| Event Id | 2389 |
| Source | MSExchangeDSAccess |
| Description | Process <process name> (PID=<process id>). A search request to Directory Server <server name> did not return a result within <number> seconds and is being abandoned. The search will be retried if possible. The search that failed has the following characteristics: Base DN=<distinguished name>, Filter=<text>, Scope=<number>. |
| Event Information | According to Microsoft: This event indicates that a search request that was sent to the server running Active Directory did not provide a result within a reasonable time period. The search request was, therefore, abandoned. This event is logged when there are problems with the action sent to the Directory Service not returning in less than 120 seconds. It is usually seen only when the Directory Service is under heavy stress and/or a network error was introduced at the packet level where the sending server is continuously trying to resend the information back to Exchange and is failing (leading to the 120 second failure). Most often it is the Directory Service being under heavy stress that is causing the problem. User Action : If this event is seen rarely, then it can be ignored. If it appears at specific times or any other pattern is detected, investigate what is happening on the particular Directory Service (named in the Description section of the event) and check to see if it is being heavily loaded. Also investigate if there are networking issues between the Exchange server and the named Directory Service. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.