Browse Definitions :
Definition

poison mailbox

A poison mailbox is a corrupted mailbox on the Exchange Server that causes disruptions on the Exchange database store. A poison mailbox can cause the store to fail or prohibit access to all the mailboxes hosted by the Exchange Server. Exchange Server 2010 and later versions can identify and quarantine a poison mailbox before it disrupts the Exchange store and threatens the messaging platform.

Exchange Server quarantines a poison mailbox if a thread associated with that mailbox crashes, or more than five threads on a mailbox process have stalled. In either case, Exchange Server creates a registry key leading to the poison mailbox ID which includes the number of times the mailbox has crashed the store and the last time the mailbox crashed the store. If Exchange Server flags a mailbox as poisoned three times in two hours, then it will quarantine that mailbox for six hours before being released.

Exchange administrators can adjust the number of times a mailbox can be identified as poisoned before it is quarantined. They can also change the length of time a mailbox remains in quarantine before the Exchange Server releases it.

Exchange Server isolates a quarantined mailbox from users and other Exchange processes -- such as content indexing and mailbox tools -- until it lifts the quarantine. If an administrator troubleshoots and corrects the root cause of the poison mailbox event, they can manually release the quarantined mailbox by deleting the registry key for the crash event. If the administrator does not identify and correct the root cause, Exchange will release the poison mailbox automatically when the quarantine duration expires.

Administrators can check the system event log and search for event 10018 to identify quarantined mailboxes. Other log events may point to potential thread execution problems -- which may lead to poison mailbox quarantines -- such as a time-out on the Exchange Server (event 10025), a time-out on the database (event 10026), and a time-out on an individual mailbox (event 10027).

Administrators can see the MSExchangeIS Mailbox\Quarantined Mailbox Count counter in the Performance Monitor monitoring tool to track quarantined mailboxes. PowerShell allows administrators to gauge the quarantined state of a mailbox using the Get-MailboxStatistics cmdlet. Administrators can use the New-MailboxRepairRequest cmdlet in PowerShell to detect and repair mailbox or store corruptions in Exchange 2010 Service Pack 1 (SP1) and later.

This was last updated in October 2016

Continue Reading About poison mailbox

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

What are some other troubleshooting techniques to resolve an issue with a poison mailbox?
Cancel

-ADS BY GOOGLE

File Extensions and File Formats

Powered by:

SearchCompliance

SearchSecurity

  • GPS jamming

    GPS jamming is the process of using a frequency transmitting device to block or interfere with radio communications.

  • time-based one-time password (TOTP)

    A time-based one-time password (TOTP) is a temporary code, generated by an algorithm, for use in authenticating access to ...

  • Security Operations Center (SOC)

    A security operations center (SOC) is a command center facility for a team of IT professionals with expertise in information ...

SearchHealthIT

SearchDisasterRecovery

  • disaster recovery team

    A disaster recovery team is a group of individuals focused on planning, implementing, maintaining, auditing and testing an ...

  • cloud insurance

    Cloud insurance is any type of financial or data protection obtained by a cloud service provider. 

  • business continuity software

    Business continuity software is an application or suite designed to make business continuity planning/business continuity ...

SearchStorage

  • SSD (solid-state drive)

    An SSD (solid-state drive) is a type of nonvolatile storage media that stores persistent data on solid-state flash memory.

  • NAND flash memory

    NAND flash memory is a type of nonvolatile storage technology that does not require power to retain data.

  • storage class memory (SCM)

    Storage class memory (SCM) is a type of NAND flash that includes a power source to ensure that data won't be lost due to a system...

Close