Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9646

Source
Level
Description
Mapi session "/o=First Organization/ou=First Administrative Group/cn=Recipients/cn=<account name>" exceeded the maximum of <number> objects of type "<type>".
Comments
 
Can be caused by Colligo which creates hundreds of folders in the user's mailbox. See EV100430 (Exchange Store Limits) for an explanation of these limits and how to modify them.
I got this message after applying Update Rollup 4-V2 for Exchange server 2010 Service Pack 2 (KB2756485).
In my case, this happened when a user got Outlook 2010 opened 2 times and cache mode was enabled. Outlook was downloading a mailbox 2 times and created to many sessions. After closing the error went away.
In my case this error comes up, only when a user is connected to the Exchange Server from outside via VPN. It seems to be the delay or different interrupts on the WAN side, especially when the VPN tunnel is connected over long distances. (Germany - Italia, Germany or Chile). From the LAN side I haven't seen any errors like that.
Use the TA997425 article to solve the problem. You just need to create some registry keys into the MSExchangeIS service and restart the Information Store to get the new values in place. This also applies if you migrate from previous version from Exchange to Exchange 2007.


In my case (Exchange 2007), Xobni (search agent for Outlook) was the culprit.
This error can appear if you use Microsoft Outlook 2007 on a terminal server in combination with MindJet MindManager 7. The MindManager add-in crawls the whole mailbox for elements and due to the disabled cache mode on terminal servers Exchange server starts blocking further connections when the limit is reached. The solution is to disable the MindManager add-ins. In order to achieve this just remove the following registry keys:

HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\Mindjet.Mm7OutlookLinker.AddIn.3
HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\Mindjet.Mm7OutlookMapMinderLinker.AddIn.3.
As per Microsoft: "A single MAPI session has exceeded the maximum number of objects of a given type. To prevent a single client from affecting the performance of the entire server, this MAPI session was terminated". See MSEX2K3DB, ME842022, ME899663, and the link to "Veritas Support Document ID: 271186" for details on this event.
If you use Blackberry, read “BlackBerry Support Doc ID: KB05309” for information on this issue.
Windows 2003 SP2 introduced a feature called scalable networking. Disabling it immediately fixed the problem of Outlook clients using too many sessions. To disable without rebooting enter the following at a command prompt:

netsh int ip set chimney diabled

To permanently disable (reboot required), set the following registry value to 0:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableTCPChimney.

Also, see ME936594 and the link to “Windows 2003 Scalable Networking pack and its possible effects on Exchange” for additional information on this issue.
This problem may occur if a MAPI client opens more than the default value of the server objects. See ME925815 for a table containing the default values for all object types.
More details for Peter Jensen's comment for object type "session".

- Object type: "session" - Look at Exchange System Manager/Servers/<server>/<storage group>/<mailbox store>/logons. Visually find the user name (if this name is not known from log, as it was in my case) which exceeded 32 sessions. It is a pity that there is no way of using ESM to close these sessions. To do this, find the user's IP address, open tcpview.exe (from Sysinternals) and close all connections to store.exe generated by that IP.
Errors with exceeded "sessions" were generated after the user tried to send a large e-mail and were caused by broken network cable on user’s workstation.
In my case, this event occured when the network became unstable due to an error in one of the cisco switches. After replacing the swicth, the error went away.
According to Microsoft Support, this is a new feature in Exchange 2003 to help prevent any one client from acting "abnormally" and adversely affecting the performance of the server. The recommended fix was to modify the registry to raise the threshold for each one of the object types mentioned in the error message. In my case, I had to quadruple the affected values to get this behavior to stop.
Create the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem\MaxObjsPerMapiSession. Then create a new DWORD value for each object name appearing in the error (for example, “objtMessageView”), and set the desired value. In my case, they recommended quadrupling the value mentioned in the error. You should not have to restart any services for this change to take affect. See ME830836 for more details.


Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...