An 'SMTPSVC' error event (ID: 429) was logged within the last 24 hours

[This topic is intended to address a specific issue called out by the Exchange Server Analyzer Tool. You should apply it only to systems that have had the Exchange Server Analyzer Tool run against them and are experiencing that specific issue. The Exchange Server Analyzer Tool, available as a free download, remotely collects configuration data from each server in the topology and automatically analyzes the data. The resulting report details important configuration issues, potential problems, and nondefault product settings. By following these recommendations, you can achieve better performance, scalability, reliability, and uptime. For more information about the tool or to download the latest versions, see "Microsoft Exchange Analyzers" at https://go.microsoft.com/fwlink/?linkid=34707.]  

Topic Last Modified: 2007-03-16

The Microsoft Exchange Analyzer tool queries the IIS metabase to determine the value of the LM/SmtpSvc/%SMTPInstance%/ServerState property for each instance of a Simple Mail Transfer Protocol (SMTP) Virtual Server.

The ServerState property presents the current state of the server instance. The states, and the corresponding state codes, are as follows: 1 (starting), 2 (started), 3 (stopping), 4 (stopped), 5 (pausing), 6 (paused), or 7 (continuing).

If the Exchange Analyzer determines that the value for the ServerState property for an SMTP Virtual Server instance is not equal to 2 (started) the Exchange Analyzer then queries the Win32_NTLogEvent Microsoft Windows Management Instrumentation (WMI) class to determine whether an Event 429 error has been logged for the SMTP Service (SMTPSVC) within the last 24 hours.

If the Exchange Analyzer finds that the SMTP Virtual Server Instance (VSI) is not started and there is at least one Event 429 error logged for the SMTPSVC within the past 24 hours, the Exchange Analyzer displays a warning.

This warning indicates that there may be issues with the designated directories for the SMTP Virtual Server Instance.

SMTP is the native mail protocol for mail submission and mail transport for Exchange Server. This means that clients use SMTP to send messages and Exchange servers use SMTP to deliver messages and message data.

When messages arrive at the Exchange computer through the SMTP service, the data is written to the hard disk as an .eml file. By default, these files are stored in the <drive>:\Program Files\Exchsrvr\Mailroot folder on the same partition that Exchange is installed on.

This problem can be caused by one of the following:

  • The <drive>:\Program Files\Exchsrvr\Mailroot directory path or folders under that directory path have been moved, are missing, or have become corrupt

  • The permissions to the <drive>:\Program Files\Exchsrvr\Mailroot or folders under that directory path are not set appropriately.

  • Antivirus application scanning of the <drive>:\Program Files\Exchsrvr\Mailroot directory path or folders under that directory path.

To address this warning, do one or more of the following:

  • Verify the location and integrity of the <drive>:\Program Files\Exchsrvr\Mailroot directory path and folders under that directory path.

  • Verify the permissions on the <drive>:\Program Files\Exchsrvr\Mailroot directory path and folders under that directory path.

  • Make sure that Antivirus applications are not scanning the folders in the <drive>:\Program Files\Exchsrvr\Mailroot directory path.

To verify the Mailroot directory path on Exchange Server 2003

  1. Open Exchange System Manager.

  2. Expand Servers, expand an Exchange server, expand Protocols, and then expand SMTP.

  3. Right-click an SMTP virtual server (for example, Default SMTP Virtual Server), and then click Stop.

  4. Right-click the SMTP virtual server again, and then click Properties.

  5. Click the Messages tab.

  6. In the Queue directory field, verify the full path of the appropriate Mailroot folder. You can click Browse to browse the local computer for the path.

  7. Click OK to save the changes.

  8. Right-click the SMTP virtual server, and then click Start.

To verify the Mailroot directory path on Exchange 2000 Server

  1. Stop all the Exchange Server and IIS services on the Exchange 2000 Server computer whose SMTP virtual server Mailroot folder you want to verify.

  2. Verify that the affected SMTP virtual server's value for msExchSmtpQueueDirectory is configured for the appropriate path.

  3. Wait for Active Directory to replicate this change to the global catalog servers used by this Exchange server.

  4. Start the Microsoft Exchange System Attendant service.

  5. On the Exchange Server computer, check for the presence of three instances of Event ID 1005 in the Application event log that have an Event Source of MSExchangeMU and a Category of General.

  6. Restart the Exchange Server computer for any changes to take effect.

To verify the default permissions to the Mailroot directory path on Exchange 2000 Server and Exchange Server 2003

  1. Start Windows Explorer, and then navigate to and expand the Exchsvr folder.

  2. Right-click the Mailroot folder, and then click Properties

  3. Click the Security tab, and then verify the following default permissions:

Account Permissions

Administrators

Full Control

Authenticated Users

Read and Execute, List Folder Contents, Read

Creator Owner

None

Server Operators

Modify, Read and Execute, List Folder Contents, Read, Write

System

Full Control

  1. Verify these default permissions for all folders for each Virtual Server Instance are present.

For more information about the procedures that are described, see the following Microsoft Knowledge Base articles:

For more information about SMTP virtual server settings, see the following Microsoft Knowledge Base articles:

For more information about configuring antivirus scanning applications for use with Exchange, see Anti-Virus folder exclusions have not been configured.

For detailed information about how to configure exclusions on RealTime scanning in Symantec AntiVirus Corporate Edition, see the Symantec antivirus Web site (http://www.symantec.com).

Note

Web addresses can change, so you might be unable to connect to the Web site or sites that are mentioned here.

For more information about fortifying an Exchange Server environment against e-mail transmitted viruses and worms, see "Slowing and Stopping E-Mail Viruses in an Exchange Server 2003 Environment" (https://go.microsoft.com/fwlink/?LinkId=47587).

For more information about how to use antivirus software with Exchange Server, see the following Microsoft Knowledge Base articles:

For a list of third-party antivirus software that is available for Exchange Server, see "Exchange Server 2007 Partners: Antivirus, Antispam" (https://go.microsoft.com/fwlink/?linkid=16226).