| Event Id | 9671 |
| Source | MSExchangeIS |
| Description | User <user name> has exceeded the allowed maximum number of simultaneous registrations for MAPI notifications. The configured maximum number of event notification registrations is <number>. |
| Event Information | According to Microsoft, Explanation : When a MAPI client (such as Outlook) starts and connects to an Exchange server, the client registers itself with the Information Store. The client registers its User Datagram Protocol (UDP) post and an IP address so that the server can use this information to communicate to the client when a new message is received by the store for the client. This is called a PUSH NOTIFICATION because the Server PUSHes this information to the client. The server saves the clients Push Notification Registrations in its memory. When a new message is received for a particular client, the server looks up that clients registration information (UDP port and IP address) and informs the client that a new message is waiting in the store. It is then the clients responsibility to download the information so that the user sees the new mail. Exchange Server now has a limit on the default number of registrations (and context size settings) that can be set up by a particular client. This is set on the server by adding a registry entry and prevents clients from registering more push notifications than set. In such a situation, if the client attempts to set more than the expected number of Push notification registrations an MSExchangeIS event 9671 is logged in the servers application log. The administrator can set the maximum number of registrations and the context size setting by adding the following REG_DWORD values to HKLM\System\CurrentControlSet\Services\MSExchangeIS\ParametersSystem: Maximum Allowed Client Context Size (default is 16 bytes). Maximum Allowed Notification Registrations Per Client (default is 8). Both values can range from 1 through 0xFFFFFFFF. A value of 0 for either value means the corresponding default will be used. User Action: No user action is required. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.