I got my even log filled with entries like this:Event Type: ErrorEvent Source: MSExchangeIS Mailbox StoreEvent Category: Event History Event ID: 9785Date: 23-4-2007Time: 22:32:13User: N/AComputer: EXCHANGEDescription:An attempt to write an invalid event history watermark has been detected. Database: '/o=Whatever/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=EXCHANGE/cn=Microsoft Private MDB'. Consumer: 'df4b5565-53e9-4776-a824-185f22fb3ca6'. Mailbox: '6dcc0c30-0227-42b0-998c-52cd4c03476c'. Watermark counter: '0x18855'. Database event counter: '0x18856'. User performing the operation: 'SYSTEM'. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Data:0000: 5b 44 49 41 47 5f 43 54 [DIAG_CT0008: 58 5d 00 00 96 00 00 00 X]..–...0010: ff a0 12 00 00 00 00 22 ....."0018: 79 02 88 00 00 00 34 2a y.ˆ...4*0020: 40 10 bf f9 ff ff 06 62 @..b0028: 00 10 1d fa ff ff 8e 35 ...Ž50030: 40 10 9b 08 00 00 34 2a @.›...4*0038: 40 10 bf f9 ff ff 06 62 @..b0040: 00 10 0f 01 04 80 8e 35 .....€Ž50048: 40 10 9b 08 00 00 bd 44 @.›...D0050: 20 10 00 00 00 00 03 59 ......Y0058: 20 10 00 00 00 00 03 59 ......Y0060: 20 10 00 00 00 00 bd 44 .....D0068: 20 10 00 00 00 00 03 59 ......Y0070: 20 10 00 00 00 00 03 59 ......Y0078: 20 10 00 00 00 00 03 59 ......Y0080: 20 10 00 00 00 00 bd 44 .....D0088: 20 10 00 00 00 00 03 59 ......Y0090: 20 10 00 00 00 00 03 59 ......Y0098: 20 10 00 00 00 00 03 59 ......Y00a0: 20 10 00 00 00 00 ..... Does anyone have any idea what might have caused it? Honestly, I don't even have the slightest clue where to start looking.

I have got exactly the same error: Event Type:ErrorEvent Source:MSExchangeIS Mailbox StoreEvent Category:Event History Event ID:9785Date:15/10/2007Time:09:36:08User:N/AComputer:EXCHANGE07Description:An attempt to write an invalid event history watermark has been detected. Database: '/o=Whatever/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=EXCHANGE07/cn=Microsoft Private MDB'. Consumer: 'df4b5565-53e9-4776-a824-185f22fb3ca6'. Mailbox: '126a62aa-21c4-437a-8398-c2e92f8f9ed2'. Watermark counter: '0x184518'. Database event counter: '0x184519'. User performing the operation: 'SYSTEM'. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Data:0000: 5b 44 49 41 47 5f 43 54 [DIAG_CT0008: 58 5d 00 00 66 00 00 00 X]..f...0010: ff 34 1c 00 00 00 00 4f 4.....O0018: 80 02 58 00 00 00 34 2a €.X...4*0020: 40 10 bf f9 ff ff 06 62 @..b0028: 00 10 1d fa ff ff 8e 35 ...Ž50030: 40 10 9b 08 00 00 03 59 @.›....Y0038: 20 10 00 00 00 00 03 59 ......Y0040: 20 10 00 00 00 00 03 59 ......Y0048: 20 10 00 00 00 00 03 59 ......Y0050: 20 10 00 00 00 00 03 59 ......Y0058: 20 10 00 00 00 00 03 59 ......Y0060: 20 10 00 00 00 00 03 59 ......Y0068: 20 10 00 00 00 00 03 59 ......Y0070: 20 10 00 00 00 00 ..... No clue either.

Are you guys seeing any unusual activity with disk i/o ? If not failing drives, or long disk queue lengths, etc I'd say take this one to PSS.

Cause: ------------ This is due to migration of users to E2K7 After users are moved from legacy Exchange to the new Exch2007 .They're probably referrring to mailboxes that have been moved or deleted. Resolution: ----------------- This has been fixed in build 08.00.0544.00.

I am getting the same event 9785 errors...I have rollup 5 installed so I don't think this was fixed in any recent builds. I am using Quest Migration Manager to migrate mailboxes across orgs. Also, the move mailbox wizard in the EMC reports failures but the mailbox still moves over. What is this error message?

I am getting the same error too... any help!!!???

I installed de Rollup 4 for EX2007 SP1 and the issue is gone.