| Event Id | 1009 |
| Source | MSExchangeMailSubmission |
| Description | The Microsoft Exchange Mail Submission service is currently unable to contact any Hub Transport servers in the local Active Directory site. The servers may be too busy to accept new connections at this time. |
| Event Information | According to Microsoft : Cause : This Warning event indicates that the computer that is running the Mailbox server role cannot submit messages to a computer that is running the Microsoft® Exchange Server 2007 Hub Transport server role. Additionally, there are Hub Transport servers in the same Active Directory® directory service site as the Mailbox server that can respond to the request. This event may occur if any of the following conditions is true: 1.The Microsoft Exchange Transport service is not running on a Hub Transport server. 2.The MAPI RPC connection is blocked between the Mailbox server and Hub Transport server. 3.The Hub Transport server has reached the maximum number of submission threads that the server can have open at the same time to send messages from mailboxes. This behavior may occur if the computer that is running the Mailbox server role has multi-processors and the computer that is running the Hub Transport server role is a single-processor. In this configuration, the Mailbox server may submit more e-mail traffic than the Hub Transport server can process. In Exchange 2007, a new notification service called the Microsoft Exchange Mail Submission service runs on the mailbox server and notifies an available Hub Transport server in the same Active Directory site in which the service is running that messages are available for retrieval from a sender’s Outbox. The Microsoft Exchange Mail Submission service tries to distribute message submissions equally across all available Hub Transport servers that are available in the same Active Directory site in which the service is running. The Microsoft Exchange Mail Submission service obtains a list of Hub Transport servers in the same Active Directory site as the mailbox from which a Store driver retrieves messages. A round-robin process determines which bridgehead server is notified. The store driver on the Hub Transport server that is notified retrieves the message and adds the message to the transport pipeline by putting it in the Submission queue on the Hub Transport server that was notified. If no bridgehead servers are available, messages cannot be added to the transport pipeline. Resolution: To resolve this warning, follow one or more of these steps: 1.Make sure that the Microsoft Exchange Transport Service is enabled and running on the Hub Transport server. 2.Make sure that no firewalls filter network data or block MAPI remote procedure call (RPC) traffic between the Mailbox server and Hub Transport server. 3.Make sure that the Mailbox server and the Hub Transport server are not deployed in a perimeter network. 4.If this frequently occurs, consider whether you should add more processors on the Hub Transport server. You can also increase the value of MaxConcurrentMailboxSubmissions by using the Set-TransportServer cmdlet. |
| Reference Links | Event ID 1009 From Source MSExchangeMailSubmission |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.