ActiveSync Event ID 3007?

[retsamneZ]

Hi Guys,

I run Exchange 2003 SP2. I recently connected 2 blackberies and 1 iPhone to receive emails from the server.
Every couple of days my mobile users will stop receiving emails and OWA users can't get in to their email from home. When I check the server I see Event ID 3007 error.

"Exchange mailbox Server response timout: Server: [xxxx.xxxx.com] User:[xxxxx@xxxx.com]. Exchange ActiveSync Server failed to communicate with the Exchange mailbox server in a timely manner. Verify the the Exchange mailbox is working correctly and is not overloaded."

After I restart IIS services everything is working fine, until it happens again.

Any idea what could be the problem?

Thank you for help.

Alex.

 

[Zelandakh]

Is your OS patched to date?

 

[retsamneZ]

I update every quarter, looks like there are couple of security updates and Microsoft .NET Framework 3.5 SP1 family update (KB951847) x86

Do you think that might make a difference?

 

[Zelandakh]

Every quarter? Interesting.

Sounds like a memory leak which was why I suggested it. Doubt the security updates would change anything and .Net might help or might make things worse . Install it, test and then rollback if things get worse.

 

[retsamneZ]

Zelandakh,

Yes, I load security updates every quarter, why is it interesting?

 

[Zelandakh]

I feel (personally) that security updates are something that shouldn't be applied on a quarterly basis as that could potentially give a hacker up to 3 months to compromise your system.

 

[retsamneZ]

I agree with you, but I have more trust in Cisco MARS and IPS to give me early warning then in Microsoft, who's updates are usually couple of months late anyway.

 

[58sniper]

You have more trust in a separate vendor finding security issues in Microsoft software before Microsoft? That's interesting as well.

48 hours max from release for me to at least have on a lab server testing.

And that's with MARS, Clean Access, and IPS.

The security isn't always from stuff happening on the outside. It's also for "the perfect storm" where security breaches can be unintentional based on a the right criteria happening in the right order.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[retsamneZ]

48 hours? you might be too late if you don't monitor what's going on your network. If are familiar with MARS it monitors your whole network inside, including your servers,
pcs etc...NOT only outside. My point is that don't think that if you patch your servers you are secure, maybe from the security wholes known to Microsoft at that time. And yes, I do rely heavily on 3rd party tools like MARS, because it gives me the 30,000 feet view of my network and any problems that might arise.

I'm not here to argue, you should do both. That's my opinion and that's what that is only.