| Event Id | 9022 |
| Source | CDOEXM |
| Description | Microsoft Exchange System Attendant encountered an error while processing the security data for Exchange server <server name> |
| Event Information | "According to Microsoft: Explanation : This event indicates that the Microsoft Exchange System Attendant Service was unable to access the password management keys for the server specified in the Description section of the Event. The most common causes known are as below: a. The System Attendant is having difficulty accessing the key container of the Microsoft Windows 2000 server. The first attempt by the System Attendant to open an existing container does not work with NTE_BAD_KEYSET. The System Attendant then tries to create a key container with the same name, which is rejected with NTE_EXISTS (0x8009000f) because permissions on one of these key containers is corrupt. b. The server account does not have the correct permissions on both the Exchange Organization container and the server container in Active Directory. c. The Exchange System Attendant cannot read the encryption private keys in the Rsa\Machinekeys folder on the node. This can occur for any of the following reasons: i. The public key in the directory is corrupted (either intentionally or accidentally). ii. The Crypto container that contains the private key is corrupted. iii .Mad.exe (the system attendant process) does not have access to (permission for) the Crypto container. User Action : Reset the permissions on the key containers. For more information, see Article 280432, XADM: System Attendant Stops Working with a 9022 Event. Give the Server appropriate permissions at the Exchange Organization Level in Active Directory." |
| Reference Links | "Event id 9022 from source Cdeoxm Article 280432 System Attendant does not start after disaster recovery installation and event ID 9022, 9149, 1005 messages occur " |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.