Exchange 2003 / 2007 Event ID 9646 errors – multiple causes from network dropping to application scanning/downloading mails, attachments, folders too many times


9646 Exchange errors have different causes that can be narrowed down depending on the description of these errors :

  • 9646 Type #1 error: MAPI session <GUID: DN of account> exceeded the maximum of xxx objects of type objt<object type>, where objt<Object type> can be anything on the below:
    • objtMessage
    • objtFolder
    • objtAttachment
    • objtFolderView
    • objtMessageView
    • objtAttachView
    • objtStream
    • objtACLView
    • objtRulesView
    • objtFXSrcStrm
    • objtFXDstStrm
    • objtCStream
    • objtNotify

 

  • 9646 Type #2 error: Mapi session "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx: /o=MYDOMAIN/ou=First Administrative Group/cn=Recipients/cn=MYUSER" exceeded the maximum of 32 objects of type "session".

 

> 9646 type #1 error : If the MAPI 9646 error refers to the first type (with "objt<object type>") in its description, then it can be:

  • a user who opened multiple Outlooks, likely in cached mode, that downloads the mailbox on his local workstation: that opens Folder, Message and Attachments objects simultaneously, which can meet the default limits on these
  • a desktop search or indexing engine that scans the mailbox : that opens all folders, messages and attachments potentially, meeting the limits and triggering this error
  • another application that scans all messages and folders (like BES5 agent, or any other mail related software, or a desktop antivirus that is set to scan Outlook application's messages)
  • ...

 

> 9646 type #2 error : If the MAPI 9646 error refers to the second type (with exceeded the max objects of type "Session"), then this issue may go out by itself. But if the user is still experiencing the issue, try to close the IP connections, and investigate what on his desktop (or on other desktops if he has multiple opened connections) can generate too much MAPI connections.

Usually, it can be caused by VPN connections closing and users re-opening them. When a VPN connection closes, the MAPI session to an Exchange Server is not released. Then re-establighing the VPN then the MAPI connection just add more MAPI connections

It can also be caused by an external MAPI based device such as Blackberry or application such as scripts or third-party mail applications.

 

1- First, checkout the IP address of UserAlias listed in the Distinguished Name of the event :

Get-LogonStatistics UserAlias | ft Name,ClientIPAddress

Note: if the client is not more connected to the Exchange server or the MAPI sessions finally closed by themselves, the ClientIPAddress property will be blank

 

2- Using a tool like TCPView (http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx), close the connections from your Exchange server that refer to the ClientIPAddress you just get with the PowerShell command in Step-1

 

 

Again, forcing TCP connections without knowing the cause of what caused them is not very clever. The MAPI connections exhaustion may come back.

Check with the user’s devices and applications he is using to connect to the Exchange server as you may be able to solution the issue for a broader number of users.


Comments (0)

Skip to main content