Event 9673 with code 0xc00000fd occurs when the Microsoft Exchange Information Store service crashes on a computer that is running Exchange Server 2007

SYMPTOMS
The Microsoft Exchange Information Store service crashes intermittently with a stack overflow on a computer that is running Exchange Server 2007. This behavior prevents users from accessing their mailboxes.


This behavior may occur approximately every five minutes on a computer that is running Exchange Server 2007
Additionally, event 9673 with code 0xc00000fd is logged in the Application log:

Event Type: Error
Event Source: MSExchangeIS
Event Category: General
Event ID: 9673
Description:
An exception with code 0xc00000fd was thrown in module; some parameters and their values were <Exception address>. A significant section of the call stack is in the data section. For more information, see Help and Support Center at <http://go.microsoft.com/fwlink/events.asp>.Data:00000: 00 00 00 00 00 00 00 00 ........00008: 00 00 00 00 00 00 00 00 ........00010: 00 00 00 00 00 00 00 00 ........00018: 03 00 00 00 00 00 00 00 ........00020: 04 00 00 00 00 00 00 00 ........00028: 00 00 00 00 00 00 00 00 ........00030: 00 00 00 00 00 00 00 00 ........00038: 00 00 00 00 00 00 00 00 ........00040: 00 00 00 00 00 00 00 00 ........00048: 01 00 00 00 00 00 00 00 ........00050: 72 81 21 54 00 00 00 00 r!T....00058: 90 40 a3 39 00 00 00 00 @£9....00060: 00 00 00 00 00 00 00 00 ........00068: 00 00 00 00 00 00 00 00 ........

RESOLUTION
Typically, this problem may be resolved after you install Update Rollup 7 for Exchange Server 2007 SP1. If you have not already installed Update Rollup 7, install the update from the link in the "Install Update Rollup 7" section. However, in some cases this issue may continue to occur after installation of Update Rollup 7.If this situation occurs, you can resolve the problem by configuring two registry entries that are available after you install Update Rollup 7.To configure these registry entries follow the steps in the “More information about Update Rollup 7” section.

Install Update Rollup 7

To enable the two registry entries that help resolve this problem, install Update Rollup 7 for Exchange 2007 Service Pack 1. For more information about Update Rollup 7 for Exchange Server 2007 Service Pack 1, see the following Exchange Help topic: For more information about how to install the latest Exchange service pack or update rollup, see the following Exchange Help topic:

More information about Update Rollup 7

By default, after you install Update Rollup 7 for Exchange Server 2007 SP1, the recurrence search for deep folder search is changed from "unlimited" to a limited value of 50,000. In some circumstances, this value may be too high, and you may still experience a Microsoft Exchange Information Store service crash. However, Update Rollup 7 enables you to use two registry entries to manually change the recurrence search parameters. To do this, follow these steps:
  1. Start Registry Editor.
  2. Locate and then click the following registry subkey:
    HKLM\System\CCS\Services\MSExchangeIS\ParametersSystem
  3. Create or change the value for the following registry entry under the registry subkey, as follows:
    Name: Validate Search Folder Restriction
    Data type: REG_DWORD
    Value data: 1
  4. After you change the value for the registry entry, verify that the issue is fixed. If you continue to experience the issue, continue with the remaining steps.
  5. In Registry Editor, locate and then click the registry subkey that is mentioned in step 2.
  6. Create or change the value for the following registry entry under the registry subkey, as follows:
    Name: Search Folder Nesting Level
    Data type: REG_DWORD
    Value data: 500 (decimal)
  7. If you continue to experience the same issue even after the change to the Search Folder Nesting Level registry entry, complete the steps in the "Use Isinteg tool" section.

    Notes For the registry changes to take effect, you do not have to do the following:
    • Restart the Microsoft Exchange Information Store service.
    • Restart the Exchange server.
    • Fail over the Exchange server in a clustered environment.

Use Isinteg tool

If the Microsoft Exchange Information Store service continues to crash even after the change of values for the two registry entries, you must use the Isinteg tool. To do this, follow these steps.

Note You can run the Isinteg tool from the Drive_Letter:\Program Files\Exchsrvr\bin folder.
  1. Identify and unmount the Exchange database that has the problem.
  2. Run the Isinteg tool against the database by using the following command:
    exchsrvr\bin\isinteg -s Server_Name -fix -test alltests
  3. After Isinteg finishes running, view the ISINTEG.pri log file that is created in the MDBDATA folder.Verify that the entry for FIXES is equal to zero. If this entry is not equal to zero, run the Isinteg tool against the database again. You may have to run the Isinteg tool several times until you see that the FIXES entry is equal to zero.
MORE INFORMATION
This issue generates the following call stack.
 # Child-SP          RetAddr           Call Site 00 00000000`50980ff0 00000000`5422e203 ese!ErrBFReadLatchPage+0x1fd 01 00000000`509810b0 00000000`54235e1b ese!CPAGE::ErrGetReadPage+0x83 02 00000000`50981140 00000000`54226e6b ese!ErrBTIIRefresh+0xdb 03 00000000`509811f0 00000000`5425fe50 ese!ErrBTGet+0x2b 04 00000000`50981230 00000000`542850c2 ese!ErrDIRGet+0x20 05 00000000`50981260 00000000`542a58f6 ese!ErrIsamRetrieveColumn+0x232 06 00000000`50981380 00000000`542a5a3d ese!JetRetrieveColumnEx+0x246 07 00000000`50981440 00000000`009693b6 ese!JetRetrieveColumn+0xfd 08 00000000`509814e0 00000000`0097a808 store!JetRetrieveColumnFn+0x96 09 00000000`50981560 00000000`00982d97 store!JTAB_BASE::EcRetrieveColumnByPtagid+0x288 0a 00000000`50981600 00000000`0094ccb0 store!EcReadBinary+0x87 0b 00000000`509818c0 00000000`007d82db store!EcRetrieveFIDL+0x20 0c 00000000`50981900 00000000`007d84db store!EcGetSearchFoldersRecursive+0xab 0d 00000000`509819b0 00000000`007d84db store!EcGetSearchFoldersRecursive+0x2ab 0e 00000000`50981a60 00000000`007d84db store!EcGetSearchFoldersRecursive+0x2ab 0f 00000000`50981b10 00000000`007d84db store!EcGetSearchFoldersRecursive+0x2ab 10 00000000`50981bc0 00000000`007d84db store!EcGetSearchFoldersRecursive+0x2ab 11 00000000`50981c70 00000000`007d84db store!EcGetSearchFoldersRecursive+0x2ab ......57c 00000000`509bd600 00000000`007d84db store!EcGetSearchFoldersRecursive+0x2ab 57d 00000000`509bd6b0 00000000`007d84db store!EcGetSearchFoldersRecursive+0x2ab 57e 00000000`509bd760 00000000`007d84db store!EcGetSearchFoldersRecursive+0x2ab 57f 00000000`509bd810 00000000`007d87e9 store!EcGetSearchFoldersRecursive+0x2ab 580 00000000`509bd8c0 00000000`007d8aa4 store!EcGetSearchFoldersEx+0x1d9 581 00000000`509bd9b0 00000000`007db81f store!EcBeginTransactionWithSearchFolders+0x144 582 00000000`509bda90 00000000`00719555 store!EcBeginMessageTransaction+0x2f 583 00000000`509bdae0 00000000`00a3d76b store!OMSG::EcDeliver+0x1c25 584 00000000`509bdf30 00000000`007a96a0 store!EcLocallyDeliverMsg+0x2e1b 585 00000000`509be780 00000000`009fb0da store!EcTransportDeliverMessageOp+0x300 586 00000000`509be800 00000000`00a12abe store!EcTransportDeliverMessage+0x11a 587 00000000`509be830 00000000`00a1403d store!EcRpc+0x390e 588 00000000`509bf090 00000000`00a1435d store!EcRpcExt+0x27d 589 00000000`509bf1b0 00000000`009e12fc store!EcRpcExt2+0xdd 58a 00000000`509bf280 000007ff`7fd69a75 store!EcDoRpcExt2+0x10c 58b 00000000`509bf340 000007ff`7fe96cc9 rpcrt4!Invoke+0x65 58c 00000000`509bf3e0 000007ff`7fe9758d rpcrt4!NdrStubCall2+0x54d 58d 00000000`509bf9a0 000007ff`7fd697b4 rpcrt4!NdrServerCall2+0x1d 58e 00000000`509bf9d0 000007ff`7fd6990d rpcrt4!DispatchToStubInCNoAvrf+0x14 58f 00000000`509bfa00 000007ff`7fd69766 rpcrt4!RPC_INTERFACE::DispatchToStubWorker+0x50d 590 00000000`509bfb70 000007ff`7fd48b65 rpcrt4!RPC_INTERFACE::DispatchToStub+0x2ec 591 00000000`509bfbf0 000007ff`7fd497b9 rpcrt4!OSF_SCALL::DispatchHelper+0x2d3 592 00000000`509bfc70 000007ff`7fd49674 rpcrt4!OSF_SCALL::DispatchRPCCall+0x1ba 593 00000000`509bfca0 000007ff`7fd49c2f rpcrt4!OSF_SCALL::ProcessReceivedPDU+0x7f8 594 00000000`509bfd10 000007ff`7fd47e28 rpcrt4!OSF_SCALL::BeginRpcCall+0x1a4 595 00000000`509bfd50 000007ff`7fd46f8c rpcrt4!OSF_SCONNECTION::ProcessReceiveComplete+0x1b7 596 00000000`509bfe00 000007ff`7fd47179 rpcrt4!LOADABLE_TRANSPORT::ProcessIOEvents+0x1e1 597 00000000`509bfeb0 000007ff`7fd65996 rpcrt4!ProcessIOEventsWrapper+0x9 598 00000000`509bfee0 000007ff`7fd65d51 rpcrt4!BaseCachedThreadRoutine+0xde 599 00000000`509bff50 00000000`77d6b6da rpcrt4!ThreadStartRoutine+0x21 59a 00000000`509bff80 00000000`00000000 kernel32!BaseThreadStart+0x3a
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Properties

Article ID: 959135 - Last Review: 05/12/2009 21:22:07 - Revision: 4.2

  • Microsoft Exchange Server 2007 Enterprise Edition
  • Microsoft Exchange Server 2007 Standard Edition
  • kbexpertiseadvanced kbqfe kbsurveynew kbhotfixrollup KB959135
Feedback