Exchange 2010/2013/2016 Event ID 9646 errors - multiple causes from network dropping to application scanning/downloading mails, attachments, folders too many times

9646 Exchange errors have different causes that can be narrowed down depending on the description of these errors :

• 9646 Type #1 error: MAPI session <GUID: DN of account> exceeded the maximum of xxx objects of type objt<object type>, where objt<Object type> can be anything on the below:
  • objtMessage
  • objtFolder
  • objtAttachment
  • objtFolderView
  • objtMessageView
  • objtAttachView
  • objtStream
  • objtACLView
  • objtRulesView
  • objtFXSrcStrm
  • objtFXDstStrm
  • objtCStream
  • objtNotify

• 9646 Type #2 error: Mapi session "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx: /o=MYDOMAIN/ou=First Administrative Group/cn=Recipients/cn=MYUSER" exceeded the maximum of 32 objects of type "session".

> 9646 type #1 error : If the MAPI 9646 error refers to the first type (with "objt<object type>") in its description, then it can be:

• a user who opened multiple Outlooks, likely in cached mode, that downloads the mailbox on his local workstation: that opens Folder, Message and Attachments objects simultaneously, which can meet the default limits on these
• a desktop search or indexing engine that scans the mailbox : that opens all folders, messages and attachments potentially, meeting the limits and triggering this error
• another application that scans all messages and folders (like BES5 agent, or any other mail related software, or a desktop antivirus that is set to scan Outlook application's messages)
• ...

> 9646 type #2 error : If the MAPI 9646 error refers to the second type (with exceeded the max objects of type "Session"), then this issue may go out by itself. But if the user is still experiencing the issue, try to close the IP connections, and investigate what on his desktop (or on other desktops if he has multiple opened connections) can generate too much MAPI connections.

Usually, it can be caused by VPN connections closing and users re-opening them. When a VPN connection closes, the MAPI session to an Exchange Server is not released. Then re-establighing the VPN then the MAPI connection just add more MAPI connections

It can also be caused by an external MAPI based device such as Blackberry or application such as scripts or third-party mail applications.

What are the limits ? Can we change them ?

For the Type #1 error, you can change the limits in the number of objects that can be opened by a single mailbox in a single session can be done, but you have to use it with care : we have to understand first why the user(s) are opening more than the default limit of items or sessions - there might be a reason, and if it's known, then we can raise the limits. If not, we need to investigate first why some users / application are trying to open more than the limited number of items in a single session or more than the limited number of sessions.

For the Type #2 error, same thing, investigate what's happening with the user first, then you can raise the nb of "sessions" limits using Set-ThrottlingPolicy and changing the RCAMaxConcurrency parameter.

For information, here are the limits on Exchange 2010/2013/2016 (for the above "type #1" error):

As per the Exchange Store Limits TechNet article...

Configure Open Item Limits:  You can limit the maximum number of resources that a MAPI client can use simultaneously. It's done using Registry, please see the above mentioned article for more information about how to modify

But some investigations have to be made first before increasing the above limits:

1- First, checkout the IP address of UserAlias listed in the Distinguished Name of the event :

Get-LogonStatistics UserAlias | ft Name,ClientIPAddress

Note: if the client is not more connected to the Exchange server or the MAPI sessions finally closed by themselves, the ClientIPAddress property will be blank

2- Using a tool like TCPView (https://technet.microsoft.com/en-us/sysinternals/bb897437.aspx), close the connections from your Exchange server that refer to the ClientIPAddress you just get with the PowerShell command in Step-1

Again, forcing TCP connections without knowing the cause of what caused them is not very clever. The MAPI connections exhaustion may come back.

Check with the user’s devices and applications he is using to connect to the Exchange server as you may be able to solution the issue for a broader number of users.