Subscription Has Been Removed
I have an Exchange 2007 server that is almost 2 yrs old that just started getting event ID's 5, 6 and 7 (see sample below). Can someone tell me how to trace this out to find the source? We do use Windows Mobile devices via ActiveSync. Our SSL certificate is also due to be renewed in March but I would not think that this would cause the problem?Event Type: ErrorEvent Source: MSExchange Web ServicesEvent Category: Core Event ID: 7Date: 2/11/2010Time: 4:29:44 PMUser: N/AComputer: MS2Description:After 8 unsuccessful attempts to send a notification for subscription DgBtczIuY3Bocy5sb2NhbBAAAABSkWacjrixQJ6bAKL3draV, subscription has been removed. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
February 12th, 2010 1:06am

See the thread below. Here just a quote: "The event 5, 6, and 7 are basically event that telling us that a device/client is subscribing a server event, but when the server when to notify the client/device, the client is not there to respond to it, so the server threw and error and close the subscription." MSExchange Web Services event warnings and errorshttp://social.technet.microsoft.com/Forums/en/exchangesvrgeneral/thread/4d341abb-8e2f-4cab-a6ae-6735d4c1561eMCTS: Messaging | MCSE: S+M | Small Business Specialist
Free Windows Admin Tool Kit Click here and download it now
February 12th, 2010 3:44am

Jon- Thanks for the reply but I want to track down which device/client is subscribing the server event so that I can stop it. Does anyone know how to do that? Thanks!
February 12th, 2010 6:04pm

HiAre any WM users intermittently not able to synchronize with the Exchange server over activesync? Maybe they receive an error: 0x80072efd in their device.Or some other devices, like telephone system sending SOAP request to your server?Frank Wang
Free Windows Admin Tool Kit Click here and download it now
February 15th, 2010 12:17pm

Frank- Thanks for your reply. We have many Windows Mobile devices and getting users to tell me if they are having a problem is hard. Is there any way to track a subscription via the unique ID that it uses? The problem went away over the weekend and started again this morning. That makes me think that it is a PC since we have users shutdown when they go home. Any help from anyone would be appreciated about how I can track this down.
February 15th, 2010 9:06pm

I had Microsoft help me analyze the IIS logs on our Exchange server. It looks like someone is trying to attach a rogue mobile device to our Exchange server using Jakarta protocol. We were able to pinpoint the credentials being used and the IP address of the mobile service provider. It appears to be coming from something affiliated with www.seven.com. Hope this helps someone else in the future.
Free Windows Admin Tool Kit Click here and download it now
February 26th, 2010 9:04pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics