Exchange Server records most of its problems in the Windows event logs before users notice: back pressure, a domain controller it refuses to use, a database page that fails its checksum, a DAG member dropping out of the cluster. This quick reference lists 43 event IDs grouped by source, with what each means on Exchange Server SE and Exchange Server 2019, the usual cause and the first thing to check. Press Ctrl+F, type the event ID, and follow the guide link where there is one.
Codes in this quick reference
Event ID 15004 (MSExchangeTransport): Resource pressure increased (back pressure)Application logEvent ID 15005 (MSExchangeTransport): Resource pressure decreasedApplication logEvent ID 15006 (MSExchangeTransport): rejecting messages, available disk space below the thresholdApplication logEvent ID 15007 (MSExchangeTransport): rejecting message submissions, memory use above the thresholdApplication logEvent ID 12014 (MSExchangeFrontEndTransport / MSExchangeTransport): no certificate for the connector FQDN, no STARTTLSApplication logEvent ID 1035 (MSExchangeFrontEndTransport): Inbound authentication failed with error LogonDenied for Receive connectorApplication logEvent ID 474 (ESE): page checksum mismatch, the read fails with -1018Application logEvent ID 476 (ESE): page contains no page data (-1019)Application log
+ 35 more codes in the tables below.
How to read these codes#
An event ID only means something together with its source, the provider name in Event Viewer: 1003 from MSExchange Front End HTTPS Proxy has nothing to do with a 1003 from another product.
- Application log: the MSExchange sources, ESE, ExchangeStoreDB, ASP.NET, .NET Runtime and Application Error.
- System log: Windows components Exchange relies on: FailoverClustering, HttpEvent, Service Control Manager, Resource-Exhaustion-Detector and Security-Kerberos.
- Security log on a domain controller: account lockouts.
The description holds the detail that matters: a server, database, connector or process name, an error name such as LogonDenied, or a JET code. Compare servers too: a 2142 on one server points at its site or network, on every server at Active Directory. Informational events (15005, 2080, 2014, 10048) are the partners to look for after a fix. Exchange also writes detailed channels under Applications and Services Logs › Microsoft › Exchange; this list sticks to the classic logs.
PowerShell
# Busiest Exchange sources and IDs in the last 24 hours
Get-WinEvent -FilterHashtable @{LogName='Application'; Level=2,3; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
Where-Object ProviderName -match 'MSExchange|ESE|ExchangeStoreDB' |
Group-Object ProviderName, Id | Sort-Object Count -Descending | Select-Object Count, Name -First 20
# Newest events for one source and ID, with the full text
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='MSExchangeTransport'; Id=15004} -MaxEvents 5 |
Format-List TimeCreated, MessageRelated: NDR status codes, ESE/JET error codes and Exchange Management Shell and AD errors.
Transport: MSExchangeTransport and MSExchangeFrontEndTransport#
MSExchangeTransport is the Transport service; MSExchangeFrontEndTransport is the Front End Transport service, which accepts SMTP from the internet and from clients on port 587.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
15004MSExchangeTransport | Resource pressure increased: back pressure has started | Low space on the queue volume, EdgeTransport.exe memory, version buckets or a long Submission queue | The resource named in the event; Get-ExchangeDiagnosticInfo -Process EdgeTransport -Component ResourceThrottling. Guide |
15005MSExchangeTransport | Resource pressure decreased (informational) | The resource fell back below its threshold | Queues drain in Get-Queue. Guide |
15006MSExchangeTransport | Rejecting messages: available disk space is below the configured threshold | The queue database volume filled with logs, dumps or a backlog | Free space; thresholds are a percentage of the volume, not gigabytes. Guide |
15007MSExchangeTransport | Rejecting message submissions: the service keeps using more memory than the threshold | Huge queues, a misbehaving transport agent or too little RAM | Get-Queue, Get-TransportAgent; a restart only buys time. Guide |
12014MSExchangeFrontEndTransport or MSExchangeTransport | No certificate with the connector's FQDN in the personal store, so no STARTTLS | A certificate renewed or removed without updating the connector | Connector Fqdn and TlsCertificateName against Get-ExchangeCertificate. Guide |
1035MSExchangeFrontEndTransport | Inbound authentication failed with error LogonDenied for Receive connector …, with the mechanism and source IP | An app with a wrong or expired password, or password guessing on an internet-facing client connector | The source IP in the receive protocol log. Only your load balancer's IP? It hides the clients |
Databases and the store: ESE, ExchangeStoreDB and MSExchangeIS Mailbox Store#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
474ESE | Page checksum mismatch; the read fails with -1018 | Storage: disk, controller, firmware or driver | DAG page patching; disk errors in the System log. Guide |
476ESE | Page contains no page data (-1019): a page in use is blank | The same storage problems as 474 | As for 474. Guide |
413ESE | Unable to create a new logfile because the database cannot write to the log drive. | Log volume full (logs not truncating), read-only or failed | Free space; LastFullBackup in Get-MailboxDatabase -Status. Guide |
623ESE | The version store has reached its maximum size; updates are rejected until a long-running transaction ends | A long-running transaction blocking cleanup, e.g. slow storage or a stuck operation | Disk latency and the events just before it; related code -1069 |
129ExchangeStoreDB | Page patching was initiated to restore the page. Event 130 follows when the copy is repaired | A -1018 page error, fixed from a healthy DAG copy | A storage warning even though nothing failed: check that server's disks. Guide |
10047MSExchangeIS Mailbox Store | Mailbox-level repair request started (informational) | New-MailboxRepairRequest -Mailbox | Get-MailboxRepairRequest. Guide |
10059MSExchangeIS Mailbox Store | Database-level repair request started (informational) | New-MailboxRepairRequest -Database | As for 10047. Guide |
10048MSExchangeIS Mailbox Store | Repair request completed successfully (informational) | End of a repair request | Rerun with -DetectOnly: zero corruptions. Guide |
10062MSExchangeIS Mailbox Store | Corruption detected; lists each one and whether it was fixed | Logical corruption such as wrong folder counts or broken views | Read the list; rerun with -DetectOnly. Guide |
Replication and the DAG: MSExchangeRepl and FailoverClustering#
A DAG runs on Windows failover clustering, so check the FailoverClustering events in the System log too.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
4113MSExchangeRepl | The database redundancy check failed: fewer healthy copies than expected (admins report the text Database redundancy health check failed) | A passive copy Failed, FailedAndSuspended or disconnected, or a member down | Get-MailboxDatabaseCopyStatus *; Test-ReplicationHealth. Guide |
4374MSExchangeRepl | The database availability check failed: fewer copies available than expected (admins report the text Database availability health check failed) | A Replication service unreachable over RPC, or copies suspended or blocked from activation | Test-ReplicationHealth on each member. Related: copy and replay queues |
1135FailoverClustering | A node was removed from the active failover cluster membership | Missed heartbeats: a network drop, a paused or overloaded VM or host, a NIC or driver fault, a reboot | That node's System log; Get-ClusterLog. Guide |
1177FailoverClustering | The Cluster service is shutting down because quorum was lost | Too many members, or members and the witness, unreachable at once | Get-ClusterQuorum; the witness share from each member. Guide |
1069FailoverClustering | A cluster resource failed; names the resource, type and role | Depends on the resource: the witness, a network or a dependency | Get-ClusterResource; the cluster log. Guide |
Active Directory access: MSExchange ADAccess and MSExchangeADTopology#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
2080MSExchange ADAccess | Topology discovery result (informational): each DC and GC with role, reachability, sync and SACL columns | Logged routinely | Healthy in-site DCs show CDG 1 7 7 1 0 1 1 7 1. Guide |
2142MSExchangeADTopology | Topology discovery failed, e.g. No Minimal Required Number of Suitable Directory Servers Found in Forest or TimedOut | Subnet in the wrong AD site, wrong DNS, LDAP or RPC blocked, or a removed DC still listed | The latest 2080: which DCs failed, on which column. Guide |
2112MSExchange ADAccess | No Audit Security Privilege on a domain controller, so it won't be used | Exchange Servers missing from Manage auditing and security log in domain controller Group Policy | That user right in the GPO for domain controllers. Guide |
2937MSExchange ADAccess | A property such as HomeMTA points to Deleted Objects (warning) | A removed Exchange server or deleted OU still referenced | The object and property in the event; bulk fix in the guide. Guide |
Client access: HTTP proxy, IIS, ActiveSync, RBAC and OAuth#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
1003MSExchange Front End HTTPS Proxy | Unhandled proxy exception; with NullReferenceException at FbaModule.ParseCadataCookies it's the OWA and EAC sign-in loop | An expired, missing or misconfigured Auth certificate | The Get-AuthConfig thumbprint and its expiry on every server. Guide |
1309ASP.NET | An unhandled exception has occurred for /owa or /ecp (warning) | An app failure behind an HTTP 500, e.g. a missing assembly after a non-elevated update | The exception and URL in the event. Guide |
15021HttpEvent | An error occurred while using SSL configuration for endpoint 0.0.0.0:444 | The Exchange Back End site's certificate was deleted or replaced | The 444 binding: normally the self-signed "Microsoft Exchange" certificate. Guide |
1053MSExchange ActiveSync | No permission to create the device container under the user (INSUFF_ACCESS_RIGHTS) | Inheritance off on the user: protected admin accounts (adminCount = 1) | Security › Advanced on the user object. Guide |
258MSExchange RBAC | CmdletAccessDeniedException: no management roles | No role group membership or assignment | Get-ManagementRoleAssignment -RoleAssignee <user>; a new session after adding. Guide |
2014MSExchange AuthAdmin | The signing certificate was updated to a new thumbprint (informational) | A staged Auth certificate rotation completed | Get-AuthConfig; the certificate on every server. Guide |
Crashes, performance counters and mitigations#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
4999MSExchange Common | Watson report about to be sent for process id: …: an unhandled exception | A product bug, a third-party component or a known issue in your build | Process, component and exception in the parameters; your build's known issues. Guide |
106MSExchange Common | Performance counter updating error. Names the counter and category | A counter or counter category that isn't registered correctly | Cosmetic if nothing else fails; admins report re-registering the counters with New-PerfCounters |
1000Application Error | Faulting application name: EdgeTransport.exe (or w3wp.exe), with the faulting module | A crash; a third-party DLL points at an agent or filter | The faulting module; Get-TransportAgent; the poison queue. Guide |
1026.NET Runtime | The process was terminated due to an unhandled exception. | The crash behind a 4999, with the stack | Pair it with the 4999. Guide |
1325ASP.NET | An unhandled exception occurred and the process was terminated. Names the app, e.g. /LM/W3SVC/2/ROOT/EWS | An IIS worker crash in an Exchange web app | The matching 4999; the app pool. Guide |
1005, 1006MSExchange Mitigation Service | A successful action, e.g. a mitigation applied (informational) | The hourly EEMS check | Get-ExchangeServer | Format-List Name,MitigationsApplied,MitigationsBlocked. Guide |
1008MSExchange Mitigation Service | An error, e.g. the Office Config Service (OCS) unreachable | Blocked HTTPS, no WinHTTP proxy, SSL inspection or blocked revocation checks | The proxy path; V15\Logging\MitigationService. Guide |
Windows events that explain Exchange problems#
All in the System log, except 4740 (Security log of a domain controller).
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
7000Service Control Manager | A service failed to start; the text gives the reason | A disabled service, a logon failure or an interrupted update | Start types of the Exchange services. Guide |
7001Service Control Manager | A service depends on a service which failed to start | Usually Microsoft Exchange Active Directory Topology failed or is disabled | Start MSExchangeADTopology first. Guide |
7040Service Control Manager | A start type changed, e.g. from auto start to disabled | Setup disables services during a CU or SU; a failed install leaves them that way | Restore start types to match a healthy server. Guide |
2004Resource-Exhaustion-Detector | Low virtual memory condition; lists the top consumers | Too little RAM or page file, or a runaway process | The processes named. Guide |
4Security-Kerberos (client) | KRB_AP_ERR_MODIFIED: the server couldn't decrypt the ticket | The SPN on another account, or a server missing the ASA credential | setspn -F -Q http/mail.contoso.com; ASA status. Guide |
4740Security (domain controller) | A user account was locked out; names the caller computer | An old password cached on a phone, app or computer | The caller computer; clear the credential there. Guide |
How to verify a fix#
- The event stops on every server, not just the one you fixed.
- The partner event appears: 15005 after 15004, a clean 2080, 10048 after a repair, 2014 after an Auth rotation, EEMS 1005 or 1006 instead of 1008.
- Health commands agree:
Test-ServiceHealth,Get-HealthReport,Test-ReplicationHealthandGet-Queueare clean. - Monitoring watches it: forward 15004 to 15007, 2142, 474, 413, 1135, 1177 and 4999 to your monitoring system.
PowerShell
$since = (Get-Date).AddHours(-4)
Get-ExchangeServer | Where-Object { -not $_.IsEdgeServer } | ForEach-Object {
Get-WinEvent -ComputerName $_.Name -FilterHashtable @{LogName='Application'; Id=15004,2142,474,4999; StartTime=$since} -ErrorAction SilentlyContinue |
Select-Object MachineName, TimeCreated, ProviderName, Id
}
Get-HealthReport -Identity EX01 | Where-Object AlertValue -ne 'Healthy'
Test-ReplicationHealth -Identity EX01References#
- Exchange Server troubleshooting (Microsoft Learn): Microsoft's troubleshooting library, filterable by keyword
- Exchange Emergency Mitigation (EM) service (Microsoft Learn): events 1005, 1006 and 1008 and their source,
MSExchange Mitigation Service - The guides on this site linked in each row, which cite Microsoft's documentation for their events
