How to troubleshoot MAPI logon script errors in MOM

Friends - I found a MOM KB article disguised as an Exchange KB on my daily KBAlertz email this week, and the troubleshooting info it contains is quite good really. “How to troubleshoot MAPI logon script errors in Microsoft Operations Manager 2005 when it is used together with Exchange Server 2003” - KB911144. One of the cornerstones of virtually every MOM deployment is the Exchange 2003Management Pack and its sibling, the Exchange Best Practices Analyzer. I can’t think of any management pack that stands up to this pair from a service oriented monitoring perspective. And while the transactional monitoring components are invaluable, we often see in the newsgroups that they can be quite challenging to configure and troubleshoot for new MOM administrators. Fortunately, the Exchange Management Pack Configuration Wizard (EMPCW) automates the vast majority of the configuration. The transaction components I’m referring to are: MAPI logon (which can be configured per server or per store) Mailflow - Sending and receiving of a test messages between servers. (In a hub-and-spoke topology, I like to send messages from my hub site bridgehead to all my mailbox servers – validating WAN connectivity at no extra charge). OWA/OMA/EAS Synthetic Logon – This is a script that simulates logon to OWA and mobility sites. (Note that SSL is required). This is a completely different topic, but whilst I’m here, let me say if you haven’t read it already, check out: Top 3 Configuration Issues with the Exchange Mgmt Pack And the OWACHECK tool mentioned in this article is a MUST HAVE for troubleshooting OWA synthetic logon failures….but you have to call PSS to get it. But I digress. Back to MAPI logon failures… The Mailflow configuration involves the creation of a disabled user with a mailbox for every server or every store (depending on your selection). In the process of the wizard you’ll be prompted for the MOM Mailbox Access Account. This is just a domain user that, during the configuration process executed by the EMPCW, is granted the following rights on each of these test mailboxes (named MyServerNameMOM, MyServerNameMOM1, etc) for purposes of sending these test messages: 1) Full Mailbox Access, 2) Delete mailbox storage 3) Read. It should be noted that adding the MOM Mailbox Access Account to Domain Admins actually results in LESSER PERMISSIONS (lesser relevant permissions anyway). How? Domain Admins are DENIED Send As / Receive As rights throughout the Exchange Org by default. Without Send As, mailflow will fail. So, Domain Users will do just fine, thank you very much. That being said, take note the latest Exchange hotfix for the dreaded 9548 error actually rearranges some permissions, removing Send As from the list for the MOM Mailbox Access Account, which breaks mailflow and requires Send As rights be added back manually to the MOM test mailboxes (I just went through this on 41 test mailboxes! Aye Carumba). See my previous post for more info on this. Finally, I arrive at the purpose of this rant. This KB provides a set of general troubleshooting procedures, as well as specific steps for addressing the most common MAPI failures (MAPI_E_NOT_FOUND, MAPI_E_LOGON_FAILED, MAPI_E_NOT_INITIALIZED) and provides resolution steps for each. Very informative indeed. I also want to point out a good MAPI troubleshooting tool mentioned in this article - MFCMAPI…a learning project that turned into a MAPI client vis-à-vis Mdbvu32.exe. See kb291794. Anyway, more insight into these transactional processes is always welcome, so bookmark this one for a rainy day…and while you’re at it, check out the other KB articles referenced in this one, that take you further down the rabbit hole that is Exchange 2003 (I took the red pill a long time ago :-) ). Cheers, Pete