Events 1000, 4999, and 9775 are logged when Store.exe crashes on an Exchange Server 2010 SP3 Mailbox server

The Microsoft Exchange Information Store service (Store.exe) crashes on a Microsoft Exchange Server 2010 Service Pack 3 (SP3) Mailbox server. Additionally, the following events are logged in the Application log:

Time:     Time
ID:       1000
Level:    Error
Source: Application Error
Machine: Computer
Message: Faulting application name: store.exe, version: Version, time stamp: TimeStamp
Faulting module name: advapi32.dll, version: Version, time stamp: TimeStamp
Exception code: 0xc0000005
Fault offset: Offset
Faulting process id: ProcessID
Faulting application start time: StartTime

Time:     Time
ID:       4999
Level:    Error
Source: MSExchange Common
Machine: Computer
Message: Watson report about to be sent for process id: ProcessID, with parameters: E12N, BuildType, VersionNumber, store.exe, advapi32.dll, XXXX, c0000005, XXXX, VersionNumber.
ErrorReportingEnabled: False

Log Name: Application
Source: MSExchangeIS
Event ID: 9775
Task Category: General
Level: Warning
Description:
The mailbox ''contains a folder 'FolderName' with a security descriptor that violates the canonical format.

Back to the top | Give Feedback

This issue occurs because a LogFailedSDUpdateEvent function calls the ConvertSecurityDescriptorToStringSecurityDescriptor function in the advapi32.dll file. However, corruption occurs in the Security Descriptor. Then, the ConvertSecurityDescriptorToStringSecurityDescriptor function throws an access violation exception.

Back to the top | Give Feedback

To resolve this issue, install the following update rollup:

2891587

(http://support.microsoft.com/kb/2891587/ )

Description of Update Rollup 3 for Exchange Server 2010 Service Pack 3

Back to the top | Give Feedback

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Back to the top | Give Feedback

For more information about the ConvertSecurityDescriptorToStringSecurityDescriptor function, go to the following Microsoft website:

General information about the ConvertSecurityDescriptorToStringSecurityDescriptor function

(http://msdn.microsoft.com/en-us/library/windows/desktop/aa376397(v=vs.85).aspx)

Back to the top | Give Feedback