Cleaning up Exchange 10033 Errors in the Application Log

It's not uncommon for me to look at a client's Exchange logs and see a deluge of Event 10033 in the Application Log.  The error is caused by "A folder is being scoped which no longer exists. This may result in failures or errors when attempting to update the folder contents.  If this message continues to persist for this mailbox, moving the mailbox to a different database may resolve the issue."  For once the error is pretty straightforward and the fix is equally simple.  The problem with the error is that it seems to be generated every time an affected user touches their mailbox.  There could be thousands of these messages, and finding out which users are impacted is not as simple as applying an event log filter.  Unfortunately the mailbox causing the issue is in the General description and not a searchable field.  My solution?  Excel time!

First, filter the Application Log on only Event ID 10033.  Then click on Save Filtered Log File As... and save the events as a csv.  Open the csv file in Excel and add this formula in the second row after the last column.

=MID(F2,FIND("Folder:",F2),FIND("]",F2)-FIND("[",F2)+9)

The formula will find the text that starts with "Folder:" and Pull out the text that follows in brackets.  This will be the mailbox name.  Select the results in that column and click on the Advanced Filter on the Data tab.  Make sure the list range is only the results column and check the Unique records only box.  Click OK and you will be presented with the unique mailboxes that are causing the errors.  Move those mailboxes to a different database during your next maintenance window and say hello to a cleaner and easier to review Application Log.

Labels: , ,