Exchange Server Forums

Help please with Event ID 9548 and 1022

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> Server Security >> Help please with Event ID 9548 and 1022

Page: [1]

Message

<< Older Topic Newer Topic >>

Limited time MSExchange.org offer! -- 1.Sep.2008 1:00:00 PM

TechGenix and SolarWinds have partnered to provide free copies of SolarWinds Exchange Monitor to all visitors who join the MSExchange.org Forums. SolarWinds Exchange Monitor is a handy desktop dashboard that continuously monitors Microsoft Exchange to deliver real-time insight into Exchange services, mail queue sizes, and host server health. Learn more about Exchange Monitor and the free offer!

Help please with Event ID 9548 and 1022 - 24.Jul.2008 6:49:36 AM

danielhargrove

Posts: 2
Joined: 24.Jul.2008
Status: offline

Hello

Can anyone help with the issues I am having details below.

I am running Exchange 2003 SP2 and I keep getting the following server events on a nightly basis that I do not understand:

Event ID: 9548
Source: MSExchangeIS
Description:
Disabled user /o=XXXXX/ou=First Administrative Group/cn=Recipients/cn=customerservices7 does not have a master account SID. Please use Active Directory MMC to set an active account as this user's master account.

And at the same time

Event ID: 1022
Source: MSExchangeIS Mailbox Store
Desciption:
Logon Failure on database "First Storage Group\Mailbox Store (ITDS2K3XXXX)" - Windows 2000 account NT AUTHORITY\SYSTEM; mailbox /o=XXXXX/ou=First Administrative Group/cn=Recipients/cn=customerservices7.
Error: -2147221231

Just before these errors are logged the MSExchange Public Store finishes an Online Defraghmentation.

The above errors are repeated one after the other for a few minutes. The errors are generated at the same time every night.

Just after these errors have been logged the Microsoft Search (Gatherer) appears to run and completes successfully.

After hunting around all I can see with regards to customerservices7 is that it is an additional SMTP address for an enabled user within our organisation. There is no mailbox or user with this name.

I have had these error events before, but these were for disabled users and setting the Exchange permission "Associated external account" in the Self ACL in AD appears to of fixed it in these cases.

Any ideas would be great. Im a little stuck now and getting a little frustrated.

Thanks for any help in advance.

Dan Hargrove

< Message edited by danielhargrove -- 24.Jul.2008 6:51:46 AM >

Post #: 1

Featured Links*

RE: Help please with Event ID 9548 and 1022 - 25.Jul.2008 6:51:18 AM

Sembee

Posts: 3604
Joined: 17.Jan.2008
From: Somewhere near London, UK
Status: offline

You have an account or a mailbox with that name somewhere in the org. It may well have been deleted and the deletion hasn't fully replicated. Have you looked at the mailbox list to see if it is listed there?

It could be an orphaned object in the domain somewhere.

Simon.

_____________________________

Simon Butler,
Exchange MVP
Blog: http://www.sembee.co.uk/
Web: http://www.amset.info/
In the UK? Hire me: http://www.amset.co.uk/

(in reply to danielhargrove)

Post #: 2