Exchange 2013 CU5

Every 1-3 minutes I have about 7 Eventlog entries with event id 16028, sources MsExchangeTransport, MSExchangeFrontEndTransport, MSExchangeTransportSubmission and MSExchangeTransportDelivery.

"A forced configuration update for Microsoft.Exchange.Transport..... has successfully completed.

I found a post that this should be solved with CU5. I installed CU5 this Weekend, but I still have the same behavior.

Any suggestions how to stop these information events?

Regards
Peter

Any other errors in the App log?

• Edited by Connect_Mallik Monday, June 16, 2014 1:06 PM

General:
---------------------------------------------------------
A forced configuration update for Microsoft.Exchange.Transport.ReceiveConnectorConfiguration has successfully completed. Object details from  the last notification-based reload: . New details: 
---------------------------------------------------------

Details:
---------------------------------------------------------

---------------------------------------------------------

The error is for all sources the same.

Regards
Peter

Is this happening on all CAS Servers or only 1? Does restarting the Transport service

Only one CAS is running, and restarting the Transport service doesn't help.

I installed CU5 this weekend, transport service has been restarted. The problem existed already before I installed CU5.

• Edited by Connect_Mallik Monday, June 16, 2014 1:06 PM

• Edited by Connect_Mallik Monday, June 16, 2014 1:06 PM

• Edited by Connect_Mallik Monday, June 16, 2014 1:06 PM

Hi Gulab

We don't have CodeTwo installed, but I did run the Exchange2013-KB2938053-FixIt script.

Still getting these information events.

Regards
Peter

I am seeing same on CU4/SP1... No other errors, no diagnostic logging etc...

Installing CU5 now and will let you guys know...

Same behaviour in CU5, however seems no issue on server.

An article for 16028 in Exchange 2010 confirms that there shouldn't be any issue and no user action required, When changes are made to the transport configuration, the Active Directory directory service notifies the transport server to update its configuration cache. When the transport server receives this type of notification, it reloads the configuration from Active Directory into the cache, and then uses the new information for subsequent message transfer operations.... 

http://technet.microsoft.com/en-us/library/ff982804(v=exchg.141).aspx

Hi Amit,

According to the article, 16028 event will be generated when changes are made to the transport configuration.

So that means, every 1-3 minutes there are some changes are made. Is that normal?

Hello,

Those transport configuration changes updates could be anything small such as IP allow lists, IP block lists, and sender repudiation information but definitely not normal. It could be a bug that might be fixed in future CU's, we never know...

But what I am saying is, server shouldn't have any issue because of these events as these look to be pure informational events and we can ignore them... Just annoying when we look at the event logs...

Hi Peter,

the solution is below

http://www.codetwo.com/kb/codetwo-and-exchange-2013-sp1

Regards

Hi Peter,

the solution is below

http://www.codetwo.com/kb/codetwo-and-exchange-2013-sp1

Regards

Thanks Amit

Hopefully this will be fixed soon, because it is really annoying.

Regards
Peter

The problem is worse than annoying.  Email stops flowing after a while with no footprints to track down why.  

I updated my Exchange 2013 server to CU5 from CU1 last week and the 16028 events started showing up as described in earlier posts.   When Email stopped flowing yesterday, I went to Administrative Tools...Services to restart the Transport Service.  That timed out and failed.  So I went to the Task Manager and killed the Transport Service by hand and started it up again.  That opened up an email floodgate as queued up emails poured in and out.  So apparently, after a while the CU5 Transport Service just stops talking to the world and only talks to itself.  

I did apply the fix described in that Code2 reference.  The Code2 fix does ***NOT***  solve the problem.  But now I can apparently install third party transport tools I don't care about.  

I have one Exchange 2013 CU5 server running on Windows 2012 (not R2) with the latest Windows Update patches applied.  That's it - simple as can be.  

- Greg Scott

Is there any way to disable this log?

Greg / Peter et al.

I am having the exact same problem that you describe (I think).  New Dell PE T620, new domain.  New Server 2012 R2 on one VM.  New Exchange Server 2013 on another VM.  Tiny client with 15 users.

We get literally tens of thousands of events 3010, 16028 in the logs and to a lesser extent 9000, 9017, 9018 and once in a while a 6002.

The DC's security event log fills up within hours and the Exchange server creates a new 1MB log file every 2 - 5 minutes, but the db size is not really changing so we know it is not "normal" usage causing this.

I have tried capturing info using ExMon, but it doesn't indicate that the traffic is coming from actual users (no Username or Client IP/machine info captured.)  ExMon's documentation indicates that this means it is unauthenticated activity causing it.  I don't know if that means that this is internal/external spam/malware or something different.

Any assistance would be greatly appreciated.

Thx,

Joel

Same as Matus.

Have 3 different customers on Exchange 2013 CU6. All with same problem :(

Please HELP!

Hi everybody

In the meantime I have Exchange 2013 Servers with CU7 installed, and still the same behavior.

Has anybody found a solution?

Regards
Peter