Browse Definitions :
Definition

poison mailbox

A poison mailbox is a corrupted mailbox on the Exchange Server that causes disruptions on the Exchange database store. A poison mailbox can cause the store to fail or prohibit access to all the mailboxes hosted by the Exchange Server. Exchange Server 2010 and later versions can identify and quarantine a poison mailbox before it disrupts the Exchange store and threatens the messaging platform.

Exchange Server quarantines a poison mailbox if a thread associated with that mailbox crashes, or more than five threads on a mailbox process have stalled. In either case, Exchange Server creates a registry key leading to the poison mailbox ID which includes the number of times the mailbox has crashed the store and the last time the mailbox crashed the store. If Exchange Server flags a mailbox as poisoned three times in two hours, then it will quarantine that mailbox for six hours before being released.

Exchange administrators can adjust the number of times a mailbox can be identified as poisoned before it is quarantined. They can also change the length of time a mailbox remains in quarantine before the Exchange Server releases it.

Exchange Server isolates a quarantined mailbox from users and other Exchange processes -- such as content indexing and mailbox tools -- until it lifts the quarantine. If an administrator troubleshoots and corrects the root cause of the poison mailbox event, they can manually release the quarantined mailbox by deleting the registry key for the crash event. If the administrator does not identify and correct the root cause, Exchange will release the poison mailbox automatically when the quarantine duration expires.

Administrators can check the system event log and search for event 10018 to identify quarantined mailboxes. Other log events may point to potential thread execution problems -- which may lead to poison mailbox quarantines -- such as a time-out on the Exchange Server (event 10025), a time-out on the database (event 10026), and a time-out on an individual mailbox (event 10027).

Administrators can see the MSExchangeIS Mailbox\Quarantined Mailbox Count counter in the Performance Monitor monitoring tool to track quarantined mailboxes. PowerShell allows administrators to gauge the quarantined state of a mailbox using the Get-MailboxStatistics cmdlet. Administrators can use the New-MailboxRepairRequest cmdlet in PowerShell to detect and repair mailbox or store corruptions in Exchange 2010 Service Pack 1 (SP1) and later.

This was last updated in October 2016

Continue Reading About poison mailbox

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

What are some other troubleshooting techniques to resolve an issue with a poison mailbox?
Cancel

SearchCompliance

  • risk assessment

    Risk assessment is the identification of hazards that could negatively impact an organization's ability to conduct business.

  • PCI DSS (Payment Card Industry Data Security Standard)

    The Payment Card Industry Data Security Standard (PCI DSS) is a widely accepted set of policies and procedures intended to ...

  • risk management

    Risk management is the process of identifying, assessing and controlling threats to an organization's capital and earnings.

SearchSecurity

SearchHealthIT

SearchDisasterRecovery

  • call tree

    A call tree is a layered hierarchical communication model that is used to notify specific individuals of an event and coordinate ...

  • Disaster Recovery as a Service (DRaaS)

    Disaster recovery as a service (DRaaS) is the replication and hosting of physical or virtual servers by a third party to provide ...

  • cloud disaster recovery (cloud DR)

    Cloud disaster recovery (cloud DR) is a combination of strategies and services intended to back up data, applications and other ...

SearchStorage

Close