There is a Exchange 2010 SP2.RU3 It was installed in mixed environment with Ex2003.SP2 (now it's off). Today access for RPC client (MAPI) was broken. Only clients with MAPI connection were experiencing the issue; OWA worked fine. We found to events in logs: м : Application : MSExchange Common : 19.07.2012 9:38:18 : 4999 :General : : : / м: EXCH-xx-00-01.DOMAIN.LOCAL : мм " " 788 мм E12, c-RTL-AMD64, 14.02.0297.000, OWA, M.E.Clients.Owa, M.E.C.O.C.OwaStoreObjectId.CreateFromItemId, System.ArgumentNullException, 18bb, 14.02.0309.002. ErrorReportingEnabled: False Xml : <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="MSExchange Common" /> <EventID Qualifiers="16388">4999</EventID> <Level>2</Level> <Task>1</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2012-07-19T05:38:18.000000000Z" /> <EventRecordID>23604</EventRecordID> <Channel>Application</Channel> <Computer>EXCH-xx-00-01.DOMAIN.LOCAL</Computer> <Security /> </System> <EventData> <Data>788</Data> <Data>E12</Data> <Data>c-RTL-AMD64</Data> <Data>14.02.0297.000</Data> <Data>OWA</Data> <Data>M.E.Clients.Owa</Data> <Data>M.E.C.O.C.OwaStoreObjectId.CreateFromItemId</Data> <Data>System.ArgumentNullException</Data> <Data>18bb</Data> <Data>14.02.0309.002</Data> <Data>False</Data> <Data> </Data> </EventData> </Event> AND: м : System : Service Control Manager : 19.07.2012 9:53:25 : 7011 : : : : / м: EXCH-xx-00-01.DOMAIN.LOCAL : м (30000 м) "MSExchangeRPC". Xml : <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" /> <EventID Qualifiers="49152">7011</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x8080000000000000</Keywords> <TimeCreated SystemTime="2012-07-19T05:53:25.181229100Z" /> <EventRecordID>8817</EventRecordID> <Correlation /> <Execution ProcessID="508" ThreadID="7092" /> <Channel>System</Channel> <Computer>EXCH-xx-00-01.DOMAIN.LOCAL</Computer> <Security /> </System> <EventData> <Data Name="param1">30000</Data> <Data Name="param2">MSExchangeRPC</Data> </EventData> </Event> After service restart (MSExchangeRPC) users gained the access. Does anybody can help with the issue or hint what to check?! Thanks a lot. PS: Exchange 2010 was installed with SP2 + RU2 (placed in update folder), RU1 was not used. PS2: once we were installing RU3 on SP2 and server crashed (power off). We decided that the issue was in power-cord (or UPS). We reinstalled RU3 and everything was fine. PS3: in RPC access loggin (txt) we found that last access attept was at 9:23 (it's really far from event time shoed).

There is a Exchange 2010 SP2.RU3 It was installed in mixed environment with Ex2003.SP2 (now it's off). Today access for RPC client (MAPI) was broken. Only clients with MAPI connection were experiencing the issue; OWA worked fine. We found to events in logs: м : Application : MSExchange Common : 19.07.2012 9:38:18 : 4999 :General : : : / м: EXCH-xx-00-01.DOMAIN.LOCAL : мм " " 788 мм E12, c-RTL-AMD64, 14.02.0297.000, OWA, M.E.Clients.Owa, M.E.C.O.C.OwaStoreObjectId.CreateFromItemId, System.ArgumentNullException, 18bb, 14.02.0309.002. ErrorReportingEnabled: False Xml : <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="MSExchange Common" /> <EventID Qualifiers="16388">4999</EventID> <Level>2</Level> <Task>1</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2012-07-19T05:38:18.000000000Z" /> <EventRecordID>23604</EventRecordID> <Channel>Application</Channel> <Computer>EXCH-xx-00-01.DOMAIN.LOCAL</Computer> <Security /> </System> <EventData> <Data>788</Data> <Data>E12</Data> <Data>c-RTL-AMD64</Data> <Data>14.02.0297.000</Data> <Data>OWA</Data> <Data>M.E.Clients.Owa</Data> <Data>M.E.C.O.C.OwaStoreObjectId.CreateFromItemId</Data> <Data>System.ArgumentNullException</Data> <Data>18bb</Data> <Data>14.02.0309.002</Data> <Data>False</Data> <Data> </Data> </EventData> </Event> AND: м : System : Service Control Manager : 19.07.2012 9:53:25 : 7011 : : : : / м: EXCH-xx-00-01.DOMAIN.LOCAL : м (30000 м) "MSExchangeRPC". Xml : <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" /> <EventID Qualifiers="49152">7011</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x8080000000000000</Keywords> <TimeCreated SystemTime="2012-07-19T05:53:25.181229100Z" /> <EventRecordID>8817</EventRecordID> <Correlation /> <Execution ProcessID="508" ThreadID="7092" /> <Channel>System</Channel> <Computer>EXCH-xx-00-01.DOMAIN.LOCAL</Computer> <Security /> </System> <EventData> <Data Name="param1">30000</Data> <Data Name="param2">MSExchangeRPC</Data> </EventData> </Event> After service restart (MSExchangeRPC) users gained the access. Does anybody can help with the issue or hint what to check?! Thanks a lot. PS: Exchange 2010 was installed with SP2 + RU2 (placed in update folder), RU1 was not used. PS2: once we were installing RU3 on SP2 and server crashed (power off). We decided that the issue was in power-cord (or UPS). We reinstalled RU3 and everything was fine. PS3: in RPC access loggin (txt) we found that last access attept was at 9:23 (it's really far from event time shoed).

Hi there, I am sorry that it seems that you have requested support for exchange product in Russian version. Since we do not familiar with this language, it is very difficult for us to perform further troubleshooting steps, such as capture the log file. This forum is geared to answer on the English version of the product. For the forum support in Russian please use the link below http://social.technet.microsoft.com/Forums/ru-mo/exchangesvrgeneral/ Your understanding would be appreciated. Just for your reference, you may try to remove SP2 and then reinstall SP2, or create new OST files for effected users. Hope it is helpful. Fiona Liao TechNet Community Support

Hi there, I am sorry that it seems that you have requested support for exchange product in Russian version. Since we do not familiar with this language, it is very difficult for us to perform further troubleshooting steps, such as capture the log file. This forum is geared to answer on the English version of the product. For the forum support in Russian please use the link below http://social.technet.microsoft.com/Forums/ru-mo/exchangesvrgeneral/ Your understanding would be appreciated. Just for your reference, you may try to create new OST files for effected users. Hope it is helpful. Fiona Liao TechNet Community Support

If no more questions on this thread, we may mark it as answered. Your understanding would be appreciated. Fiona Liao TechNet Community Support

Hi, Fiona_Liao. About Russian - there is enough information in the messages that is spelled in English (xml formated). The only data in Russian is that Dr.Watson is sending report on the error and the transaction time limit exceeded (30000 ms) for the service MSExchangeRPC. There are no affected users - everything works fine after service restart. It's seems to me that uninstalling Exchange SP is not a good idea in any case, because it can lead to much more serious problems. Thanks a lot.

Just for your reference, you may try to remove SP2 and then reinstall SP2, or create new OST files for effected users. Hope it is helpful. Fiona Liao TechNet Community Support Hi Fiona, Just for your Information... Its not possible to uninstall a Service Pack.Martina Miskovic

Not, Martina, we cannot uninstall theservice pack. I am sorry about my mistake, and thanks for your reminder. I have already changed my earlier post. Fiona Liao TechNet Community Support

Thanks for your explaination. I researched again based on event id 4999, and found that this issue might be caused by antivirus applcation. So if you have this kind of application installed in your CAS server, please remove it or temporarily disable it, and then try again. Besides, event id 4999 might accompany with id 9659, for a particular user. It is best if you can find this user out. Meanwhile I would still suggest you post the question in Russian forum, which can be more efficiently. Fiona Liao TechNet Community Support

We have only FEP installed on Exchange server, so there is no third-party antivirus solution installed. There was no 9659 event id. All the users were affected until we restarted the service. PS: I'll post the thread in Russian forum, but in English one there are much more experienced administrators participate.

Thanks for your cooperation and understanding. I've also involved a next level support engineer in this thread. If there is any finds he/she will join directly and keep you posted. And I will also keep on monitoring. Hope the issue can be resolved soon. Fiona Liao TechNet Community Support

QRS, What roles are installed on the Exchange 2010 server?? Do you have a Public Folder database on the same server where you are facing RPC Client Access issues?? See whether this KB is applicable in your case..http://support.microsoft.com/kb/2535105 Thanks, VB

Exchange 2010 SP2.RU3 - single server with HT+CAS+MB roles installed + FEP. We have no public folder database.

How frequently does the issue happen?? Can you post the last few entries from the RCA logs located at C:\Program Files\Microsoft\Exchange Server\V14\Logging\RPC Client Access location during the time of failure...

The issue was only once (I'll try to find that log file - if it's not overwritten). I wrote, that during the issue there were no records in the file! Last record was at 9:23 and the next record was logged after the service was restarted.

It sounds as if the RPC Client Access process went into a hang state and came back to normal once you restarted the service. This condition will not provide us with useful info on logs. The next time the issue happens, please contact CTS as they can collect memory dumps of the process and also debug traces to see what is the issue.