| Event Id | 4117 |
| Source | MSExchangeIMC |
| Description | An error was returned from the messaging software the Internet Mail Service uses to process messages on the Microsoft Exchange Server. As a result, the message in spool file <servername> failed to be delivered. The message has been moved to the IMCDATA\IN\ARCHIVE directory. |
| Event Information | According to Microsoft: CAUSE: The Character Sets setting on Internet Mail Service is improperly configured. This usually happens if the default Character Sets setting was changed. The setting is on the Internet Mail tab of Internet Mail Service Properties page. The default setting for either MIME or Non-MIME is "Western European (ISO-8859-1)." This can also occur if antivirus software that is not "Exchange aware" is running on the system. Use of antivirus software that is not "Exchange aware" is highly discouraged. RESOLUTION: To resolve this problem, you need to reconfigure the Character Sets setting using the following procedure: 1. Check the 4117 event, locate the spool file name ("Jtmrmaqv" in the above example). 2. Open this file under Exchsrvr\Imcdata\In\Archive with Notepad.exe. 3. The majority of this file is in plain text format. It contains the header and body of the inbound message to be delivered. The character set of the message is included in lines similar to: Content-Type: text/plain; charset="ISO-8859-1" 4. Open the Exchange Server Administrator program, and open the properties for the Internet Mail Service. 5. On the Internet Mail tab, reset the character sets to correspond with the character set name you find in step 3. (If this problem only happens to certain domains, you may prefer per-domain setting by clicking the E-Mail Domain button.) 6. Stop and restart Internet Mail Service. |
| Reference Links | XFOR: Internet Mail Service Failed to Deliver Message, Error 4117 XIMS: No NDR Generated When Inbound SMTP Message Exceeds "Max Recipients on Submit" XADM: Bad Message Causes Dr. Watson in Store.exe XADM: IMC Shuts Down, Error Connecting to IS XFOR: Information Store Incorrectly Archiving a Message If ResolveP2 Is Enabled XADM: IMS/STORE Incorrectly Archives Message If ResolveP2 Is On |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.