Event ID 9877 with error code "0x80041606" when you use Outlook in online mode to search for a keyword in Exchange Server 2010

Symptoms

Consider the following scenario. By default, Exchange Search is enabled for a mailbox database in a Microsoft Exchange Server 2010 environment. You use Microsoft Outlook in online mode to search a mailbox for a keyword or phrase that contains a single letter or a single digit. In this scenario, you receive the following error message even though there are matches for the keyword in the mailbox:

No matches found for "keyword".

Additionally, the following event is logged in the Application log:

NOTE: 0x80041606 = QUERY_E_TOOCOMPLEX

Cause

This issue occurs because Exchange Search has a hard-coded prefix search limit of 200,000 nodes for a single character search. When a prefix search exceeds this limit, the search returns QUERY_E_TOOCOMPLEX. Therefore, 0x80041606 is logged as part of event ID 9877. By default, all searches that use Outlook online mode in an Exchange 2010 environment are prefix searches. Using single digits or letters causes the system to search for all numbers or words that begins with the single digit or letter across the whole mailbox database. If the 200,000 nodes default limit is reached, the search returns the error.

Note The most common way to reach the 200,000 nodes limit is to search for a word or phrase that contains a single digit or letter. There are also other less common causes, such as entering very complex searches with many ANDs, Ors, and NOTs. Additionally, complex combinations of date ranges and search terms, many entries in the To and From fields, or a combination of all these things may cause the limit to be reached.

Resolution

To resolve this issue, install the following update rollup:

2608646 Description of Update Rollup 6 for Exchange Server 2010 Service Pack 1 Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows
  After you install the update rollup, follow these steps to set the maximum number of query restriction nodes to 1,000,000 (decimal):

1. Verify how many event ID 9877 with 0x80041606 events in the Application log you have received on a particular Exchange Server 2010 mailbox server in the past month and make a record of the number.

2. Click Start , type regedit in the Start Search box, and then press ENTER.

3. Locate and then click the following registry key:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ExchangeServer\v14\ExSearch

4. Click Edit, point to New, and then click Key.

5. Type MaxRestrictionNodes, and then press ENTER.

6. Under MaxRestrictionNodes, click Edit, point to New, and then click DWORD Value.

7. Type Server, and then press ENTER.

8. The Registry entry should now resemble the following:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ExchangeServer\v14\ExSearch\MaxRestrictionNodes\Server

9. Click Edit, and then click Modify.

10. In the Value data box, type 1000000 (Decimal).
    Note The default value of the MaxRestrictionNodes\Server entry is 200000 (Decimal) before you make any changes to the Registry.

11. Exit Registry Editor.

Notes

• After you restart the Microsoft Exchange Search Indexer service, check in the application for the following event IDs:

  • Event ID 130 Failed to convert the MailboxDB Guid read in from under the MaxRestrictionNodes registry key to a Guid

  • Event ID 131 Failed to open the MaxRestrictionNodes registry key

  • Event ID 132 Failed to set the MaxRestrictionNodes property in the indexer

• If you are receiving any of these events, you may have entered the registry key or the DWORD value incorrectly. Or, you may not have spelled the new key or DWORD value correctly. Make the necessary corrections, and then restart the Microsoft Exchange Search Indexer Service. Search for any new instances of event IDs 130, 131, or 132.

• Check the Application log weekly and monthly which depends on the number of Event ID 9877 with error 0x80041606 in the Application log.

• If you are still receiving a significant number of these events, you can increase the value incrementally to 2000000 (Decimal).

• Do not increase the value beyond 2000000 (Decimal), because this may reduce server performance.

• If you have increased the value to 2000000 (Decimal) and are still receiving a few of these events weekly or monthly, this is the expected behavior. This behavior may be caused by users performing very complex searches (see the “Symptoms” section for more information).

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

More Information

For more information about Exchange Search, visit the following Microsoft website:

General information about Exchange SearchFor more information about how to disable or enable Exchange Search, visit the following Microsoft website:

General information about how to disable or enable Exchange SearchFor more information about the MaxRestrictionNodes entry, visit the following Microsoft website:

General information about the MaxRestrictionNodes entry