Offset=27064, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 9828, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 9828 StartupTime: 130608367291344391, currentInstance : rpca-w3wp-msexchangerpcproxyapppool(8B7590B3)
    RefCount=1 SpinLock=0 Offset=26736, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 7908, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7908 StartupTime: 130608366316230865, currentInstance : rpca-edgetransport-edgetransport.exe(911B6EB3)
    RefCount=1 SpinLock=0 Offset=26408, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 7908, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7908 StartupTime: 130608366316230865, currentInstance : mb-edgetransport-edgetransport.exe(A5AF4BBC)
    RefCount=1 SpinLock=0 Offset=26080, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 7908, counter : time in resource per second Value=679 SpinLock=0 Lifetime=Type: 1 ProcessId: 7908 StartupTime: 130608366316230865, currentInstance : ad-edgetransport-edgetransport.exe(E79D4A36)
    RefCount=1 SpinLock=0 Offset=25752, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 7096, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7096 StartupTime: 130608366107949622, currentInstance : rpca-umworkerprocess-umworkerprocess.exe(970CCE33)
    RefCount=1 SpinLock=0 Offset=25424, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 7096, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7096 StartupTime: 130608366107949622, currentInstance : mb-umworkerprocess-umworkerprocess.exe(8A7F8A3C)
    RefCount=1 SpinLock=0 Offset=25096, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 7096, counter : time in resource per second Value=89 SpinLock=0 Lifetime=Type: 1 ProcessId: 7096 StartupTime: 130608366107949622, currentInstance : ad-umworkerprocess-umworkerprocess.exe(95818B6)
    RefCount=1 SpinLock=0 Offset=24768, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 7532, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7532 StartupTime: 130608366287637157, currentInstance : rpca-msexchangetransport-msexchangetransport.exe(24F56C33)
    RefCount=1 SpinLock=0 Offset=24440, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 7532, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7532 StartupTime: 130608366287637157, currentInstance : mb-msexchangetransport-msexchangetransport.exe(92FB3D3C)
    RefCount=1 SpinLock=0 Offset=24112, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 7532, counter : time in resource per second Value=12 SpinLock=0 Lifetime=Type: 1 ProcessId: 7532 StartupTime: 130608366287637157, currentInstance : ad-msexchangetransport-msexchangetransport.exe(2447ECB6)
    RefCount=1 SpinLock=0 Offset=23784, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 6292, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 6292 StartupTime: 130608366134668487, currentInstance : rpca-microsoft.exchange.store.worker-microsoft.exchange.store.worker.exe(ABB009B3)
    RefCount=1 SpinLock=0 Offset=23456, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 6292, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 6292 StartupTime: 130608366134668487, currentInstance : mb-microsoft.exchange.store.worker-microsoft.exchange.store.worker.exe(38BA31BC)
    RefCount=1 SpinLock=0 Offset=23128, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 6292, counter : time in resource per second Value=704 SpinLock=0 Lifetime=Type: 1 ProcessId: 6292 StartupTime: 130608366134668487, currentInstance : ad-microsoft.exchange.store.worker-microsoft.exchange.store.worker.exe(11106236)
    RefCount=1 SpinLock=0 Offset=22800, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 6524, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 6524 StartupTime: 130608366054199628, currentInstance : rpca-microsoft.exchange.um.callrouter-microsoft.exchange.um.callrouter.exe(E8475353)
    RefCount=1 SpinLock=0 Offset=22472, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 6524, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 6524 StartupTime: 130608366054199628, currentInstance : mb-microsoft.exchange.um.callrouter-microsoft.exchange.um.callrouter.exe(8F65881C)
    RefCount=1 SpinLock=0 Offset=22144, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 6524, counter : time in resource per second Value=40 SpinLock=0 Lifetime=Type: 1 ProcessId: 6524 StartupTime: 130608366054199628, currentInstance : ad-microsoft.exchange.um.callrouter-microsoft.exchange.um.callrouter.exe(78F52196)
    RefCount=1 SpinLock=0 Offset=21816, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5656, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5656 StartupTime: 130608365987637119, currentInstance : rpca-umservice-umservice.exe(E39A1133)
    RefCount=1 SpinLock=0 Offset=21488, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5656, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5656 StartupTime: 130608365987637119, currentInstance : mb-umservice-umservice.exe(FFBB273C) RefCount=1
    SpinLock=0 Offset=21160, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5656, counter : time in resource per second Value=45 SpinLock=0 Lifetime=Type: 1 ProcessId: 5656 StartupTime: 130608365987637119, currentInstance : ad-umservice-umservice.exe(9A8AC6B6) RefCount=1
    SpinLock=0 Offset=20832, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5948, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5948 StartupTime: 130608365970762140, currentInstance : rpca-msexchangetransportlogsearch-msexchangetransportlogsearch.exe(EF66F2D3)
    RefCount=1 SpinLock=0 Offset=20504, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5948, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5948 StartupTime: 130608365970762140, currentInstance : mb-msexchangetransportlogsearch-msexchangetransportlogsearch.exe(B020391C)
    RefCount=1 SpinLock=0 Offset=20176, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5948, counter : time in resource per second Value=28 SpinLock=0 Lifetime=Type: 1 ProcessId: 5948 StartupTime: 130608365970762140, currentInstance : ad-msexchangetransportlogsearch-msexchangetransportlogsearch.exe(20578116)
    RefCount=1 SpinLock=0 Offset=19848, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5864, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5864 StartupTime: 130608365966074661, currentInstance : rpca-msexchangethrottling-msexchangethrottling.exe(8C1DA893)
    RefCount=1 SpinLock=0 Offset=19520, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5864, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5864 StartupTime: 130608365966074661, currentInstance : mb-msexchangethrottling-msexchangethrottling.exe(AB2BADDC)
    RefCount=1 SpinLock=0 Offset=19192, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5864, counter : time in resource per second Value=8 SpinLock=0 Lifetime=Type: 1 ProcessId: 5864 StartupTime: 130608365966074661, currentInstance : ad-msexchangethrottling-msexchangethrottling.exe(8962F4D6)
    RefCount=1 SpinLock=0 Offset=18864, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5356, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5356 StartupTime: 130608365930918390, currentInstance : rpca-msexchangesubmission-msexchangesubmission.exe(60747EB3)
    RefCount=1 SpinLock=0 Offset=18536, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5356, counter : time in resource per second Value=400 SpinLock=0 Lifetime=Type: 1 ProcessId: 5356 StartupTime: 130608365930918390, currentInstance : mb-msexchangesubmission-msexchangesubmission.exe(67B4173C)
    RefCount=1 SpinLock=0 Offset=18208, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5356, counter : time in resource per second Value=390 SpinLock=0 Lifetime=Type: 1 ProcessId: 5356 StartupTime: 130608365930918390, currentInstance : ad-msexchangesubmission-msexchangesubmission.exe(85200236)
    RefCount=1 SpinLock=0 Offset=17880, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 3980, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 3980 StartupTime: 130608365902793374, currentInstance : rpca-microsoft.exchange.rpcclientaccess.service-microsoft.exchange.rpcclientaccess.service.exe(E4305E13)
    RefCount=1 SpinLock=0 Offset=17552, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 3980, counter : time in resource per second Value=15105 SpinLock=0 Lifetime=Type: 1 ProcessId: 3980 StartupTime: 130608365902793374, currentInstance : mb-microsoft.exchange.rpcclientaccess.service-microsoft.exchange.rpcclientaccess.service.exe(BBA60BDC)
    RefCount=1 SpinLock=0 Offset=17224, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 3980, counter : time in resource per second Value=1570 SpinLock=0 Lifetime=Type: 1 ProcessId: 3980 StartupTime: 130608365902793374, currentInstance : ad-microsoft.exchange.rpcclientaccess.service-microsoft.exchange.rpcclientaccess.service.exe(B6581E56)
    RefCount=1 SpinLock=0 Offset=16896, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 3676, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 3676 StartupTime: 130608365883887116, currentInstance : rpca-msexchangemailboxreplication-msexchangemailboxreplication.exe(276F4DB3)
    RefCount=1 SpinLock=0 Offset=16568, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 3676, counter : time in resource per second Value=55 SpinLock=0 Lifetime=Type: 1 ProcessId: 3676 StartupTime: 130608365883887116, currentInstance : mb-msexchangemailboxreplication-msexchangemailboxreplication.exe(95E41BC)
    RefCount=1 SpinLock=0 Offset=16240, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 3676, counter : time in resource per second Value=1045 SpinLock=0 Lifetime=Type: 1 ProcessId: 3676 StartupTime: 130608365883887116, currentInstance : ad-msexchangemailboxreplication-msexchangemailboxreplication.exe(394712B6)
    RefCount=1 SpinLock=0 Offset=15912, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5272, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5272 StartupTime: 130608365924980876, currentInstance : rpca-microsoft.exchange.servicehost-microsoft.exchange.servicehost.exe(39C8D53)
    RefCount=1 SpinLock=0 Offset=15584, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5272, counter : time in resource per second Value=13 SpinLock=0 Lifetime=Type: 1 ProcessId: 5272 StartupTime: 130608365924980876, currentInstance : mb-microsoft.exchange.servicehost-microsoft.exchange.servicehost.exe(E7963A1C)
    RefCount=1 SpinLock=0 Offset=15256, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 5272, counter : time in resource per second Value=1004 SpinLock=0 Lifetime=Type: 1 ProcessId: 5272 StartupTime: 130608365924980876, currentInstance : ad-microsoft.exchange.servicehost-microsoft.exchange.servicehost.exe(10E8B196)
    RefCount=1 SpinLock=0 Offset=14928, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 4892, counter : time in resource per second Value=2260 SpinLock=0 Lifetime=Type: 1 ProcessId: 4892 StartupTime: 130608365821855891, currentInstance : rpca-msexchangemailboxassistants-msexchangemailboxassistants.exe(DEAC0933)
    RefCount=1 SpinLock=0 Offset=14600, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 4892, counter : time in resource per second Value=19900 SpinLock=0 Lifetime=Type: 1 ProcessId: 4892 StartupTime: 130608365821855891, currentInstance : mb-msexchangemailboxassistants-msexchangemailboxassistants.exe(A754293C)
    RefCount=1 SpinLock=0 Offset=14272, categoryName: MSExchange Activity Context Resources
    A process is holding onto a transport performance counter. processId : 4892, counter : time in resource per second Value=3491 SpinLock=0 Lifetime=Type: 1 ProcessId: 4892 StartupTime: 130608365821855891, currentInstance : ad-msexchangemailboxassistants-msexchangemailboxassistants.exe(EE890EB6)
    RefCount=1 SpinLock=0 Offset=13944, categoryName...

    This error is not resolved in CU8.
    [PS] C:\>Get-ExchangeServer | fl *version*
    AdminDisplayVersion : Version 15.0 (Build 1076.9)
    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
    <Provider Name="MSExchange Common" />
    <EventID Qualifiers="49156">106</EventID>
    <Level>2</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-04-15T10:14:22.000000000Z" />
    <EventRecordID>11366785</EventRecordID>
    <Channel>Application</Channel>
    <Computer>EX1.domain.com</Computer>
    <Security />
    </System>
    - <EventData>
    <Data>2</Data>
    <Data>Time in Resource per second</Data>
    <Data>MSExchange Activity Context Resources</Data>
    <Data>The exception thrown is : System.InvalidOperationException: Instance 'ad-powershell-defaultdomain' already exists with a lifetime of Process. It cannot be recreated or reused until it has been removed or until the process using it has exited. at System.Diagnostics.SharedPerformanceCounter.FindInstance(Int32 instanceNameHashCode, String instanceName, CategoryEntry* categoryPointer, InstanceEntry** returnInstancePointerReference, Boolean activateUnusedInstances, PerformanceCounterInstanceLifetime lifetime, Boolean& foundFreeInstance) at System.Diagnostics.SharedPerformanceCounter.GetCounter(String counterName, String instanceName, Boolean enableReuse, PerformanceCounterInstanceLifetime lifetime) at System.Diagnostics.SharedPerformanceCounter..ctor(String catName, String counterName, String instanceName, PerformanceCounterInstanceLifetime lifetime) at System.Diagnostics.PerformanceCounter.InitializeImpl() at System.Diagnostics.PerformanceCounter.get_RawValue() at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.get_RawValue() Last worker process info : System.ArgumentException: Process with an Id of 884 is not running. at System.Diagnostics.Process.GetProcessById(Int32 processId) at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo() Processes running while Performance counter failed to update: 15084 w3wp 16804 powershell 16368 SCNotification 21108 conhost 22744 dllhost 17224 conhost 844 MsMpEng 21100 conhost 5580 taskhostex 1724 Microsoft.Exchange.Diagnostics.Service 3852 MSExchangeDagMgmt 13764 MonitoringHost 1264 fms 832 LogonUI 25828 mmc 1688 inetinfo 7900 Microsoft.Exchange.Store.Worker 3840 rundll32 1252 SMSvcHost 15040 msseces 3916 w3wp 1676 svchost 2968 Microsoft.Exchange.Directory.TopologyService 14600 explorer 5548 MSExchangeMailboxReplication 1236 svchost 5976 scanningprocess 2096 WMSvc 2200 w3wp 13376 WmiPrvSE 19472 powershell 8116 umservice 24492 powershell 24060 conhost 7204 MSExchangeTransportLogSearch 1812 WmiPrvSE 16348 w3wp 10260 svchost 2496 conhost 3784 Microsoft.Exchange.AntispamUpdateSvc 9932 Microsoft.Exchange.ContentFilter.Wrapper 16280 conhost 2056 svchost 1192 spoolsv 2052 noderunner 320 smss 5920 scanningprocess 11152 ParserServer 8068 UMWorkerProcess 3756 conhost 304 svchost 2888 w3wp 732 svchost 1900 winlogon 14948 w3wp 22700 noderunner 2872 updateservice 2000 w3wp 700 svchost 1992 mqsvc 4128 Microsoft.Exchange.EdgeSyncSvc 28636 ParserServer 17912 conhost 20652 ParserServer 1960 svchost 14168 msdtc 11436 ParserServer 19192 ParserServer 4536 Microsoft.Exchange.Imap4Service 16168 WmiPrvSE 10132 w3wp 27800 noderunner 25644 mmc 2452 ParserServer 640 lsass 1932 svchost 632 services 3216 ForefrontActiveDirectoryConnector 17436 svchost 4504 Microsoft.Exchange.Store.Service 4500 ParserServer 2772 WmiPrvSE 28200 dllhost 10528 VSSVC 10520 dllhost 7932 Microsoft.Exchange.Store.Worker 1032 rundll32 1920 sftracing 7492 Microsoft.Exchange.Store.Worker 14384 rdpclip 26016 conhost 24464 powershell 13332 MSExchangeHMHost 1008 svchost 10920 csrss 7040 MSExchangeThrottling 3160 MSExchangeTransport 1004 svchost 572 winlogon 7464 Microsoft.Exchange.Store.Worker 10880 WmiPrvSE 7892 Microsoft.Exchange.Store.Worker 12632 CcmExec 992 svchost 10904 WmiPrvSE 4868 Microsoft.Exchange.Imap4Service 6160 w3wp 14348 conhost 8312 dllhost 14776 w3wp 13480 dwm 5720 Microsoft.Exchange.Pop3 544 wininit 7008 Microsoft.Exchange.UM.CallRouter 4420 Microsoft.Exchange.Imap4 6140 Microsoft.Exchange.Pop3 5764 Microsoft.Exchange.Pop3Service 964 svchost 7428 Microsoft.Exchange.Store.Worker 13580 MonitoringHost 25096 noderunner 5700 scanningprocess 13456 conhost 24656 MSExchangeMailboxAssistants 5260 Microsoft.Exchange.RpcClientAccess.Service 6080 Microsoft.Exchange.Search.Service 11288 powershell 3960 MSExchangeDelivery 4440 MSExchangeFrontendTransport 6112 Microsoft.Exchange.Store.Worker 12712 ParserServer 5248 conhost 1368 HealthService 6536 MSExchangeSubmission 26076 conhost 3084 rundll32 6100 Microsoft.Exchange.Pop3Service 24200 conhost 536 csrss 7812 Microsoft.Exchange.Store.Worker 10396 svchost 10824 conhost 21596 MSExchangeHMWorker 7416 Microsoft.Exchange.Store.Worker 852 dwm 7368 Microsoft.Exchange.Store.Worker 468 csrss 17552 conhost 2260 SMSvcHost 12100 CmRcService 4772 Microsoft.Exchange.Imap4 10372 ParserServer 3044 EdgeTransport 4760 conhost 14672 svchost 15100 hostcontrollerservice 6048 msexchangerepl 5616 Microsoft.Exchange.Store.Worker 436 svchost 4 System 6408 Microsoft.Exchange.ServiceHost 0 Idle Performance Counters Layout information: A process is holding onto a transport performance counter. processId : 23084, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 23084 StartupTime: 130735656036583286, currentInstance : rpca-e14cmdletswrapper-defaultdomain(B61B0DD9) RefCount=0 SpinLock=0 Offset=40184, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 23084, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 23084 StartupTime: 130735656036583286, currentInstance : mb-e14cmdletswrapper-defaultdomain(290EF16) RefCount=0 SpinLock=0 Offset=39856, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 23084, counter : time in resource per second Value=102 SpinLock=0 Lifetime=Type: 1 ProcessId: 23084 StartupTime: 130735656036583286, currentInstance : ad-e14cmdletswrapper-defaultdomain(2CDA669C) RefCount=0 SpinLock=0 Offset=39528, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 11288, counter : time in resource per second Value=81 SpinLock=0 Lifetime=Type: 1 ProcessId: 11288 StartupTime: 130735664378248405, currentInstance : ad-powershell-defaultdomain(95CC324A) RefCount=1 SpinLock=0 Offset=39200, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 11288, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 11288 StartupTime: 130735664378248405, currentInstance : mb-powershell-defaultdomain(CC014C00) RefCount=1 SpinLock=0 Offset=38872, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 11288, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 11288 StartupTime: 130735664378248405, currentInstance : rpca-powershell-defaultdomain(4598AFAF) RefCount=1 SpinLock=0 Offset=38544, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 3044, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 3044 StartupTime: 130732607834359955, currentInstance : rpca-edgetransport-edgetransport.exe(911B6EB3) RefCount=1 SpinLock=0 Offset=38216, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 3044, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 3044 StartupTime: 130732607834359955, currentInstance : mb-edgetransport-edgetransport.exe(A5AF4BBC) RefCount=1 SpinLock=0 Offset=37888, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 3044, counter : time in resource per second Value=400734 SpinLock=0 Lifetime=Type: 1 ProcessId: 3044 StartupTime: 130732607834359955, currentInstance : ad-edgetransport-edgetransport.exe(E79D4A36) RefCount=1 SpinLock=0 Offset=37560, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 2200, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 2200 StartupTime: 130730082646643505, currentInstance : rpca-w3wp-msexchangeowaapppool(4AA799E7) RefCount=0 SpinLock=0 Offset=37232, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 2200, counter : time in resource per second Value=280053 SpinLock=0 Lifetime=Type: 1 ProcessId: 2200 StartupTime: 130730082646643505, currentInstance : mb-w3wp-msexchangeowaapppool(C3953468) RefCount=0 SpinLock=0 Offset=36904, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 2200, counter : time in resource per second Value=142126 SpinLock=0 Lifetime=Type: 1 ProcessId: 2200 StartupTime: 130730082646643505, currentInstance : ad-w3wp-msexchangeowaapppool(160BE662) RefCount=0 SpinLock=0 Offset=36576, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 14776, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 14776 StartupTime: 130730081973252112, currentInstance : rpca-w3wp-msexchangepowershellapppool(3CF18BF) RefCount=0 SpinLock=0 Offset=36248, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 14776, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 14776 StartupTime: 130730081973252112, currentInstance : mb-w3wp-msexchangepowershellapppool(A686C810) RefCount=0 SpinLock=0 Offset=35920, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 14776, counter : time in resource per second Value=2068875 SpinLock=0 Lifetime=Type: 1 ProcessId: 14776 StartupTime: 130730081973252112, currentInstance : ad-w3wp-msexchangepowershellapppool(9E48CD5A) RefCount=0 SpinLock=0 Offset=35592, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 15084, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 15084 StartupTime: 130730081886009912, currentInstance : rpca-w3wp-msexchangeoabapppool(8149E8D2) RefCount=0 SpinLock=0 Offset=35264, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 15084, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 15084 StartupTime: 130730081886009912, currentInstance : mb-w3wp-msexchangeoabapppool(58D0A79D) RefCount=0 SpinLock=0 Offset=34936, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 15084, counter : time in resource per second Value=55883 SpinLock=0 Lifetime=Type: 1 ProcessId: 15084 StartupTime: 130730081886009912, currentInstance : ad-w3wp-msexchangeoabapppool(CC31A917) RefCount=0 SpinLock=0 Offset=34608, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 14948, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 14948 StartupTime: 130730081557522734, currentInstance : rpca-w3wp-msexchangepowershellfrontendapppool(E1115251) RefCount=0 SpinLock=0 Offset=34280, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 14948, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 14948 StartupTime: 130730081557522734, currentInstance : mb-w3wp-msexchangepowershellfrontendapppool(34B9187E) RefCount=0 SpinLock=0 Offset=33952, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 14948, counter : time in resource per second Value=1576 SpinLock=0 Lifetime=Type: 1 ProcessId: 14948 StartupTime: 130730081557522734, currentInstance : ad-w3wp-msexchangepowershellfrontendapppool(FAEFA1B4) RefCount=0 SpinLock=0 Offset=33624, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 13332, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 13332 StartupTime: 130730081246077528, currentInstance : rpca-msexchangehmhost-msexchangehmhost.exe(87A5B053) RefCount=0 SpinLock=0 Offset=33296, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 13332, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 13332 StartupTime: 130730081246077528, currentInstance : mb-msexchangehmhost-msexchangehmhost.exe(FB9D599C) RefCount=0 SpinLock=0 Offset=32968, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 13332, counter : time in resource per second Value=20422 SpinLock=0 Lifetime=Type: 1 ProcessId: 13332 StartupTime: 130730081246077528, currentInstance : ad-msexchangehmhost-msexchangehmhost.exe(4E220B96) RefCount=0 SpinLock=0 Offset=32640, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 27800, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 27800 StartupTime: 130732559851229547, currentInstance : rpca-noderunner-contentenginenode1(316BF6E3) RefCount=1 SpinLock=0 Offset=32312, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 27800, counter : time in resource per second Value=250572035 SpinLock=0 Lifetime=Type: 1 ProcessId: 27800 StartupTime: 130732559851229547, currentInstance : mb-noderunner-contentenginenode1(2EE8286C) RefCount=1 SpinLock=0 Offset=31984, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 27800, counter : time in resource per second Value=309575 SpinLock=0 Lifetime=Type: 1 ProcessId: 27800 StartupTime: 130732559851229547, currentInstance : ad-noderunner-contentenginenode1(61591E6) RefCount=1 SpinLock=0 Offset=31656, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 21596, counter : time in resource per second Value=276568 SpinLock=0 Lifetime=Type: 1 ProcessId: 21596 StartupTime: 130732616321024370, currentInstance : ad-msexchangehmworker-msexchangehmworker.exe(712B0516) RefCount=1 SpinLock=0 Offset=31328, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 21596, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 21596 StartupTime: 130732616321024370, currentInstance : mb-msexchangehmworker-msexchangehmworker.exe(6177C09C) RefCount=1 SpinLock=0 Offset=31000, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 21596, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 21596 StartupTime: 130732616321024370, currentInstance : rpca-msexchangehmworker-msexchangehmworker.exe(39325ED3) RefCount=1 SpinLock=0 Offset=30672, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 8068, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 8068 StartupTime: 130730079342620471, currentInstance : rpca-umworkerprocess-umworkerprocess.exe(970CCE33) RefCount=0 SpinLock=0 Offset=30344, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 8068, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 8068 StartupTime: 130730079342620471, currentInstance : mb-umworkerprocess-umworkerprocess.exe(8A7F8A3C) RefCount=0 SpinLock=0 Offset=30016, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 8068, counter : time in resource per second Value=489 SpinLock=0 Lifetime=Type: 1 ProcessId: 8068 StartupTime: 130730079342620471, currentInstance : ad-umworkerprocess-umworkerprocess.exe(95818B6) RefCount=0 SpinLock=0 Offset=29688, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 16348, counter : time in resource per second Value=393256 SpinLock=0 Lifetime=Type: 1 ProcessId: 16348 StartupTime: 130730082964967615, currentInstance : ad-w3wp-msexchangeecpapppool(B648688D) RefCount=0 SpinLock=0 Offset=29360, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 16348, counter : time in resource per second Value=4885 SpinLock=0 Lifetime=Type: 1 ProcessId: 16348 StartupTime: 130730082964967615, currentInstance : mb-w3wp-msexchangeecpapppool(E27E6507) RefCount=0 SpinLock=0 Offset=29032, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 16348, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 16348 StartupTime: 130730082964967615, currentInstance : rpca-w3wp-msexchangeecpapppool(57806648) RefCount=0 SpinLock=0 Offset=28704, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 3160, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 3160 StartupTime: 130732607510143268, currentInstance : rpca-msexchangetransport-msexchangetransport.exe(24F56C33) RefCount=1 SpinLock=0 Offset=28376, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 3160, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 3160 StartupTime: 130732607510143268, currentInstance : mb-msexchangetransport-msexchangetransport.exe(92FB3D3C) RefCount=1 SpinLock=0 Offset=28048, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 3160, counter : time in resource per second Value=42 SpinLock=0 Lifetime=Type: 1 ProcessId: 3160 StartupTime: 130732607510143268, currentInstance : ad-msexchangetransport-msexchangetransport.exe(2447ECB6) RefCount=1 SpinLock=0 Offset=27720, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 7008, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7008 StartupTime: 130730079088089233, currentInstance : rpca-microsoft.exchange.um.callrouter-microsoft.exchange.um.callrouter.exe(E8475353) RefCount=0 SpinLock=0 Offset=27392, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 7008, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7008 StartupTime: 130730079088089233, currentInstance : mb-microsoft.exchange.um.callrouter-microsoft.exchange.um.callrouter.exe(8F65881C) RefCount=0 SpinLock=0 Offset=27064, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 7008, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7008 StartupTime: 130730079088089233, currentInstance : ad-microsoft.exchange.um.callrouter-microsoft.exchange.um.callrouter.exe(78F52196) RefCount=0 SpinLock=0 Offset=26736, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 8116, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 8116 StartupTime: 130730078965276725, currentInstance : rpca-umservice-umservice.exe(E39A1133) RefCount=0 SpinLock=0 Offset=26408, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 8116, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 8116 StartupTime: 130730078965276725, currentInstance : mb-umservice-umservice.exe(FFBB273C) RefCount=0 SpinLock=0 Offset=26080, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 8116, counter : time in resource per second Value=555 SpinLock=0 Lifetime=Type: 1 ProcessId: 8116 StartupTime: 130730078965276725, currentInstance : ad-umservice-umservice.exe(9A8AC6B6) RefCount=0 SpinLock=0 Offset=25752, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 7900, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7900 StartupTime: 130730078996839212, currentInstance : rpca-microsoft.exchange.store.worker-microsoft.exchange.store.worker.exe(ABB009B3) RefCount=0 SpinLock=0 Offset=25424, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 7900, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7900 StartupTime: 130730078996839212, currentInstance : mb-microsoft.exchange.store.worker-microsoft.exchange.store.worker.exe(38BA31BC) RefCount=0 SpinLock=0 Offset=25096, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 7900, counter : time in resource per second Value=218529 SpinLock=0 Lifetime=Type: 1 ProcessId: 7900 StartupTime: 130730078996839212, currentInstance : ad-microsoft.exchange.store.worker-microsoft.exchange.store.worker.exe(11106236) RefCount=0 SpinLock=0 Offset=24768, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 7204, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7204 StartupTime: 130730078901370474, currentInstance : rpca-msexchangetransportlogsearch-msexchangetransportlogsearch.exe(EF66F2D3) RefCount=0 SpinLock=0 Offset=24440, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 7204, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7204 StartupTime: 130730078901370474, currentInstance : mb-msexchangetransportlogsearch-msexchangetransportlogsearch.exe(B020391C) RefCount=0 SpinLock=0 Offset=24112, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 7204, counter : time in resource per second Value=611 SpinLock=0 Lifetime=Type: 1 ProcessId: 7204 StartupTime: 130730078901370474, currentInstance : ad-msexchangetransportlogsearch-msexchangetransportlogsearch.exe(20578116) RefCount=0 SpinLock=0 Offset=23784, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 4868, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 4868 StartupTime: 130730078594026714, currentInstance : rpca-microsoft.exchange.imap4service-microsoft.exchange.imap4service.exe(128A1B3) RefCount=0 SpinLock=0 Offset=23456, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 4868, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 4868 StartupTime: 130730078594026714, currentInstance : mb-microsoft.exchange.imap4service-microsoft.exchange.imap4service.exe(B4CBDCBC) RefCount=0 SpinLock=0 Offset=23128, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 4868, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 4868 StartupTime: 130730078594026714, currentInstance : ad-microsoft.exchange.imap4service-microsoft.exchange.imap4service.exe(F0E98836) RefCount=0 SpinLock=0 Offset=22800, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 5764, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5764 StartupTime: 130730078701682966, currentInstance : rpca-microsoft.exchange.pop3service-microsoft.exchange.pop3service.exe(8961F613) RefCount=0 SpinLock=0 Offset=22472, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 5764, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5764 StartupTime: 130730078701682966, currentInstance : mb-microsoft.exchange.pop3service-microsoft.exchange.pop3service.exe(3C128D5C) RefCount=0 SpinLock=0 Offset=22144, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 5764, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5764 StartupTime: 130730078701682966, currentInstance : ad-microsoft.exchange.pop3service-microsoft.exchange.pop3service.exe(96BB056) RefCount=0 SpinLock=0 Offset=21816, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 7040, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7040 StartupTime: 130730078816526722, currentInstance : rpca-msexchangethrottling-msexchangethrottling.exe(8C1DA893) RefCount=0 SpinLock=0 Offset=21488, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 7040, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7040 StartupTime: 130730078816526722, currentInstance : mb-msexchangethrottling-msexchangethrottling.exe(AB2BADDC) RefCount=0 SpinLock=0 Offset=21160, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 7040, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7040 StartupTime: 130730078816526722, currentInstance : ad-msexchangethrottling-msexchangethrottling.exe(8962F4D6) RefCount=0 SpinLock=0 Offset=20832, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 6536, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 6536 StartupTime: 130730078769807986, currentInstance : rpca-msexchangesubmission-msexchangesubmission.exe(60747EB3) RefCount=0 SpinLock=0 Offset=20504, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 6536, counter : time in resource per second Value=159000 SpinLock=0 Lifetime=Type: 1 ProcessId: 6536 StartupTime: 130730078769807986, currentInstance : mb-msexchangesubmission-msexchangesubmission.exe(67B4173C) RefCount=0 SpinLock=0 Offset=20176, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 6536, counter : time in resource per second Value=273020 SpinLock=0 Lifetime=Type: 1 ProcessId: 6536 StartupTime: 130730078769807986, currentInstance : ad-msexchangesubmission-msexchangesubmission.exe(85200236) RefCount=0 SpinLock=0 Offset=19848, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 4420, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 4420 StartupTime: 130730078654651715, currentInstance : rpca-microsoft.exchange.imap4-microsoft.exchange.imap4.exe(EAAB5DD3) RefCount=0 SpinLock=0 Offset=19520, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 4420, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 4420 StartupTime: 130730078654651715, currentInstance : mb-microsoft.exchange.imap4-microsoft.exchange.imap4.exe(1FC2541C) RefCount=0 SpinLock=0 Offset=19192, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 4420, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 4420 StartupTime: 130730078654651715, currentInstance : ad-microsoft.exchange.imap4-microsoft.exchange.imap4.exe(17E0EA16) RefCount=0 SpinLock=0 Offset=18864, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 6160, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 6160 StartupTime: 130730078749026715, currentInstance : rpca-w3wp-msexchangeservicesapppool(E8BBF810) RefCount=0 SpinLock=0 Offset=18536, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 6160, counter : time in resource per second Value=1867617 SpinLock=0 Lifetime=Type: 1 ProcessId: 6160 StartupTime: 130730078749026715, currentInstance : mb-w3wp-msexchangeservicesapppool(10FE94BF) RefCount=0 SpinLock=0 Offset=18208, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 6160, counter : time in resource per second Value=3331874 SpinLock=0 Lifetime=Type: 1 ProcessId: 6160 StartupTime: 130730078749026715, currentInstance : ad-w3wp-msexchangeservicesapppool(E0DE475) RefCount=0 SpinLock=0 Offset=17880, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 10132, counter : time in resource per second Value=84124 SpinLock=0 Lifetime=Type: 1 ProcessId: 10132 StartupTime: 130730079880745472, currentInstance : ad-w3wp-msexchangerpcproxyapppool(99BB8ED6) RefCount=0 SpinLock=0 Offset=17552, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 10132, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 10132 StartupTime: 130730079880745472, currentInstance : mb-w3wp-msexchangerpcproxyapppool(B190F21C) RefCount=0 SpinLock=0 Offset=17224, categoryName: MSExchange Activity Context Resources A process is holding onto a transport performance counter. processId : 10132, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 10132 StartupTime: 130730079880745472, currentInstance : rpca-w3wp-msexchangerpcproxyapppool(8B7590B3) RefCount=0 SpinLock=0 Offset=16896, cate...</Data>
    </EventData>
    </Event>
    https://support.microsoft.com/en-us/kb/2870416/
    I used method
    1, but it did not help
    me.
    Method 2:
    [PS] C:\Windows\system32>Add-Pssnapin Microsoft.Exchange.Management.PowerShell.Setup
    [PS] C:\Windows\system32>New-PerfCounters -definitionfilename "C:\Program Files\Microsoft\Exchange Server\V15\Setup\Perf
    \GlsPerformanceCounters.xml"
    New-PerfCounters : The performance counter definition file C:\Program Files\Microsoft\Exchange Server\V15\Setup\Perf\GlsPerformanceCounters.xml could not be found.
    Any idea ?
    Если Вам помог чей-либо ответ, пожалуйста, не забывайте жать на кнопку "Предложить как ответ" или "Проголосовать за полезное сообщение"

  • Exchange 2013 backup and log truncation question

    I have a scenario where I have 5 Exchange mailbox servers as members of a DAG, everything running fine, log truncation is working, but seems to be working differently than I am expecting it to work, as in previous versions of Exchange. I am used to the
    logs being truncated immediately after the full backup completes. What is happening is that the server is retaining a weeks worth of logs. Everything older than 7 days gets truncated after a full backup completes. Is this expected behavior? I am running Exchange
    2013 CU3 on Server 2012, backup software is HP Data Protector 8 running the latest updates. I am running a VSS backup. The DAG is not a lagged copy of the DB's either.

    I will check the HP Data Protector setting, but I do not think that setting is valid or anything configurable.
    Here is the contents of some various commands for one of my databases, all of which are configured identically, tell me if you see something set incorrectly. Hopefully I have redacted enough internal stuff:
    Get-MailboxDatabaseCopyStatus
    RunspaceId                            : 8467f253-8c82-4206-a002-14779e701b0e
    Identity                              : DB1\EX2013-MB1
    Id                                    : DB1\EX2013-MB1
    Name                                  : DB1\EX2013-MB1
    DatabaseName                          : DB1
    Status                                : Mounted
    InstanceStartTime                     : 12/10/2013 7:02:44 PM
    LastStatusTransitionTime              :
    MailboxServer                         : EX2013-MB1
    ActiveDatabaseCopy                    : EX2013-MB1
    ActiveCopy                            : True
    ActivationPreference                  : 1
    StatusRetrievedTime                   : 1/7/2014 12:54:19 PM
    WorkerProcessId                       : 10292
    ActivationSuspended                   : False
    ActionInitiator                       : Unknown
    ErrorMessage                          :
    ErrorEventId                          :
    ExtendedErrorInfo                     :
    SuspendComment                        :
    RequiredLogsPresent                   :
    SinglePageRestore                     : 0
    ContentIndexState                     : Healthy
    ContentIndexErrorMessage              :
    ContentIndexVersion                   : 1
    ContentIndexBacklog                   : 0
    ContentIndexRetryQueueSize            : 0
    ContentIndexMailboxesToCrawl          :
    ContentIndexSeedingPercent            :
    ContentIndexSeedingSource             :
    CopyQueueLength                       : 0
    ReplayQueueLength                     : 0
    ReplaySuspended                       : False
    ResumeBlocked                         : False
    ReseedBlocked                         : False
    MinimumSupportedDatabaseSchemaVersion : 0.121
    MaximumSupportedDatabaseSchemaVersion : 0.126
    RequestedDatabaseSchemaVersion        :
    LatestAvailableLogTime                :
    LastCopyNotificationedLogTime         : 1/7/2014 12:38:09 PM
    LastCopiedLogTime                     :
    LastInspectedLogTime                  :
    LastReplayedLogTime                   :
    LastLogGenerated                      : 3510
    LastLogCopyNotified                   : 3510
    LastLogCopied                         : 0
    LastLogInspected                      : 0
    LastLogReplayed                       : 0
    LowestLogPresent                      : 2875
    LastLogInfoIsStale                    : False
    LastLogInfoFromCopierTime             : 1/7/2014 12:54:19 PM
    LastLogInfoFromClusterTime            : 1/7/2014 12:54:16 PM
    LastLogInfoFromClusterGen             : 3510
    LogsReplayedSinceInstanceStart        : 0
    LogsCopiedSinceInstanceStart          : 0
    LatestFullBackupTime                  : 12/9/2013 10:31:32 PM
    LatestIncrementalBackupTime           :
    LatestDifferentialBackupTime          :
    LatestCopyBackupTime                  :
    SnapshotBackup                        : True
    SnapshotLatestFullBackup              : True
    SnapshotLatestIncrementalBackup       :
    SnapshotLatestDifferentialBackup      :
    SnapshotLatestCopyBackup              :
    LogReplayQueueIncreasing              : False
    LogCopyQueueIncreasing                : False
    ReplayLagStatus                       : Enabled:False; PlayDownReason:None; Percentage:0; Configured:00:00:00; Actual:00:00:00
    DatabaseSeedStatus                    :
    OutstandingDumpsterRequests           : {}
    OutgoingConnections                   : {}
    IncomingLogCopyingNetwork             :
    SeedingNetwork                        :
    DiskFreeSpacePercent                  : 99
    DiskFreeSpace                         : 4.365 TB (4,798,945,292,288 bytes)
    DiskTotalSpace                        : 4.366 TB (4,800,702,836,736 bytes)
    ExchangeVolumeMountPoint              :
    DatabaseVolumeMountPoint              : C:\Disks\DB1\
    DatabaseVolumeName                    : \\?\Volume{b95c7aa2-2cd9-430e-ab75-ea4b0efba659}\
    DatabasePathIsOnMountedFolder         : True
    LogVolumeMountPoint                   : C:\Disks\DB1\
    LogVolumeName                         : \\?\Volume{b95c7aa2-2cd9-430e-ab75-ea4b0efba659}\
    LogPathIsOnMountedFolder              : True
    LastDatabaseVolumeName                :
    LastDatabaseVolumeNameTransitionTime  :
    VolumeInfoError                       :
    IsValid                               : True
    ObjectState                           : Unchanged
    [PS] C:\Windows\system32>Get-MailboxDatabase -Identity db1  |fl
    RunspaceId                                   : 8467f253-8c82-4206-a002-14779e701b0e
    JournalRecipient                             :
    MailboxRetention                             : 30.00:00:00
    OfflineAddressBook                           : \Default Offline Address Book
    OriginalDatabase                             :
    PublicFolderDatabase                         : CMBS1CC\CMBS1PF\CMBS1PF
    ProhibitSendReceiveQuota                     : Unlimited
    ProhibitSendQuota                            : 2 GB (2,147,483,648 bytes)
    RecoverableItemsQuota                        : 30 GB (32,212,254,720 bytes)
    RecoverableItemsWarningQuota                 : 20 GB (21,474,836,480 bytes)
    CalendarLoggingQuota                         : 6 GB (6,442,450,944 bytes)
    IndexEnabled                                 : True
    IsExcludedFromProvisioning                   : False
    IsExcludedFromInitialProvisioning            : False
    IsSuspendedFromProvisioning                  : False
    IsExcludedFromProvisioningBySpaceMonitoring  : False
    DumpsterStatistics                           :
    DumpsterServersNotAvailable                  :
    ReplicationType                              : Remote
    AdminDisplayVersion                          : Version 15.0 (Build 775.38)
    AdministrativeGroup                          : Exchange Administrative Group (FYDIBOHF23SPDLT)
    AllowFileRestore                             : False
    BackgroundDatabaseMaintenance                : True
    ReplayBackgroundDatabaseMaintenance          :
    BackgroundDatabaseMaintenanceSerialization   :
    BackgroundDatabaseMaintenanceDelay           :
    ReplayBackgroundDatabaseMaintenanceDelay     :
    MimimumBackgroundDatabaseMaintenanceInterval :
    MaximumBackgroundDatabaseMaintenanceInterval :
    BackupInProgress                             :
    DatabaseCreated                              : True
    Description                                  :
    EdbFilePath                                  : C:\Disks\DB1\DB\DB1.edb
    ExchangeLegacyDN                             : /o=%%%%%/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=EX2013-MB1/cn=Microsoft
    Private MDB
    DatabaseCopies                               : {DB1\EX2013-MB1, DB1\EX2013-MB2, DB1\EX2013-MB3, DB1\EX2013-MB1-DR,
    DB1\EX2013-MB2-DR}
    InvalidDatabaseCopies                        : {}
    AllDatabaseCopies                            : {DB1\EX2013-MB1, DB1\EX2013-MB2, DB1\EX2013-MB3, DB1\EX2013-MB1-DR, DB1\EX2013-MB2-DR}
    Servers                                      : {EX2013-MB1, EX2013-MB2,
    EX2013-MB3, EX2013-MB1-DR, EX2013-MB2-DR}
    ActivationPreference                         : {[EX2013-MB1, 1], [EX2013-MB2, 2], [EX2013-MB3, 3], [EX2013-MB1-DR, 4], [EX2013-MB2-DR, 5]}
    ReplayLagTimes                               : {[EX2013-MB1, 00:00:00], [EX2013-MB2, 00:00:00], [EX2013-MB3,
    00:00:00], [EX2013-MB1-DR, 00:00:00], [EX2013-MB2-DR, 00:00:00]}
    TruncationLagTimes                           : {[EX2013-MB1, 00:00:00], [EX2013-MB2, 00:00:00], [EX2013-MB3, 00:00:00], [EX2013-MB1-DR,
    00:00:00], [EX2013-MB2-DR, 00:00:00]}
    RpcClientAccessServer                        : EX2013-MB1.%%%%%%.local
    MountedOnServer                              :
    DeletedItemRetention                         : 60.00:00:00
    SnapshotLastFullBackup                       :
    SnapshotLastIncrementalBackup                :
    SnapshotLastDifferentialBackup               :
    SnapshotLastCopyBackup                       :
    LastFullBackup                               :
    LastIncrementalBackup                        :
    LastDifferentialBackup                       :
    LastCopyBackup                               :
    DatabaseSize                                 :
    AvailableNewMailboxSpace                     :
    MaintenanceSchedule                          : {Sun.1:00 AM-Sun.5:00 AM, Mon.1:00 AM-Mon.5:00 AM, Tue.1:00 AM-Tue.5:00 AM, Wed.1:00
    AM-Wed.5:00 AM, Thu.1:00 AM-Thu.5:00 AM, Fri.1:00 AM-Fri.5:00 AM, Sat.1:00 AM-Sat.5:00 AM}
    MountAtStartup                               : True
    Mounted                                      :
    Organization                                 : %%%%%%%
    QuotaNotificationSchedule                    : {Sun.1:00 AM-Sun.1:15 AM, Mon.1:00 AM-Mon.1:15 AM, Tue.1:00 AM-Tue.1:15 AM, Wed.1:00 AM-Wed.1:15 AM, Thu.1:00 AM-Thu.1:15
    AM, Fri.1:00 AM-Fri.1:15 AM, Sat.1:00 AM-Sat.1:15 AM}
    Recovery                                     : False
    RetainDeletedItemsUntilBackup                : False
    Server                                       : EX2013-MB1
    MasterServerOrAvailabilityGroup              : DAG1
    WorkerProcessId                              :
    CurrentSchemaVersion                         :
    RequestedSchemaVersion                       :
    AutoDagExcludeFromMonitoring                 : False
    AutoDatabaseMountDial                        : GoodAvailability
    DatabaseGroup                                :
    MasterType                                   : DatabaseAvailabilityGroup
    ServerName                                   : EX2013-MB1
    IssueWarningQuota                            : 1.9 GB (2,040,110,080 bytes)
    EventHistoryRetentionPeriod                  : 7.00:00:00
    Name                                         : DB1
    LogFolderPath                                : C:\Disks\DB1\LOGS
    TemporaryDataFolderPath                      :
    CircularLoggingEnabled                       : False
    LogFilePrefix                                : E01
    LogFileSize                                  : 1024
    LogBuffers                                   :
    MaximumOpenTables                            :
    MaximumTemporaryTables                       :
    MaximumCursors                               :
    MaximumSessions                              :
    MaximumVersionStorePages                     :
    PreferredVersionStorePages                   :
    DatabaseExtensionSize                        :
    LogCheckpointDepth                           :
    ReplayCheckpointDepth                        :
    CachedClosedTables                           :
    CachePriority                                :
    ReplayCachePriority                          :
    MaximumPreReadPages                          :
    MaximumReplayPreReadPages                    :
    DataMoveReplicationConstraint                : SecondCopy
    IsMailboxDatabase                            : True
    IsPublicFolderDatabase                       : False
    MailboxProvisioningAttributes                :
    AdminDisplayName                             : DB1
    ExchangeVersion                              : 0.10 (14.0.100.0)
    DistinguishedName                            : CN=DB1,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative
    Groups,CN=%%%%%,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=%%%%%%,DC=%%%
    Identity                                     : DB1
    Guid                                         : 765d01d0-4468-43fd-a1e8-ad205b25c8ee
    ObjectCategory                               : %%%%%%.%%%/Configuration/Schema/ms-Exch-Private-MDB
    ObjectClass                                  : {top, msExchMDB, msExchPrivateMDB}
    WhenChanged                                  : 12/10/2013 7:02:44 PM
    WhenCreated                                  : 11/13/2013 11:00:58 AM
    WhenChangedUTC                               : 12/11/2013 12:02:44 AM
    WhenCreatedUTC                               : 11/13/2013 4:00:58 PM
    OrganizationId                               :
    OriginatingServer                            : %%%%%-DC4.%%%%%.%%%
    IsValid                                      : True
    ObjectState                                  : Changed
    [PS] C:\Windows\system32>Get-MailboxDatabase -Status | ft Name,Server,LastF*Backup,LastI*Backup,LastD*Backup -AutoSize
    Name       Server        LastFullBackup       LastIncrementalBackup LastDifferentialBackup
    MB1-DB0    EX2013-MB1    1/6/2014 11:30:46 PM
    DB1        EX2013-MB1    1/6/2014 11:30:46 PM
    DB2        EX2013-MB1    1/6/2014 11:30:46 PM
    MB3-DB0    EX2013-MB3    1/6/2014 10:45:44 PM
    DB5        EX2013-MB3    1/6/2014 10:45:44 PM
    DB6        EX2013-MB3    1/6/2014 10:45:44 PM
    MB2-DB0    EX2013-MB2    1/6/2014 10:15:39 PM
    DB3        EX2013-MB2    1/6/2014 10:15:39 PM
    DB4        EX2013-MB2    1/6/2014 10:15:39 PM
    MB1-DR-DB0 EX2013-MB1-DR 1/6/2014 8:00:23 PM
    MB2-DR-DB0 EX2013-MB2-DR 1/6/2014 8:15:22 PM

  • We have a Exchange 2013 server and the Mailbox Database folder is filling up with .log files.

    We are migrating from Exchange 2010 to Exchange 2013.  We have installed the Exchange 2013 but it only has a couple of mailboxes on this server, all the mailboxes are still on the Exchange 2010 server.
    I have run a Windows Backup of the Exchange 2013 but I am still seeing a ton a log files in the mailbox folder.
    Also the database file is only about 1.1 GB but the backup is now 40 GB.  
    Is there something that can be done to truncate these logs and make the backup smaller?

    Hi ,
    1.Does the full backup completed successfully ?
    2.what about the status for the below mentioned command ? Does the mailbox database headers updated with the latest time and date ?
    Get-MailboxDatabase -Status | ft name,*full* -au
    3.Just check the application event logs for the event id
     2046  and that should state that the log truncation for the mailbox databases has been initiated or not.
    4.Before initiating the backup just make the exchange writer is not on error.
    vssadmin list writers
    In case if it on error state ,please restart the Microsoft exchange replication service and check the exchange writers status again by using the above mentioned command.
    Thanks & Regards S.Nithyanandham

  • Exchange 2013 Health Mailbox filling up security logs

    I'm doing security audits and having the Exchange 2013 Health Mailbox fill up my security logs.  I've read that if I delete the mailboxes and re-create them and restart the service the errors will go away.  My question is how do I delete them?
     I found the full mailbox name with this command.  
    get-mailbox -monitoring | select-object -expandproperty name
    Do I use this method?
    Remove-Mailbox -Identity contoso\johnor this one?Remove-Mailbox -Identity contoso\john -Permanent $trueOr something else?
    Thanks!
    Fernando

    I did help on the setup in Exchange server folder.  Looks like prepares Active Directory forest for Exchange Install.  /PrepareAD, /p  So this is what I'm supposed to run?
    C:\Program Files\Microsoft\Exchange Server\V15\Bin>setup /?
    Welcome to Microsoft Exchange Server 2013 Cumulative Update 3 Unattended Setup
    For detailed help, type one of the following options:
      Setup /help:Install         - Install Exchange server roles.
      Setup /help:Upgrade         - Upgrade an existing Exchange server.
      Setup /help:Uninstall       - Uninstall Exchange server roles.
      Setup /help:RecoverServer   - Recover an existing Exchange server.
      Setup /help:PrepareTopology - Prepare your topology for Exchange.
      Setup /help:Delegation      - Delegate server installations.
      Setup /help:UmLanguagePacks - Add or remove Unified Messaging
                                    language packs.
    C:\Program Files\Microsoft\Exchange Server\V15\Bin>Setup /help:PrepareTopology
    Welcome to Microsoft Exchange Server 2013 Cumulative Update 3 Unattended Setup
    Microsoft Exchange Server 2013 Setup Parameter Help
    Prepare Topology Usage:
        Setup /PrepareAD [<OptionalParameters>]
          /IAcceptExchangeServerLicenseTerms
        Setup /PrepareSchema [<OptionalParameters>]
          /IAcceptExchangeServerLicenseTerms
        Setup /PrepareDomain [<OptionalParameters>]
          /IAcceptExchangeServerLicenseTerms
        Setup /PrepareDomain:<domainA, domainB> [<OptionalParameters>]
          /IAcceptExchangeServerLicenseTerms
        Setup /PrepareAllDomains [<OptionalParameters>]
          /IAcceptExchangeServerLicenseTerms
    --Prepare Topology Required Parameters--
    /PrepareAD, /p
        Prepares the Active Directory forest for the Exchange
        installation.
    Fernando

Maybe you are looking for

  • Reader 9 and Acrobat X Pro

    Has anyone installed Reader 9 on a machine that also has Acrobat X Pro?  A website we use for UCC filings is not compatible with Acrobat X Pro.  We need to determine the best way to work with this website until they are compatible with Acrobat X and

  • Gamma Shift with Encore Transcoded Material

    Hello, I use Edius as my NLE and have always noticed that if I let Encore CS4/CS5encode my assets the gamma of the resulting DVD or BD is higher resulting in a grey, milky look to the footage. 1)  Does anybody else see this? 2)  What is causing this?

  • Where are the system extensions in Tiger?

    In Mac OS 7-9 system extensions and control pannels were easy to find. Where are they in OSX? John

  • Cannot remove selected keyword with certain movies

    Greetings, I started with a movie file on disk. The format is Apple Motion JPEG A, 1440 x 1080, Millions. I imported it into iMovie '11 a couple of months ago, so it was iMovie 9.0.0. (I am now using iMovie 9.0.2.) The movie was converted to this for

  • Pages not available in web browser

    When I try to preview my web pages in the browser I get error 404 come up. The root file tests fine and I checked with my hosting company and the connection is fine. I must have done something incorrect when I set up the individual pages. Can anyone