Sysadminsblog.com Anything for sysadmins!

Event 2937 – HomeMTA pointing to the Deleted Objects container

Recently I came across the following warning.

 Log Name: Application<br/>Source: MSExchange ADAccess<br/>Date: 23-9-2010 17:06:55<br/>Event ID: 2937<br/>Task Category: Validation<br/>Level: Warning<br/>Keywords: Classic<br/>User: N/A<br/>Computer: exchangeserver.domain.local<br/>Description:<br/>Process powershell.exe (PID=8552). Object [CN=FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042,CN=OU,DC=domain,DC=local]. Property [HomeMTA] is set to value [domain.local/Configuration/Deleted Objects/Microsoft MTA DEL:ceb6fb78-f913-4907-9522-3f2f20e20d1a], it is pointing to the Deleted Objects container in Active Directory. This property should be fixed as soon as possible.<br/>Event Xml:<br/>&lt;Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"&gt;<br/>&lt;System&gt;<br/>&lt;Provider Name="MSExchange ADAccess" /&gt;<br/>&lt;EventID Qualifiers="32768"&gt;2937&lt;/EventID&gt;<br/>&lt;Level&gt;3&lt;/Level&gt;<br/>&lt;Task&gt;6&lt;/Task&gt;<br/>&lt;Keywords&gt;0x80000000000000&lt;/Keywords&gt;<br/>&lt;TimeCreated SystemTime="2010-09-23T15:06:55.000000000Z" /&gt;<br/>&lt;EventRecordID&gt;49552&lt;/EventRecordID&gt;<br/>&lt;Channel&gt;Application&lt;/Channel&gt;<br/>&lt;Computer&gt;exchangeserver.domain.local&lt;/Computer&gt;<br/>&lt;Security /&gt;<br/>&lt;/System&gt;<br/>&lt;EventData&gt;<br/>&lt;Data&gt;powershell.exe&lt;/Data&gt;<br/>&lt;Data&gt;8552&lt;/Data&gt;<br/>&lt;Data&gt;CN=FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042,CN=OU,DC=domain,DC=local&lt;/Data&gt;<br/>&lt;Data&gt;HomeMTA&lt;/Data&gt;<br/>&lt;Data&gt;domain.local/Configuration/Deleted Objects/Microsoft MTADEL:ceb6fb78-f913-4907-9522-3f2f20e20d1a&lt;/Data&gt;<br/>&lt;/EventData&gt;<br/>&lt;/Event&gt;

The process can be anything related to Exchange. I’ve seen:

• MSExchangeMailboxAssistants.exe
• w3wp.exe
• Microsoft.Exchange.RpcClientAccess.Service.exe
• Microsoft.Exchange.ServiceHost.exe
• ExSetupUI.exe
• powershell.exe

The object can also change. I’ve seen:

• Administrator
• SystemMailbox.<GUID>
• FederatedEmail.<GUID>

This probably started because I upgraded Exchange 2010 to SP1. Thanks to Kevin Ca I now know how to correct the issue.

In the Exchange Management Shell do a Get-Mailbox to get the mailbox. Use the -Arbitration switch to get the system mailboxes. Then pipe that to Update-Recipient.

[Powershell]Get-Mailbox Administrator | Update-Recipient[/Powershell]

If you’re using the -Arbitration switch you might have to further specify the mailbox. An easy way is:

[Powershell]Get-Mailbox -Arbitration | Where {$_.Name -like “SystemMailbox{E3*” } | Update-Recipient [/Powershell]

Running the Update-Recipient cmdlet on a mailbox reinitializes the HomeMTA value and solves the warning message.