A poison mailbox is a corrupted mailbox on the Exchange Server that causes disruptions on the Exchange database store. A poison mailbox can cause the store to fail or prohibit access to all the mailboxes hosted by the Exchange Server. Exchange Server 2010 and later versions can identify and quarantine a poison mailbox before it disrupts the Exchange store and threatens the messaging platform.
Exchange Server quarantines a poison mailbox if a thread associated with that mailbox crashes, or more than five threads on a mailbox process have stalled. In either case, Exchange Server creates a registry key leading to the poison mailbox ID which includes the number of times the mailbox has crashed the store and the last time the mailbox crashed the store. If Exchange Server flags a mailbox as poisoned three times in two hours, then it will quarantine that mailbox for six hours before being released.
Exchange administrators can adjust the number of times a mailbox can be identified as poisoned before it is quarantined. They can also change the length of time a mailbox remains in quarantine before the Exchange Server releases it.
Exchange Server isolates a quarantined mailbox from users and other Exchange processes -- such as content indexing and mailbox tools -- until it lifts the quarantine. If an administrator troubleshoots and corrects the root cause of the poison mailbox event, they can manually release the quarantined mailbox by deleting the registry key for the crash event. If the administrator does not identify and correct the root cause, Exchange will release the poison mailbox automatically when the quarantine duration expires.
Administrators can check the system event log and search for event 10018 to identify quarantined mailboxes. Other log events may point to potential thread execution problems -- which may lead to poison mailbox quarantines -- such as a time-out on the Exchange Server (event 10025), a time-out on the database (event 10026), and a time-out on an individual mailbox (event 10027).
Administrators can see the MSExchangeIS Mailbox\Quarantined Mailbox Count counter in the Performance Monitor monitoring tool to track quarantined mailboxes. PowerShell allows administrators to gauge the quarantined state of a mailbox using the Get-MailboxStatistics cmdlet. Administrators can use the New-MailboxRepairRequest cmdlet in PowerShell to detect and repair mailbox or store corruptions in Exchange 2010 Service Pack 1 (SP1) and later.