Hi All

We have an on-premise Exchange 2013 server which is used as a SMTP relay for sending emails via Office 365.

We've pointed numerous devices / applications at this server for SMTP email and works fine. 

I would like to obtain a list of devices / applications which are sending emails via this Exchange server.  Can someone point me in the right direction how i can extract this information and from which log?   I guess it will be a list of IP Addresses which are sending messages via this server. That will be sufficient.

Thanks!

I just installed Microsoft Exchange Server 2013 onto a Microsoft Server 2012 and I'm unable to get to the management console.

When I tried this, https://<servernameFQDN>/ecp it fails with

HTTP Error 404.0 - Not Found

The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

Detailed Error Information:

Module  IIS Web Core

Notification  MapRequestHandler

Handler  StaticFile

Error Code  0x80070002

Requested URL  https://<servernameFQDN>:443/ecp

Physical Path  C:\inetpub\wwwroot\ecp  (this part is of special focus because no such directory exists)

Logon Method  Anonymous

Logon User  Anonymous

There are two "web sites" on that IIS server; Default and Exchange Backend. Ports used for Default are 80 and 443. Ports used for Exchange Backend are 81 and 444. I've made NO post-installation configuration changes. Everything is exactly as the Exchange Installation set it to. During installation, everything was left at the default settings except one item; the installation target path was changed from using drive "C:" to drive "E:", which is using the ReFS file system.

If I attempt to go to https://<servernameFQDN:444>/ecp I get to the login screen, as I should. But when I login, I'm taken to Outlook Web App.

I regularly see the following error on my Exchange servers:

RunspaceId              : 0ffa50a4-3a83-45ed-8f30-25aadba55c3e
Server                  : ex13-db2
CurrentHealthSetState   : NotApplicable
Name                    : Mapi.Submit.Monitor
TargetResource          : MailboxTransport
HealthSetName           : MailboxTransport
HealthGroupName         : ServiceComponents
AlertValue              : Unhealthy
FirstAlertObservedTime  : 10/11/2015 2:52:29 PM
Description             :
IsHaImpacting           : False
RecurranceInterval      : 0
DefinitionCreatedTime   : 10/9/2015 7:50:17 PM
HealthSetDescription    :
ServerComponentName     : None
LastTransitionTime      : 10/11/2015 2:52:29 PM
LastExecutionTime       : 10/19/2015 10:15:35 AM
LastExecutionResult     : Succeeded
ResultId                : 129414608
WorkItemId              : 320
IsStale                 : False
Error                   :
Exception               :
IsNotified              : False
LastFailedProbeId       : 65
LastFailedProbeResultId : 67891150
ServicePriority         : 2
Identity                : MailboxTransport\Mapi.Submit.Monitor\MailboxTransport
IsValid                 : True
ObjectState             : New

While this post:
https://www.gavin.pro/2015/08/26/exchange-2013-mapi-submit-monitor/

says you can safely ignore and override this monitor, I have not been able to do so. This is particularly frustrating because our SCOM server catches these alerts and shows our Exchange servers as unhealthy.

I ran the following command to override it:

[PS] C:\Windows\system32>Get-GlobalMonitoringOverride | fl

RunspaceId         : 0ffa50a4-3a83-45ed-8f30-25aadba55c3e

ItemType           : Monitor

PropertyName       : Enabled

PropertyValue      : 0

HealthSetName      : MailboxTransport

MonitoringItemName : Mapi.Submit.Monitor

TargetResource     :

ExpirationTime     : 10/17/2016 10:15:52 AM

ApplyVersion       : Version 15.0 (Build 1104.5)

CreatedTime        : 10/18/2015 10:16:02 AM

Identity           : MailboxTransport\Mapi.Submit.Monitor

IsValid            : True

ObjectState        : New

But the alert still returns.

I have tried overriding the Responder instead of the Monitor:

Add-GlobalMonitoringOverride -ItemType "Responder"

but the state is still unhealthy.

Any advice? Thanks!

I tried to update body of an item using EWS, however, I get the following error:

Exception calling "Update"with"1" argument(s):"The invalid value '' was specified for the 'Body' element."FullyQualifiedErrorId:ServiceXmlSerializationException

Steps to reproduce problem:

$item.Body.Text = 30 -as [char]
$item.Update("AlwaysOverwrite")

Cause of error is usage of control characters (File, Group, Record, and Unit: FS, GS, RS and US).

Hi everyone,
for a couple of days users receive the following error when they try to connect to OWA.
The error occured suddenly, nothing was changed at the configuration.
its Exchange 2013 with CU10 and Windows 2012 R2 Servers.
2 CAS and 2 Mailbox Servers within a DAG.

X-ClientId: KQYO - LXOX - ESTK - YVPBVMLG
X-OWA-Error: SDServerErr;System.Xml.XmlException
X-OWA-Version: 15.0.1130.7
X-FEServer: *Server*
X-BEServer: *Server*
Date: 18.01.2016 10:06:35
*url*owa/auth/errorfe.aspx?owaError=SDServerErr;System.Xml.XmlException&owaVer=15.0.1130.7&be=*server*&msg=ErrorUnexpectedFailure
I tried it already with deleting canary data values in the AD. Did not helped.
I have no more ideas for solving this issue. Maybe somebody here could help me.
Thanks.

Hi Technet,

I have 2 exchange 2010 servers in 2 different physical AD sites.  Each server is Mailbox, HUB transport & CAS server. Both servers share a send connector to a smart host, with 1 receive connector configured on server 1.  So all external inbound email received on server1 and transported to server 2 via WAN if necessary.

The issue i have is when searching transport log explorer via the EMC.  Server 1 returns full information, I can see the messages inbound, outbound to smart host, and send to server2. 

Server2 however contains very little information.  I see nothing about outbound email, no send to server1, the results I do get contain no information about the recipients of the email, nor subject. 

I have compared the logging settings of both servers, and they appear to be identical.  I did however change the default log location on server 2 to another hard disc in the server.  

Could anyone help me here with some possible solutions to the issue?

Thanks in Advance

Dear all,

we are currently running Exchange Server 2010.

I often have a request from users to delete the email that they have accidentally sent out and failed to recall from specific mailboxes. may I know whether any command that I could run? Maybe it is best that we can delete based on subject name or maybe based on sender name within specific period of time.

Please advise.

Thanks.

This is rather frustrating. I have been going back and forth with this for a while. We can't change the passwords for users.

I go in to the EAC, Permissions, Admin Roles, Organization Management, then try to add in the role for Reset Passwords. Go to save and I get the following.

You don't have access to create, change, or remove the "Reset Password-Organization Management" management role assignment. You must be assigned a delegating role assignment to the management role or its parent in the hierarchy without a scope restriction.

That's fine, so I do a bunch of research and everyone says the same things. Almost everyone cheers that this did the trick.

• Launch Exchange Management shell.
• Type Add-pssnapin microsoft* and hit enter.
• Type Install-CannedRbacRoles and hit enter.
• Type Install-CannedRbacRoleAssignments and hit enter.

Almost everyone cheers that this did the trick. Unfortunately as soon as I enter the Install-CannedRbacRoles in to the Exchange Shell I get the following.

Install-CannedRbacRole : The term 'Install-CannedRbacRole' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
+ Install-CannedRbacRole
+ ~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Install-CannedRbacRole:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

There are a whopping 2 Google entries I found searching "The term 'Install-CannedRbacRole' is not recognized as the name of a cmdlet" No one has answered the question of where to go if the Install-CannedRbacRole is unable to be used. Everything is being entered in to the Exchange Shell from Admin accounts ran as Administrator. Any ideas what is going on here?

Hi,

I have a problem where Event ID 3028 Source MSExchangeApplicationLogic is beeing logged every 6 hours with 4 same type of events. Here is the log:

Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.995.29\ext\killbit\killbit.xml' because it is being used by another process.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
   at System.IO.File.Open(String path, FileMode mode, FileAccess access, FileShare share)
   at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

The environment is single virtual MS Exchange 2013 server running on Windows 2012 R2. DC is running on a separate server.

I can't seem to find any articles or blogs relating to this issue.

Thanks for any help.

Dear all, 

I am facing an issue with connecting to the Exchange 2013 server from Exchange Management Shell. Once I click on the icon, the following message shows: 

VERBOSE: Connecting to mydomain.com.
New-PSSession : [mydomain.com] Connecting to remote server mydomain.com failed with the following
error message : WinRM cannot process the request. The following error with errorcode 0x8009030e occurred while using
Kerberos authentication: A specified logon session does not exist. It may already have been terminated.
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or
use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config. For more
information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:1+ New-PSSession -ConnectionURI "$connectionUri" -ConfigurationName Microsoft.Excha ...+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+ CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotin
   gTransportException+ FullyQualifiedErrorId : 1312,PSSessionOpenFailed
VERBOSE: Connecting to mydomain.com.
New-PSSession : [mydomain.com] Connecting to remote server mydomain.com failed with the following
error message : WinRM cannot process the request. The following error with errorcode 0x8009030e occurred while using
Kerberos authentication: A specified logon session does not exist. It may already have been terminated.
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or
use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config. For more
information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:1+ New-PSSession -ConnectionURI "$connectionUri" -ConfigurationName Microsoft.Excha ...+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+ CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotin
   gTransportException+ FullyQualifiedErrorId : 1312,PSSessionOpenFailed
VERBOSE: Connecting to mydomain.com.
New-PSSession : [mydomain.com] Connecting to remote server mydomain.com failed with the following
error message : WinRM cannot process the request. The following error with errorcode 0x8009030e occurred while using
Kerberos authentication: A specified logon session does not exist. It may already have been terminated.
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or
use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config. For more
information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:1+ New-PSSession -ConnectionURI "$connectionUri" -ConfigurationName Microsoft.Excha ...+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+ CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotin
   gTransportException+ FullyQualifiedErrorId : 1312,PSSessionOpenFailed
Exception calling "FindAll" with "0" argument(s): "Unknown error (0x80005000)"
At C:\Program Files\Microsoft\Exchange Server\V15\bin\ConnectFunctions.ps1:253 char:2+     $search.FindAll()+     ~~~~~~~~~~~~~~~~~+ CategoryInfo          : NotSpecified: (:) [], MethodInvocationException+ FullyQualifiedErrorId : COMException

_AutoDiscoverAndConnect : No Exchange servers are available in any Active Directory sites. You can't connect to remote
Powershell on a computer that only has the Management Tools role installed.
At C:\Program Files\Microsoft\Exchange Server\V15\bin\ConnectFunctions.ps1:45 char:4
+             _AutoDiscoverAndConnect $credential $Forest -useWIA:$useWIA -ClientApplicatio ...+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+ CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,_AutoDiscoverAndConnect

Failed to connect to an Exchange server in the current site.
Enter the server FQDN where you want to connect.:
VERBOSE: Connecting to .
New-PSSession : Cannot bind parameter 'ConnectionUri'. Cannot convert value
"http:///powershell?serializationLevel=Full;ExchClientVer=15.0.847.32;clientApplication=ManagementShell;TargetServer="
to type "System.Uri". Error: "Invalid URI: The hostname could not be parsed."
At line:1 char:30+ New-PSSession -ConnectionURI "$connectionUri" -ConfigurationName Microsoft.Excha ...+                              ~~~~~~~~~~~~~~~~+ CategoryInfo          : InvalidArgument: (:) [New-PSSession], ParameterBindingException+ FullyQualifiedErrorId : CannotConvertArgumentNoMessage,Microsoft.PowerShell.Commands.NewPSSessionCommand

Surprisingly I can log into the Exchange Administrative Center with no issues. I didn't change the password since I built the exchange server. Also the Admin password didn't change from the domain controller since it was built.

What could be the possible issue?

Hello techies out there.

I am trying to build a simple script where I need a simple email alert if Any DB does not have an Activation preference of 1. Why i say simple because I have an environment over 500 DBs spread across and i dont want any complex methods to collect the data.

i took the reference from https://gallery.technet.microsoft.com/scriptcenter/Monitor-Databases-in-DAG-310b7bd1 but this only works for 2010 and I got an Exchange 2013 environment so I tried to dig more and build something with reference to the existing one.

########################### Add Exchange Shell##############################

If ((Get-PSSnapin | where {$_.Name -match "Microsoft.Exchange.Management.PowerShell"}) -eq $null)
{
    Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn
}

#########################Get the Exchange Servers###########################

    $exchangeserver = Get-ExchangeServer | Format-List

##########################Define Variables & Strings########################
[Bool] $bolFailover = $False
[String] $errMessage = $null

$databases = Get-MailboxDatabase | Sort-Object Name

 ForEach ($database in $databases) {
    $db = $database.Name
    $curServer = $database.Server
    $ownServer = $database.ActivationPreference | ? {$_.Value -eq 1}

    # Compare the server where the DB is currently active to the server where it should be
    If ($curServer -ne $ownServer.value)
    {
            $errMessage += "`n$db on $curServer should be on $ownServer!"
        }

        $bolFailover = $True
    }

$errMessage += "`n`n"


If ($bolFailover) {
        
    #$errMessage
    Send-MailMessage -From "test@tesdomain.com" -To "test@testdomain.com" -Subject "Activation Pref Not Good!" -Body $errMessage -Priority High -SMTPserver "12345.testdomain.com"
}

Now I do get an email out but it lists all those 500 dbs and says should be on !

Also i dont get a value for the $ownserver.

I am now a bit lost and spent too much time thinking on this. So though would ask the experts here since I am no hardcore scripting guy. Thanks again for all your help.

I think if this can be completed may be will be of help to others as well. Please assist,

The emails sent and received have To: and From: addresses repeated at least 50+ times.

Initial email goes out fine. Several replies also do well. Then replies to the same email thread are having From and To addresses repeated several times.

Below is an example: I have just replaced the exact email IDs with some sample.

From: Campus Management Client Services [mailto:validemail@campusmgmt.com [mailto:validemail@campusmgmt.com [mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com [mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com [mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com [mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com%20[mailto:validemail@campusmgmt.com]]]]]] 
Sent: Friday, January 22, 2016 1:41 PM
To: UserName <validemailuser@campusmgmt.com [mailto:validemailuser@campusmgmt.com] [mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]] [mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]%20[mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]]] [mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]%20[mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]]%20[mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]%20[mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]]]] [mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]%20[mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]]%20[mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]%20[mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]]]%20[mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]%20[mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]]%20[mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]%20[mailto:validemailuser@campusmgmt.com%20[mailto:validemailuser@campusmgmt.com]]]]]>;

---

Naveed.DG MCITP, MCTS -SharePoint 2010 Administrator "Vote As Helpful" If it helps!!

I piloted a migration to O365 a few years ago when my environment was mainly Exchange 2007.  I had to standup a couple 2010 CAS's to proxy the traffic.  We scrapped the pilot after testing, and of course there was no way to remove the config beyond ADSIEDIT.  

Fast forward to today with my environment all Exchange 2013, and I'm trying to standup a new hybrid configuration.  The Hybrid Configuration Wizard detects the old config and offers to upgrade it.  If I don't check "upgrade", I can't continue.  When it tries to upgrade the configuration, it tries to connect one of the old Exchange 2010 CAS servers that have been retired for over a year.  As far as I can tell, the MSExchCoexistenceServers and MSExchCoexistenceTransportServers attributes in the Hybrid Configuration portion of the schema are the only references to these servers left in Active Directory.  Exchange was gracefully removed, the servers were removed from AD, and they were powered off.  I tried adding a DNS A record to point that name to a new server.  I also tried changing the schema attributes to point to a new server.  Neither worked.

What are my options here?  I figure if worse comes to worse I can cross my fingers and run remove-hybridconfiguration (notes say to only do this with MS Support) or just blow away that part of the schema.  Neither are really too appealing to me. Thanks!

Dear friends,

I have a scenario. I have 2 data centers each hosting a CAS and a Mailbox server.

Data center 1:

CAS01 (Acting as witness)

MAIL01 (Primary)

Data center 2:

CAS02

MAIL02

Due to a previous experience (when data center 1 fails all dbs got dismounted until the data center become online) i have configured alternate witness server as CAS02 in the DAG. As of my knowledge,when data center 1 fails the primary mail server and the witness will fail and all the dbs got dismounted.

How can we restore this, i know that the command is

Restore-DatabaseAvailabilityGroup -Identity DAG1 .........
Can you guys plse let me know the exact command to do a fail over/switching to the alternate witness server?

Thanks.

Arun

We run Exchange 2010 - our email client is outlook 2010.  Trying to find a process whereby  all users  folder called trash is purging documents which is older than 365 days.  There must be exchange administrators that have implemented this task in their environment. 

Migration from 2007 to 2013.  Performed all the steps required per technet.microsoft.com/en-us/library/jj898581(v=exchg.150).aspx.  Exchange 2007 has been completely removed from the organization.  Still getting many of these errors although public folders are working perfectly (i.e. mail is flowing to the public folders without bounces or any issues at all).  Any thoughts on how to get these event log errors to stop?

Thanks,

Paul

After upgrading to CU6 for Exchange 2013, the Application event log is flooded with MSExhange Common error 106: Performance counter updating error. Counter name is Time in Resource per second, category name is MSExchange Activity Context Resources. Optional code: 2. Exception: The exception thrown is : System.InvalidOperationException: Instance 'ad-powershell-defaultdomain' already exists with a lifetime of Process.  It cannot be recreated or reused until it has been removed or until the process using it has exited.
   at System.Diagnostics.SharedPerformanceCounter.FindInstance(Int32 instanceNameHashCode, String instanceName, CategoryEntry* categoryPointer, InstanceEntry** returnInstancePointerReference, Boolean activateUnusedInstances, PerformanceCounterInstanceLifetime lifetime, Boolean& foundFreeInstance)
   at System.Diagnostics.SharedPerformanceCounter.GetCounter(String counterName, String instanceName, Boolean enableReuse, PerformanceCounterInstanceLifetime lifetime)
   at System.Diagnostics.SharedPerformanceCounter..ctor(String catName, String counterName, String instanceName, PerformanceCounterInstanceLifetime lifetime)
   at System.Diagnostics.PerformanceCounter.InitializeImpl()
   at System.Diagnostics.PerformanceCounter.get_RawValue()
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.get_RawValue()
Last worker process info : System.ArgumentException: Process with an Id of 4776 is not running.
   at System.Diagnostics.Process.GetProcessById(Int32 processId)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
Processes running while Performance counter failed to update:
14256 winlogon
15748 powershell
6524 Microsoft.Exchange.UM.CallRouter
5904 w3wp
584 lsass
780 LogonUI
4324 MSExchangeFrontendTransport
6292 Microsoft.Exchange.Store.Worker
2744 WmiPrvSE
576 services
3136 MonitoringHost
12568 svchost
1360 hostcontrollerservice
8648 WmiPrvSE
1752 SMSvcHost
1160 spoolsv
1356 sftracing
9528 TiWorker
10444 explorer
2732 w3wp
14908 WmiPrvSE
3124 Microsoft.Exchange.Store.Worker
4696 Microsoft.Exchange.Store.Service
4892 MSExchangeMailboxAssistants
12208 w3wp
15740 powershell
2128 WMSvc
748 rundll32
8232 w3wp
8400 svchost
3700 MonitoringHost
15716 powershell
5864 MSExchangeThrottling
2908 w3wp
4088 Microsoft.Exchange.EdgeSyncSvc
5660 scanningprocess
2292 wuauclt
5656 umservice
6044 scanningprocess
4076 noderunner
1908 MSExchangeHMHost
2892 Microsoft.Exchange.AntispamUpdateSvc
3876 noderunner
3676 MSExchangeMailboxReplication
15732 powershell
2096 svchost
7096 UMWorkerProcess
516 winlogon
908 svchost
1296 HealthService
1492 svchost
2824 w3wp
12324 dwm
1560 ForefrontActiveDirectoryConnector
304 smss
10820 w3wp
8464 svchost
888 Microsoft.Exchange.ContentFilter.Wrapper
5024 msexchangerepl
488 wininit
8564 taskhostex
5272 Microsoft.Exchange.ServiceHost
3832 noderunner
10088 w3wp
480 csrss
7920 conhost
872 svchost
5992 scanningprocess
4808 msdtc
8352 dllhost
860 TrustedInstaller
4008 rundll32
4400 conhost
656 svchost
9828 w3wp
1832 noderunner
4392 MSExchangeHMWorker
1828 mqsvc
700 svchost
1628 Microsoft.Exchange.Diagnostics.Service
3596 w3wp
2220 Microsoft.Exchange.Directory.TopologyService
1820 MSExchangeDelivery
7532 MSExchangeTransport
13372 svchost
832 svchost
9696 conhost
8316 svchost
1580 dllhost
3980 Microsoft.Exchange.RpcClientAccess.Service
8788 VSSVC
5948 MSExchangeTransportLogSearch
2992 MSExchangeDagMgmt
10632 csrss
1216 fms
3776 rundll32
5356 MSExchangeSubmission
7908 EdgeTransport
11576 w3wp
1600 inetinfo
1008 svchost
416 csrss
808 svchost
7608 w3wp
1588 updateservice
4148 Microsoft.Exchange.Search.Service
640 w3wp
796 dwm
2568 SMSvcHost
1188 svchost
4 System
3484 rdpclip
0 Idle
Performance Counters Layout information: A process is holding onto a transport performance counter. processId : 15716, counter : time in resource per second Value=30 SpinLock=0 Lifetime=Type: 1 ProcessId: 15716 StartupTime: 130608376318179644, currentInstance : ad-powershell-defaultdomain(95CC324A) RefCount=1 SpinLock=0 Offset=38216, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 15716, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 15716 StartupTime: 130608376318179644, currentInstance : mb-powershell-defaultdomain(CC014C00) RefCount=1 SpinLock=0 Offset=37888, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 15716, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 15716 StartupTime: 130608376318179644, currentInstance : rpca-powershell-defaultdomain(4598AFAF) RefCount=1 SpinLock=0 Offset=37560, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 3596, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 3596 StartupTime: 130608368805385179, currentInstance : rpca-w3wp-msexchangemapimailboxapppool(E28F3117) RefCount=1 SpinLock=0 Offset=37232, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 3596, counter : time in resource per second Value=86 SpinLock=0 Lifetime=Type: 1 ProcessId: 3596 StartupTime: 130608368805385179, currentInstance : mb-w3wp-msexchangemapimailboxapppool(F9439F58) RefCount=1 SpinLock=0 Offset=36904, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 3596, counter : time in resource per second Value=301 SpinLock=0 Lifetime=Type: 1 ProcessId: 3596 StartupTime: 130608368805385179, currentInstance : ad-w3wp-msexchangemapimailboxapppool(35491652) RefCount=1 SpinLock=0 Offset=36576, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 10088, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 10088 StartupTime: 130608368435182301, currentInstance : rpca-w3wp-msexchangemapifrontendapppool(2C7F2005) RefCount=1 SpinLock=0 Offset=36248, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 10088, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 10088 StartupTime: 130608368435182301, currentInstance : mb-w3wp-msexchangemapifrontendapppool(BE5C2DAA) RefCount=1 SpinLock=0 Offset=35920, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 10088, counter : time in resource per second Value=50 SpinLock=0 Lifetime=Type: 1 ProcessId: 10088 StartupTime: 130608368435182301, currentInstance : ad-w3wp-msexchangemapifrontendapppool(C0FDFAE0) RefCount=1 SpinLock=0 Offset=35592, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 640, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 640 StartupTime: 130608368405334576, currentInstance : rpca-w3wp-msexchangeowacalendarapppool(8F10D1B5) RefCount=1 SpinLock=0 Offset=35264, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 640, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 640 StartupTime: 130608368405334576, currentInstance : mb-w3wp-msexchangeowacalendarapppool(2D8C9EBA) RefCount=1 SpinLock=0 Offset=34936, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 640, counter : time in resource per second Value=75 SpinLock=0 Lifetime=Type: 1 ProcessId: 640 StartupTime: 130608368405334576, currentInstance : ad-w3wp-msexchangeowacalendarapppool(D845E230) RefCount=1 SpinLock=0 Offset=34608, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 12208, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 12208 StartupTime: 130608368146087354, currentInstance : rpca-w3wp-msexchangeautodiscoverapppool(6DABF262) RefCount=1 SpinLock=0 Offset=34280, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 12208, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 12208 StartupTime: 130608368146087354, currentInstance : mb-w3wp-msexchangeautodiscoverapppool(D1C6EF4D) RefCount=1 SpinLock=0 Offset=33952, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 12208, counter : time in resource per second Value=1002 SpinLock=0 Lifetime=Type: 1 ProcessId: 12208 StartupTime: 130608368146087354, currentInstance : ad-w3wp-msexchangeautodiscoverapppool(FD072087) RefCount=1 SpinLock=0 Offset=33624, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 11576, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 11576 StartupTime: 130608368080143532, currentInstance : rpca-w3wp-msexchangeecpapppool(57806648) RefCount=1 SpinLock=0 Offset=33296, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 11576, counter : time in resource per second Value=204 SpinLock=0 Lifetime=Type: 1 ProcessId: 11576 StartupTime: 130608368080143532, currentInstance : mb-w3wp-msexchangeecpapppool(E27E6507) RefCount=1 SpinLock=0 Offset=32968, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 11576, counter : time in resource per second Value=1804 SpinLock=0 Lifetime=Type: 1 ProcessId: 11576 StartupTime: 130608368080143532, currentInstance : ad-w3wp-msexchangeecpapppool(B648688D) RefCount=1 SpinLock=0 Offset=32640, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 10820, counter : time in resource per second Value=64 SpinLock=0 Lifetime=Type: 1 ProcessId: 10820 StartupTime: 130608368364391554, currentInstance : ad-w3wp-msexchangeoabapppool(CC31A917) RefCount=1 SpinLock=0 Offset=32312, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 10820, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 10820 StartupTime: 130608368364391554, currentInstance : mb-w3wp-msexchangeoabapppool(58D0A79D) RefCount=1 SpinLock=0 Offset=31984, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 10820, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 10820 StartupTime: 130608368364391554, currentInstance : rpca-w3wp-msexchangeoabapppool(8149E8D2) RefCount=1 SpinLock=0 Offset=31656, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 7608, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7608 StartupTime: 130608367931073979, currentInstance : rpca-w3wp-msexchangeowaapppool(4AA799E7) RefCount=1 SpinLock=0 Offset=31328, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 7608, counter : time in resource per second Value=792 SpinLock=0 Lifetime=Type: 1 ProcessId: 7608 StartupTime: 130608367931073979, currentInstance : mb-w3wp-msexchangeowaapppool(C3953468) RefCount=1 SpinLock=0 Offset=31000, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 7608, counter : time in resource per second Value=2537 SpinLock=0 Lifetime=Type: 1 ProcessId: 7608 StartupTime: 130608367931073979, currentInstance : ad-w3wp-msexchangeowaapppool(160BE662) RefCount=1 SpinLock=0 Offset=30672, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5904, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5904 StartupTime: 130608367955918049, currentInstance : rpca-w3wp-msexchangepowershellapppool(3CF18BF) RefCount=1 SpinLock=0 Offset=30344, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5904, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5904 StartupTime: 130608367955918049, currentInstance : mb-w3wp-msexchangepowershellapppool(A686C810) RefCount=1 SpinLock=0 Offset=30016, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5904, counter : time in resource per second Value=2178 SpinLock=0 Lifetime=Type: 1 ProcessId: 5904 StartupTime: 130608367955918049, currentInstance : ad-w3wp-msexchangepowershellapppool(9E48CD5A) RefCount=1 SpinLock=0 Offset=29688, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 3832, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 3832 StartupTime: 130608365723574632, currentInstance : rpca-noderunner-contentenginenode1(316BF6E3) RefCount=1 SpinLock=0 Offset=29360, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 3832, counter : time in resource per second Value=1148 SpinLock=0 Lifetime=Type: 1 ProcessId: 3832 StartupTime: 130608365723574632, currentInstance : mb-noderunner-contentenginenode1(2EE8286C) RefCount=1 SpinLock=0 Offset=29032, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 3832, counter : time in resource per second Value=322 SpinLock=0 Lifetime=Type: 1 ProcessId: 3832 StartupTime: 130608365723574632, currentInstance : ad-noderunner-contentenginenode1(61591E6) RefCount=1 SpinLock=0 Offset=28704, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 8232, counter : time in resource per second Value=73 SpinLock=0 Lifetime=Type: 1 ProcessId: 8232 StartupTime: 130608367954980517, currentInstance : ad-w3wp-msexchangepowershellfrontendapppool(FAEFA1B4) RefCount=1 SpinLock=0 Offset=28376, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 8232, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 8232 StartupTime: 130608367954980517, currentInstance : mb-w3wp-msexchangepowershellfrontendapppool(34B9187E) RefCount=1 SpinLock=0 Offset=28048, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 8232, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 8232 StartupTime: 130608367954980517, currentInstance : rpca-w3wp-msexchangepowershellfrontendapppool(E1115251) RefCount=1 SpinLock=0 Offset=27720, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 9828, counter : time in resource per second Value=909 SpinLock=0 Lifetime=Type: 1 ProcessId: 9828 StartupTime: 130608367291344391, currentInstance : ad-w3wp-msexchangerpcproxyapppool(99BB8ED6) RefCount=1 SpinLock=0 Offset=27392, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 9828, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 9828 StartupTime: 130608367291344391, currentInstance : mb-w3wp-msexchangerpcproxyapppool(B190F21C) RefCount=1 SpinLock=0 Offset=27064, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 9828, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 9828 StartupTime: 130608367291344391, currentInstance : rpca-w3wp-msexchangerpcproxyapppool(8B7590B3) RefCount=1 SpinLock=0 Offset=26736, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 7908, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7908 StartupTime: 130608366316230865, currentInstance : rpca-edgetransport-edgetransport.exe(911B6EB3) RefCount=1 SpinLock=0 Offset=26408, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 7908, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7908 StartupTime: 130608366316230865, currentInstance : mb-edgetransport-edgetransport.exe(A5AF4BBC) RefCount=1 SpinLock=0 Offset=26080, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 7908, counter : time in resource per second Value=679 SpinLock=0 Lifetime=Type: 1 ProcessId: 7908 StartupTime: 130608366316230865, currentInstance : ad-edgetransport-edgetransport.exe(E79D4A36) RefCount=1 SpinLock=0 Offset=25752, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 7096, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7096 StartupTime: 130608366107949622, currentInstance : rpca-umworkerprocess-umworkerprocess.exe(970CCE33) RefCount=1 SpinLock=0 Offset=25424, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 7096, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7096 StartupTime: 130608366107949622, currentInstance : mb-umworkerprocess-umworkerprocess.exe(8A7F8A3C) RefCount=1 SpinLock=0 Offset=25096, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 7096, counter : time in resource per second Value=89 SpinLock=0 Lifetime=Type: 1 ProcessId: 7096 StartupTime: 130608366107949622, currentInstance : ad-umworkerprocess-umworkerprocess.exe(95818B6) RefCount=1 SpinLock=0 Offset=24768, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 7532, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7532 StartupTime: 130608366287637157, currentInstance : rpca-msexchangetransport-msexchangetransport.exe(24F56C33) RefCount=1 SpinLock=0 Offset=24440, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 7532, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 7532 StartupTime: 130608366287637157, currentInstance : mb-msexchangetransport-msexchangetransport.exe(92FB3D3C) RefCount=1 SpinLock=0 Offset=24112, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 7532, counter : time in resource per second Value=12 SpinLock=0 Lifetime=Type: 1 ProcessId: 7532 StartupTime: 130608366287637157, currentInstance : ad-msexchangetransport-msexchangetransport.exe(2447ECB6) RefCount=1 SpinLock=0 Offset=23784, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 6292, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 6292 StartupTime: 130608366134668487, currentInstance : rpca-microsoft.exchange.store.worker-microsoft.exchange.store.worker.exe(ABB009B3) RefCount=1 SpinLock=0 Offset=23456, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 6292, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 6292 StartupTime: 130608366134668487, currentInstance : mb-microsoft.exchange.store.worker-microsoft.exchange.store.worker.exe(38BA31BC) RefCount=1 SpinLock=0 Offset=23128, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 6292, counter : time in resource per second Value=704 SpinLock=0 Lifetime=Type: 1 ProcessId: 6292 StartupTime: 130608366134668487, currentInstance : ad-microsoft.exchange.store.worker-microsoft.exchange.store.worker.exe(11106236) RefCount=1 SpinLock=0 Offset=22800, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 6524, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 6524 StartupTime: 130608366054199628, currentInstance : rpca-microsoft.exchange.um.callrouter-microsoft.exchange.um.callrouter.exe(E8475353) RefCount=1 SpinLock=0 Offset=22472, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 6524, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 6524 StartupTime: 130608366054199628, currentInstance : mb-microsoft.exchange.um.callrouter-microsoft.exchange.um.callrouter.exe(8F65881C) RefCount=1 SpinLock=0 Offset=22144, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 6524, counter : time in resource per second Value=40 SpinLock=0 Lifetime=Type: 1 ProcessId: 6524 StartupTime: 130608366054199628, currentInstance : ad-microsoft.exchange.um.callrouter-microsoft.exchange.um.callrouter.exe(78F52196) RefCount=1 SpinLock=0 Offset=21816, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5656, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5656 StartupTime: 130608365987637119, currentInstance : rpca-umservice-umservice.exe(E39A1133) RefCount=1 SpinLock=0 Offset=21488, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5656, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5656 StartupTime: 130608365987637119, currentInstance : mb-umservice-umservice.exe(FFBB273C) RefCount=1 SpinLock=0 Offset=21160, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5656, counter : time in resource per second Value=45 SpinLock=0 Lifetime=Type: 1 ProcessId: 5656 StartupTime: 130608365987637119, currentInstance : ad-umservice-umservice.exe(9A8AC6B6) RefCount=1 SpinLock=0 Offset=20832, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5948, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5948 StartupTime: 130608365970762140, currentInstance : rpca-msexchangetransportlogsearch-msexchangetransportlogsearch.exe(EF66F2D3) RefCount=1 SpinLock=0 Offset=20504, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5948, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5948 StartupTime: 130608365970762140, currentInstance : mb-msexchangetransportlogsearch-msexchangetransportlogsearch.exe(B020391C) RefCount=1 SpinLock=0 Offset=20176, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5948, counter : time in resource per second Value=28 SpinLock=0 Lifetime=Type: 1 ProcessId: 5948 StartupTime: 130608365970762140, currentInstance : ad-msexchangetransportlogsearch-msexchangetransportlogsearch.exe(20578116) RefCount=1 SpinLock=0 Offset=19848, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5864, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5864 StartupTime: 130608365966074661, currentInstance : rpca-msexchangethrottling-msexchangethrottling.exe(8C1DA893) RefCount=1 SpinLock=0 Offset=19520, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5864, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5864 StartupTime: 130608365966074661, currentInstance : mb-msexchangethrottling-msexchangethrottling.exe(AB2BADDC) RefCount=1 SpinLock=0 Offset=19192, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5864, counter : time in resource per second Value=8 SpinLock=0 Lifetime=Type: 1 ProcessId: 5864 StartupTime: 130608365966074661, currentInstance : ad-msexchangethrottling-msexchangethrottling.exe(8962F4D6) RefCount=1 SpinLock=0 Offset=18864, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5356, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5356 StartupTime: 130608365930918390, currentInstance : rpca-msexchangesubmission-msexchangesubmission.exe(60747EB3) RefCount=1 SpinLock=0 Offset=18536, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5356, counter : time in resource per second Value=400 SpinLock=0 Lifetime=Type: 1 ProcessId: 5356 StartupTime: 130608365930918390, currentInstance : mb-msexchangesubmission-msexchangesubmission.exe(67B4173C) RefCount=1 SpinLock=0 Offset=18208, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5356, counter : time in resource per second Value=390 SpinLock=0 Lifetime=Type: 1 ProcessId: 5356 StartupTime: 130608365930918390, currentInstance : ad-msexchangesubmission-msexchangesubmission.exe(85200236) RefCount=1 SpinLock=0 Offset=17880, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 3980, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 3980 StartupTime: 130608365902793374, currentInstance : rpca-microsoft.exchange.rpcclientaccess.service-microsoft.exchange.rpcclientaccess.service.exe(E4305E13) RefCount=1 SpinLock=0 Offset=17552, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 3980, counter : time in resource per second Value=15105 SpinLock=0 Lifetime=Type: 1 ProcessId: 3980 StartupTime: 130608365902793374, currentInstance : mb-microsoft.exchange.rpcclientaccess.service-microsoft.exchange.rpcclientaccess.service.exe(BBA60BDC) RefCount=1 SpinLock=0 Offset=17224, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 3980, counter : time in resource per second Value=1570 SpinLock=0 Lifetime=Type: 1 ProcessId: 3980 StartupTime: 130608365902793374, currentInstance : ad-microsoft.exchange.rpcclientaccess.service-microsoft.exchange.rpcclientaccess.service.exe(B6581E56) RefCount=1 SpinLock=0 Offset=16896, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 3676, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 3676 StartupTime: 130608365883887116, currentInstance : rpca-msexchangemailboxreplication-msexchangemailboxreplication.exe(276F4DB3) RefCount=1 SpinLock=0 Offset=16568, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 3676, counter : time in resource per second Value=55 SpinLock=0 Lifetime=Type: 1 ProcessId: 3676 StartupTime: 130608365883887116, currentInstance : mb-msexchangemailboxreplication-msexchangemailboxreplication.exe(95E41BC) RefCount=1 SpinLock=0 Offset=16240, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 3676, counter : time in resource per second Value=1045 SpinLock=0 Lifetime=Type: 1 ProcessId: 3676 StartupTime: 130608365883887116, currentInstance : ad-msexchangemailboxreplication-msexchangemailboxreplication.exe(394712B6) RefCount=1 SpinLock=0 Offset=15912, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5272, counter : time in resource per second Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 5272 StartupTime: 130608365924980876, currentInstance : rpca-microsoft.exchange.servicehost-microsoft.exchange.servicehost.exe(39C8D53) RefCount=1 SpinLock=0 Offset=15584, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5272, counter : time in resource per second Value=13 SpinLock=0 Lifetime=Type: 1 ProcessId: 5272 StartupTime: 130608365924980876, currentInstance : mb-microsoft.exchange.servicehost-microsoft.exchange.servicehost.exe(E7963A1C) RefCount=1 SpinLock=0 Offset=15256, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 5272, counter : time in resource per second Value=1004 SpinLock=0 Lifetime=Type: 1 ProcessId: 5272 StartupTime: 130608365924980876, currentInstance : ad-microsoft.exchange.servicehost-microsoft.exchange.servicehost.exe(10E8B196) RefCount=1 SpinLock=0 Offset=14928, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 4892, counter : time in resource per second Value=2260 SpinLock=0 Lifetime=Type: 1 ProcessId: 4892 StartupTime: 130608365821855891, currentInstance : rpca-msexchangemailboxassistants-msexchangemailboxassistants.exe(DEAC0933) RefCount=1 SpinLock=0 Offset=14600, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 4892, counter : time in resource per second Value=19900 SpinLock=0 Lifetime=Type: 1 ProcessId: 4892 StartupTime: 130608365821855891, currentInstance : mb-msexchangemailboxassistants-msexchangemailboxassistants.exe(A754293C) RefCount=1 SpinLock=0 Offset=14272, categoryName: MSExchange Activity Context Resources
A process is holding onto a transport performance counter. processId : 4892, counter : time in resource per second Value=3491 SpinLock=0 Lifetime=Type: 1 ProcessId: 4892 StartupTime: 130608365821855891, currentInstance : ad-msexchangemailboxassistants-msexchangemailboxassistants.exe(EE890EB6) RefCount=1 SpinLock=0 Offset=13944, categoryName...

Hi All,.

Recently we have received a request to block any outlook connection coming from IPAD / IPHONE basically from IO's

Hence i am looking for a solution like some mailbox policy or activesyncdevice rule which can help me to block outlook connection coming from Apple devices. 

---

BR/Deepak

Dear All,
I have two 2013 exchange mailbox  server in DAG ,on one of the server the queue file size is too large,i even tried deleting it and recreate it but it stills grows in a day,this causes my volume to run out of disk space and  the mail flow stops.
how can i keep the size in limit.

---

TechGUy,System Administrator.