I recently completed a migration from Exchange 2003 to a new Exchange 2007 box. Everything was fine with the 2007 box prior to the migration, but at some point during the move mailbox process the MAD.exe process started consuming 13% of the CPU continuously. It's been over a month now like this, and despite several reboots and restarts of the service it continues to consume the same 13% CPU all the time 24 hours a day. Does anyone have any clue why it is doing this?

According to our internal incidents database, most of these issues are related to some third party programs such as AV program and other factor is the contacting GC/DCs issue. http://technet.microsoft.com/en-us/library/bb124173.aspx At this time, you may check from below factors. 1. Whether you left old Antivirus program without updating after migrating to Exchange 2007? I suggest you disable all antivirus program and check the effect. moreover, you can also run MSCONFIG and disable all third party services after hiding Microsoft related service, after clean boot, please restart server and check the result. 2. Please check Event Viewer, let me know if there is any related Event ID logged in application/system log? 3. In you EMC, Toolbox,-> Best Practices Analyzer(EXBPA) , -> Run a health check and export the XML result to me at v-jassol at Microsoft dot com. Hope it helps. -Jason

No third party AV, i am running Forefront. There are a couple of errors in the event log, a couple of performance counter update errors, a couple errors updating forefront. But this is really the only noteable error. Log Name: ApplicationSource: FSEAgentDate: 9/14/2008 8:00:49 PMEvent ID: 5170Task Category: (5)Level: ErrorKeywords: ClassicUser: N/AComputer: Description:Transport scan engine exception occurred I will mail you the BPA results.

I received your EXBPA log through Email, and I found that the TCP/IP KeepAlivetime value changed, the current value is 300000. According to my research, the default value would better to 7200000. If you modified the value, it may cause the MAD process take up much CPU utilization, because the central process being DSACESS run as the system attendant process(MAD.exe). For more information, please refer to the following Articles: You may experience network-related problems after you install Windows Server 2003 SP2 or the Scalable Networking Pack on a Windows Server 2003-based computer http://support.microsoft.com/kb/948496/ http://support.microsoft.com/kb/936594/ How to harden the TCP/IP stack against denial of service attacks in Windows 2000 http://support.microsoft.com/?id=315669 -Jason

Sorry this took me so long to follow up on. I had to fight with some group policy settings and then reboot the system. I've got the setting reverted back to 7200000. Unfortunately the problem still persists exactly the same. I'd appreciate any more suggestions you might have.

Hi, Looks like its an Error due to incorrect DNS Server records. 1)Make sure the correct DNS Server is configured on the NIC card 2) Is it configured properly to resolve all the host names in your environment. Try pinging the Domain Controller from the Exchange 2007 machine. 3) Check for the host records on the DNS Server for both Excahnge Servers. 4) Just to check that the server is connecting to the DNS Server At Command Prompt, type nslookup and see if its connecting to the correct DNS Server.Dinesh