Microsoft KB Archive/329167

= Troubleshooting the &quot;452 4.3.1 Out of memory&quot; error message in Exchange Server 2003 and in Exchange 2000 Server =

Article ID: 329167

Article Last Modified on 10/25/2007

-

APPLIES TO


 * Microsoft Exchange 2000 Server Standard Edition
 * Microsoft Exchange Server 2003 Enterprise Edition
 * Microsoft Exchange Server 2003 Standard Edition

-



This article was previously published under Q329167



Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry



SYMPTOMS
You may experience one or more of the following issues on a server that is running Microsoft Exchange 2000 Server or Microsoft Exchange Server 2003 in your organization:  Messages may become backed up in the messaging queues. You may not be able to resolve this issue by restarting the Exchange 2000 Server-related services or the Exchange Server 2003-related services. Instead, you have to restart the server to restore message flow. When you telnet to port 25 of the problem server, and issue the MAIL FROM: or DATA command, you receive the following error message:

452 4.3.1 Out of memory

 The Exchange server logs the following event in the Application event log:

Event ID: 429

Event Source: SMTPSVC

Event Type: Error

Description: &quot;Virtual Server Invalid MailQueue Directory: The specified mail queue directory is not valid. Cannot start the SMTP Service.&quot;





CAUSE
This problem may be caused by one or more reasons. Some of the most common causes are as follows.

Cause 1
This issue may occur if the Antigen antivirus event sink (version 6.5) is installed on your computer. This issue may be caused by a leak of MailMsg objects.

Exchange 2000 Server or Exchange Server 2003 has a default limit of 90,000 MailMsg objects that can be allocated. When this limit has been reached, the Exchange server cannot process additional messages. For more information about the limit, click the following article number to view the article in the Microsoft Knowledge Base:

258748 How to set a limit on the number of SMTP messages in queues

Cause 2
The Exchange routing engine does not have sufficient permissions to write the messages to the BadMail, Pickup, and Queue folders that are located under the \Mailroot\VSI  folder.

Cause 3
This problem may occur if your Exchange server received a large amount of spam e-mail messages. In this situation, the BadMail folder fills with messages that your server cannot handle. Additionally, the hard disk is almost full.



RESOLUTION
Because there may be several causes of this problem, use one or more of the following resolutions as appropriate for your situation.

Resolution 1
To work around this issue, unbind the Antigen event sink from the SMTP virtual server in Exchange 2000 Server or in Exchange Server 2003. This workaround applies only to Antigen version 6.5. To do this, follow these steps.

Note Obtain and install the following utilities before you follow these steps:  Tlist.exe: On the Windows 2000 CD-ROM, extract the Tlist.exe utility from the Support.cab file in the Support\Tools folder. Smtpreg.vbs: To obtain this, download and install the Exchange Server SDK. To do this, visit the following Microsoft Web site:

http://www.microsoft.com/msdownload/platformsdk/sdkupdate

</li></ul>

<ol> Determine whether the Antigen event sink is loaded. To do this: <ol style="list-style-type: lower-alpha;"> Click Start, click Run, type cmd in the Open box, and then click OK.</li> Locate the folder in which you extracted the Tlist.exe utility, and then type the following command:

tlist inetinfo

If AntigenSmtpSink.dll is displayed in the list of loaded DLL files, the Antigen event sink is loaded.</li></ol> </li> Determine whether the Antigen event sink is bound to the SMTP virtual server. To do this: <ol style="list-style-type: lower-alpha;"> Click Start, click Run, type cmd, and then click OK.</li> Locate the folder in which the Smtpreg.vbs file is stored (by default, C:\Program Files\Microsoft SDK\Include), and then type the following command:

cscript smtpreg.vbs /enum > before.txt

</li> Open the Before.txt file by using a text editor such as Notepad, and then search for &quot;Antigen.&quot; (Note that it is bound to the SMTP Transport OnPostCategorize event.) Quit Notepad.</li></ol>

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

</li> Click Start, click Run, type regedit in the Open box, and then click OK.</li> Navigate to the following registry subkey:

</li> On the Registry menu, click Export Registry File.</li> In the File name box, type exported antigen, and then click Save.

Note If you have to undo the changes to this registry subkey, double-click the Exported Antigen.reg file that you saved.</li> In the right pane of the Registry Editor window, right-click the AntigenEnabled value, and then click Modify.</li> Set the AntigenEnabled value to 0x1 (by default, it is 0x3).

Note This key specifies whether the Antigen Service is to be enabled for scanning.  0 disables all scanning.</li> <li>1 enables scanning in the Information Store only (Realtime, Manual, and MTA).</li> <li>2 enables the Internet Scan Job only.</li> <li>3 (default) enables all scanning.</li></ul> </li> <li>Quit Registry Editor</li> <li>Stop and then restart the Antigen IMC service.

Note When you stop the Antigen IMC service, the Simple Mail Transfer Protocol (SMTP) service is also stopped.</li> <li>To completely unload the Antigen event sink, stop and then restart the Microsoft Internet Information Services (IIS) Admin service.

This also stops all dependent services, such as the Microsoft Exchange information store, SMTP, Microsoft Exchange MTA Stacks, the World Wide Web Publishing service, and others.</li> <li>Run the tlist inetinfo command to verify that AntigenSmtpSink.dll is not displayed in the list of loaded DLL files.</li> <li>Verify that the Antigen event sink is no longer bound to the SMTP virtual server. To do this: <ol style="list-style-type: lower-alpha;"> <li>Click Start, click Run, type cmd, and then click OK.</li> <li>Locate the folder in which the Smtpreg.vbs file is stored (by default, C:\Program Files\Microsoft SDK\Include), and then type the following command:

cscript smtpreg.vbs /enum > after.txt

</li> <li>Open the After.txt file by using a text editor such as Notepad, and then search for &quot;Antigen.&quot; (Antigen should not appear in the text file.) Quit Notepad.</li></ol> </li></ol>

For more information about Antigen software, visit the following Microsoft Web site:

http://www.microsoft.com/technet/antigen/default.mspx

Resolution 2
<ol> <li>Use Windows Explorer to check the VSI  folder. By default this folder is located in the Exchange installation point:

\exchsrvr\mailroot

Note VSI 1 corresponds to SMTP Virtual Server 1, VSI 2 corresponds to SMTP Virtual Server 2, and so on.</li> <li>Right-click the VSI  folder, and then click Properties.</li> <li>Click the Security tab, and then confirm that the System account exists in the Name box.</li> <li>Click the System account, and then confirm that Full Control permissions are enabled.</li> <li>Repeat steps 2 through 4 for the BadMail, Queues, and Pickup subfolders that are located under Exchsrvr\Mailroot\Vsi .</li> <li>If you find that the System account is not listed in the Access Control List (ACL), add the System account. Additionally, and assign the account Full Control access permissions.</li> <li>Stop and then restart the Simple Mail Transport Protocol (SMTP) service and the Microsoft Exchange Routing Engine service.</li></ol>

Resolution 3
To resolve this issue, follow these steps: <ol> <li>Stop the SMTP service. To do so, follow these steps: <ol style="list-style-type: lower-alpha;"> <li>In Computer Management, double-click the Services and Applications branch, and then click Services.</li> <li>In the right pane, right-click Simple Mail Transport Protocol (SMTP), and then click Stop.</li></ol> </li> <li>In Windows Explorer, locate the \Exchsrvr\Mailroot\Vsi  folder.

Important Do not open the BadMail folder. Depending on how much spam that the Exchange server processes, this folder may contain several hundred thousand files. If you open this folder, the server may appear to stop responding.</li> <li>Permanently delete the BadMail folder. To do this, click the BadMail folder in Windows Explorer, press and hold the SHIFT key, and then press DELETE.

Note Deleting this folder may take a long time, depending on the number of files that the folder contains.</li> <li>Create a new BadMail folder.</li> <li>Start the SMTP service.</li></ol>

For more information about How to automatically delete messages from the BadMail folder in Exchange Server 2003 and in Exchange 2000 Server, click the following article number to view the article in the Microsoft Knowledge Base:

867642 How to automatically delete messages from the Badmail folder in Exchange Server 2003 and in Exchange 2000 Server

<div class="status_section">

STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

<div class="moreinformation_section">

MORE INFORMATION
For more information, click the following article number to view the article in the Microsoft Knowledge Base:

238614 How to set up Regtrace for Exchange 2000

Additional query words: XADM

Keywords: kberrmsg kbbug kbpending KB329167

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.