Video Screencast Help
Protect Your POS Environment Against Retail Data Breaches. Learn More.

Sync generates event 3196 and 3420

Created: 17 Apr 2013 | 2 comments
Tobbe.S's picture

Hi.

I have a EV 9.0 environment where we are implementing a leavers policy.

Part of this process is to hide the leaving user from the GAL and to add the user to a different provisioning group in order to empty the mailbox on all archivable items. This works well with the required registry keys added in order to archive hidden mailboxes. The users mailbox will remain in this state for a longer period of time before we disable the mailbox for further archiving and delete it from Exchange.

So far so good, however at the two daily syncronizations the eventlog is populated with event 3196 and 3420 for all users that are hidden from the GAL. This doesn´t give any real consequence since the affected users actually have left the company so the need to write new info to the hidden message is naturally very low.
The problem is rather that the eventlog is populated with so many errors and warnings that REAL problems might be undetected.

Can anyone enlighten me as to WHY we are receiving the events and HOW we can avoid them, while keeping the users mailboxes hidden from the GAL?

Thanks in advance and have a nice day.

/Tobbe

Operating Systems:

Comments 2 CommentsJump to latest comment

Tobbe.S's picture

Sure.

I hope that formatting isn´t going to make this a challenge but here´s the events, with DN´s slightly edited:

Event Type:     Error
Event Source: Enterprise Vault
Event Category: Archive Task
Event ID:  3196
Date: 2013-04-17
Time: 12:12:06
User: N/A
Computer: WSRV105

Description:
An error has occurred whilst synchronizing the properties of mailbox /o=Exorg/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=legacyexchangeDN on Exchange server WSRV151.

Error: Unspecified error  [0x80004005]

Internal: .\AgentExchSynch.cpp (CAgentExchSynch::SynchronizeMailboxEntryV9) [lines {837,943,950,965,980,997,998,1002}] built Aug  6 19:31:15 2010

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp

The 3196 event then results in the following 3420 event:

Event Type:     Warning
Event Source: Enterprise Vault
Event Category:  Archive Task
Event ID:  3420
Date:  2013-04-17
Time:  12:12:06
User:  N/A
Computer: WSRV105

Description:
Failed to open mailbox. This mailbox will not be synchronized on this run. The problem may be temporary, in which case the mailbox will be correctly synchronized on the next run.

Task: Exchange Mailbox Archiving Task for WSRV151
Mailbox: CN=display name,OU=Disabled,OU=QUARANTINE,DC=sub,DC=domain,DC=com

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp