NSPI connections to a Windows 2008-based domain controller may cause MAPI client applications to fail with an error code: "MAPI_E_LOGON_FAILED"

A Name Service Provider Interface (NSPI) connection from a MAPI client to a Windows Server 2008-based domain controller may fail with the following error code that is returned from the server:In some instances, a credential dialog box may appear in the MAPI client user interface when you encounter this issue.

Affected clients include Microsoft Outlook and BlackBerry Enterprise Server.

This behavior occurs because Windows Server 2008 only allows for a default maximum of 50 concurrent NSPI connections per user to any domain controller. Additional NSPI connections are rejected with a MAPI_E_LOGON_FAILED error code.

Note Windows Server 2003 and earlier versions of Microsoft Windows operating systems do not exhibit this behavior. The change of behavior in Windows Server 2008 is intended to protect domain controllers against clients that open too many NSPI connections without then closing the connections. Too many connections such as these can result in resource depletion.

To resolve this issue, check all NSPI connections that processes on the client create for connection leaks. For example, a call to the NspiBind function must have a corresponding call to the NspiUnbind function when an NSPI connection is no longer required. This operation may require that you debug any custom scripts or applications that are using NSPI. If this issue affects external applications, contact the software vendors for updates.

Note The Outlook NSPI MAPI provider that is installed with Microsoft Outlook is only intended for use with Microsoft Outlook. External scripts and applications that rely on the Outlook NSPI MAPI provider are not supported.

How to modify the registry to allow for additional NSPI connections

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

If more concurrent NSPI connections per user are legitimately required, you can change the default limit. To do this, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry key:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS
3. Click the Parameters key.
4. On the Edit menu, point to New, and then click DWORD Value.
5. Type NSPI max sessions per user, and then press ENTER.
6. Double-click NSPI max sessions per user, type the maximum number of the NSPI connections that you want to have, and then click OK.
   
   Note While the upper limit of this setting is 0xffffffff (or 4294967295), configuring the server with a value larger than the default will consume additional memory on the server – one new page per connection. If the value is set too high and too many connections are created for each user application instance, the server will run low on memory or become completely unresponsive. The lower default NSPI connection limit in Windows Server 2008 was based on customer experience, where previous operating systems would allow themselves to be overwhelmed by third party products in what amounts to a denial of service attack. Use a common sense approach to increasing beyond the default value; for example, start with decimal 250 (hex 0x000000FA), then test to see the memory overhead created and that the errors have ceased. Your long-term solution must be to contact the vendor of your NSPI product and ask them to change their behavior; the registry value is only as a workaround to provide error relief.
   
7. Exit Registry Editor.
8. Restart the computer or restart Active Directory Domain Services.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To confirm that you encountered the issue that is described in the "Symptoms" section, follow these steps:

1. Enable event logging for NSPI connections. To do this, follow these steps:
   1. On the domain controller that is targeted for the NspiBind connection, click Start, click Run, type regedit, and then click OK.
   2. Locate and then double-click the following registry entry:
      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Diagnostics\4 MAPI Interface Events
   3. In the Value data box, type 5, and then click OK.
      
      Note The default value of this registry entry is 0.
   4. On the File menu, click Exit.
   Note This is a verbose level of event logging and may generate many events. This verbose level of event logging includes events that are unrelated to the diagnosis of this issue. We recommend that you restore this setting to the default value after you finish troubleshooting.
2. After you enable event logging, an event that resembles the following is logged in the Directory Services event log when this issue occurs:

   Event ID: 2820
   NSPI max connection limit for the user has reached.
   You need to do NSPI unbind on old connections before making new connections.
   Additional Data
   Max NSPI connections per user: 
   %1
   User: 
   %2
   

A network capture of the failure may contain packets that resemble the following:

For more information, click the following article number to view the article in the Microsoft Knowledge Base: