[AndyJG247]

Hi,

I seem to be suffering recently!
One of the Exchange servers within a certain admin group is NDRing valid emails. It is one of an NLB pair that servers OWA as well as route emails to the other sites.
The message I receive in the event log is:
Categorizer is NDRing a recipient with address SMTP:first.last@domain.com with reason code 0x80070002 (The system cannot find the file specified).

The NDR itself states
The email account does not exist at the organization this message was sent to. Check the e-mail address, or contact the recipient directly to find out the correct address.

From comments on this forum I know the categorizer is where the AV/AS sits so I've completely un-installed it and rebooted. The problem still occurs.
As this node is one of a pair I have removed it from the routing groups leaving the other one in and everything works as it should. The bounces etc all specifically state this "faulty" server therefore I am led to believe it is a local issue with it. Googling hasn't yielded anything helpful so far and I am happy to wipe/reload it but would prefer to have a better idea of why it is happening.

I do get messages on this server about non-valid emails that give the same categorizer message bt so far not sure why valid ones are being sent the same way!

Thanks for any advice you can offer.

[v-2nas]

So those servers are NLB + Bridgehead is that right ?

AV/AS has been uninstalled

ok try telnetting locally on the server and try to drop an email to the valid user and let me know what happens does the message get deliver or ndr out. Make sure you supply correct email address. Enable message tracking and then track the message and let me know after which stage it got ndr out.

[AndyJG247]

Thanks for the reply.

If I send a message it obviously goes to one or the other server. If it hits the "good" server it goes, if it hits the "faulty" server I can track it and see it submitted to advanced queuing, to the categorizer and then queued for routing then an NDR is generated.
So:
SMTP: Message Submitted to Advanced Queuing
SMTP: Started Message Submission to Advanced Queue
SMTP: Message Submitted to Categorizer
SMTP: Message Categorized and Queued for Routing
SMTP: Non-Delivered Report (NDR) Generated

Telnet I can't test at the moment as I've had to stop the server functioning.

[v-2nas]

Hey Andy do this
go registry

hkeylocalmachine\system\currentcontrolset\services \msexchangetransport\diagnostics\

increase the value for categorization to 7 (you can do it for all it's not gonna do harm)

save and clear the app logs

Then try to send the msg

Then give me the cat event that has been fired.

[AndyJG247]

Blimey that logs a lot....
Ok, I can't mail you the logs for security reasons I'm afraid, plus it is better to keep these things on the forums.
It does show my plenty of categorizer errors though.

Event Type: Error
Event Source: MSExchangeTransport
Event Category: Categorizer 
Event ID: 9004
Date:  02/12/2008
Time:  09:11:47
User:  N/A
Computer: SERVERNAME
Description:
Categorizer encountered a hard error while processing a message.  While processing user 'smtp:a_user@btinternet.com', the function 'CPhatCat::HrSaveEJRecipIfNecessary' called 'ItemProps->pIRecipsAdd->GetStringW' which returned error code '0x800300fd' (An unexpected error occurred.
).  A DSN has been generated. ( f:\tisp2\transmt\src\cat\sinks\phatcat\cptenvelope.cpp@1028 )
   
  For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: fd 00 03 80               ý..€

I've looked into this. The permissions for Exchange appear correct. Domain Prep has been run recently plus I checked inheritance on all of the servers.
We do use journalling but all of the journalling mailboxes are listed correctly and working (to the best of my knowledge).

EDIT: The addresses all appear to be external not internal addresses. Does this mean anything?
Thanks

[v-2nas]

Do you have journal mailbox on the same store on which journaling is enabled or a different store. If it's same then you need to move journal mailbox to a different store.

Now you said msg's appear to be external ???

do you mean to say that valid internal users are sending msg to valid external users

or external msgs are coming to valid internal user or postmaster msg are coming to your domain or going out of you domain
[This could be a spam]

and i need NDR too. Complete NDR with NDR code.

There will be more event's in the log i need a set of events in order to research more into it particularly when Cat NDR's the msg.

[AndyJG247]

Apologies for not updating this. We found it was caused by a heavily loaded and faulty GC. I've replaced this with 2 and all is good. Thanks for the time v-2nas.