I can't find much online about this with websearch.

Log Name:      Application
Source:        FfoSystemProbe
Date:          12/23/2014 10:05:53 AM
Event ID:      1006
Task Category: General
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      myserver.mydomain.local
Description:
System Probe configuration. The logging directory was not specified in the registry and system probe will not be enabled on this server.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="FfoSystemProbe" />
    <EventID Qualifiers="32768">1006</EventID>
    <Level>3</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-12-23T17:05:53.000000000Z" />
    <EventRecordID>10531</EventRecordID>
    <Channel>Application</Channel>
    <Computer>myserver.mydomain.local</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

A quick registry search does find a key:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\FfoSystemProbe]
"EventMessageFile"="C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Bin\\Microsoft.Exchange.SystemProbeMsg.dll"
"CategoryMessageFile"="C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Bin\\Microsoft.Exchange.SystemProbeMsg.dll"
"TypesSupported"=dword:00000007
"CategoryCount"=dword:00000001

A quick look at the Bin folder under Exchange installation shows the dll file exists and permissions on it seem to match similar files in the same folder.

Duplicate registry entries exist also with identical subkeys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\EventLog\Application\FfoSystemProbe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\FfoSystemProbe

• Edited by MnM Show Tuesday, December 23, 2014 6:03 PM

Hello,

Thank you for your post.

This is a quick note to let you know that we are performing research on this issue.

If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

Hi MnM,

Do we have any 3rd party applicaiton on the server, especially Antivirus or scanning applicaiton? Please uninstall them and check.

Title: Anti-Virus Software in the Operating System on Exchange Servers
Link: http://technet.microsoft.com/en-us/library/bb332342(v=exchg.150).aspx

And we can disable all non-microsoft services:

(1)    Run->msconfig

(2)    Select Hide all Microsoft Services

(3)   Disable all

Then check the event again.

Moreover, after further research, we didnt find any clues about this event in Exchange 2013 CU7. And do we have any feature or function affected on the server? If no problem when we use Exchange 2013 CU7, currently we can ignore the event and wait for the update for more information about the event. I will post here if we have more clues. Thanks for your understanding and cooperation.

Best Regards,

Eric Zou

Hi Eric

There are no 3rd party apps on this server.  Only Exchange and the associated features and roles necessary for it.  I can't see any effect of this error anywhere either other than the log entry at boot.

Hi MnM,

Since we have no 3rd party apps on the server and we don't see any effect of the event, we can just ignore the event and wait for the update for more information about the event. Once we haev any more information, we will let you know ASAP. Thanks for your understanding. 

Best Regards,

Eric Zou

Hi MnM,

We still can't find more related information about this event in Exchange 2013 Cu7, thus we may consider ignore it as no issue found about the event. Appreciate your understanding.

Best Regards,

Eric Zou

Hello everybody,
first please excuse my bad english, it long ago I learned it.
But I'm also looking for a solution I found this discus. We have the same mistake in our Exchange 2013, however, with CU8.
Also still without antivirus software or other 3rd party products.
Is there now a solution for?

Best Regrards

Th.Kemkes