Hi,
I'm in the middle of preparing AD and extending the schema for an Exchange server 2013 installation and I'm getting the bellow error. My question are, what type of key do I have to create, on which server(the one I'm using to prepare the organization) and
what value should I add? Is this even supported?
Event ID: 2866
Task Category: Security
Level: Error
Keywords: Classic
User: <redacted>
Computer: <domain controller>
Description:
While logging audit events for the following object, the directory service reached the maximum number of audit events that could be cached in memory at any given time. As a result of reaching this limit, the operation was aborted.
Maximum number of audit events that can be cached: 17000
Distinguished name of object:
CN=View-Only Configuration,CN=Roles,CN=RBAC,CN=<company>,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=<domain>,DC=ca
Generally this occurs if there are a large number of changes being performed on attributes that require auditing. An example of such an operation could be deleting the membership of a large group, where the ‘member’ attribute is being audited.
Additional Data From the Audit Event Attribute name or old distinguished name:
msExchRoleEntries
Attribute value or new distinguished name:
c,Get-PublicFolderClientPermission.
Microsoft.Exchange.Management.PowerShell.E2010,Debug,DomainController,ErrorAction,
ErrorVariable,Identity,OutBuffer,OutVariable,Server,User,Verbose,WarningAction,WarningVariable
User Action
(1) Check that an excessive number of object creation, modification, move, rename or undelete operations are not being performed.
(2) Check that an excessive amount of auditing is not enabled. For example, confirm that auditing is not configured for more attributes than is necessary.
(3) If necessary, increase the size of the audit queue by increasing the ‘Maximum Audit Queue Size’ registry parameter.
Thank you.
