MSExchangeDiagnostics Event ID 1039

Since last Friday, when the Exchange servers were updated to the latest patches, I have been seeing Errors in the event logs from Source MSExchangeDiagnostics, Event ID 1039.

the information in the events is:

Log Name:      Application
Source:        MSExchangeDiagnostics
Date:          5/18/2015 11:04:45 AM
Event ID:      1039
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      server.domain.com
Description:
Failed to detect the bitlocker state for EDS log drive 'E:\'.
Exception
System.Management.ManagementException: Invalid namespace 
   at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
   at System.Management.ManagementScope.InitializeGuts(Object o)
   at System.Management.ManagementScope.Initialize()
   at System.Management.ManagementObjectSearcher.Initialize()
   at System.Management.ManagementObjectSearcher.Get()
   at Microsoft.Exchange.Diagnostics.Service.DiagnosticsService.DriveLocked(String diagnosticsRootDrive)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeDiagnostics" />
    <EventID Qualifiers="49156">1039</EventID>
    <Level>2</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-05-18T16:04:45.000000000Z" />
    <EventRecordID>5189128</EventRecordID>
    <Channel>Application</Channel>
    <Computer>server.domain.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>E:\</Data>
    <Data>
Exception
System.Management.ManagementException: Invalid namespace 
   at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
   at System.Management.ManagementScope.InitializeGuts(Object o)
   at System.Management.ManagementScope.Initialize()
   at System.Management.ManagementObjectSearcher.Initialize()
   at System.Management.ManagementObjectSearcher.Get()
   at Microsoft.Exchange.Diagnostics.Service.DiagnosticsService.DriveLocked(String diagnosticsRootDrive)</Data>
  </EventData>
</Event>

I have researched this and found numerous reports of this following the upgrade to either CU6 or CU7, we have been running at CU7 since January and had not seen this until Friday. Only one of the 2 Exchange servers is showing this error and Exchange is running fine.

We have the 2 servers in an Active Active setup with the databases spread evenly between them, there have been no reports of issues from any users and no other errors seen in the event logs.

What is causing this and what can I do to stop it?


  • Edited by GADavies Friday, May 29, 2015 3:55 PM .
May 20th, 2015 2:34pm

Hi GADavies,

We could backup Register then navigate to the following path:

Hkey local machine -> Software ->Microsoft ->Windows NT->CurrentVersion->Schedule->Taskcache->Tree->Microsoft->Windows->PLA

back up PLA and if present, delete the keys ExchangeDiagnosticsDailyPerformanceLog  and ExchangeDiagnosticsPerformanceLog, then restart the server to check if the issue persist.

If there are any questions regarding this issue, please be free to let me know.

Best Regard,

Free Windows Admin Tool Kit Click here and download it now
June 5th, 2015 1:57am

So are you saying using the suggested fix caused another problem? I still have these error logs being recorded and being pressured into finding a resolution. I did not attempt the suggested fix yet as I have been working on other issues but now this has become the focus again so I need to asses if this is something worth trying, if it is possibly going to cause other issues I'd prefer to look for an alternative solution
June 22nd, 2015 12:11pm

I have unmarked as answer because of the post from Spiteful Ivan below.

Is this a confirmed fix for the issue? I am still seeing the errors recorded though I did not make the reg changes suggested , I want to ensure it is a known fix and is not going to cause other issues as reported below.

Free Windows Admin Tool Kit Click here and download it now
June 25th, 2015 1:44pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics