It started with the cpu running at 100% then I would reboot and it would be ok for a bit then the cpu would go back to 100%. Exchange 2007 sp1 roll out 7 has been running on Windows server 2003 standard 64x fine for two years. So then no one could conect at all, I opened services and sorted by automatic and the "mail connector" service was not started. So I tried to start it and it said that the path could not be found, error 3? Is there an .exe somewhere I can point this service at? Oh it was saying that a user had some high rpc requests locking up the cpu but how would I track down the user?

Issue description: CPU runs at 100% on the exchange server, and all users cant connect to exchange server anymore Check info: 1. Is it a pure exchange 2007 environment, no SBS 2008 environment? 2. Please describe the exchange topology, is it a single box with all exchange server roles (Mailbox, Hub and CAS) installed? 3. Which service takes the most CPU utilization? Notes: If the service that takes most CPU is store.exe, please see the answer in this thread 4. Quote: mail connector in services will not start? Could you provide the full name of that service? Because theres no service called as mail connector in exchange 2007 services 5. Quote: I tried to start it and it said that the path could not be found Please provide the exact error info, and please also see if theres any error or warning info in the application log 6. Quote: it was saying that a user had some high rpc requests locking up the cpu Where did you get this info? Could you provide the exact error info? 7. After CPU runs at 100% on the exchange server, please check the application log again on the server to seek for related error or warning event

1. Yes pure exchange 2007 2. 1 box HP proliant server 2003 standard with all the exchange roles installed. 3. It looks like mad.exe is at 99%. 4. I think that mail connector is left over from our failed blackberry experiment from a few years ago. 5. see 4 6. By running the Exchange Trouble shooting assistant. 7. I get a bunch of Source: MSExchangeIs Event ID: 9646 (different users) / Source: MSExchange System Att Event ID: 4001 / Source: Application Error Event ID: 1000

Is there a way to restart mad.exe? Performance Details Performance Details Time Range: 05/27/2009 09:30:29 - 05/27/2009 09:35:55 Area: Memory and Processor Health 'mad' process processor performance issue Time Range: 05/27/2009 09:30:29 - 05/27/2009 09:35:55 '\Process(mad)\% Processor time' should be less than 40% on a back-end server. Actual measured processor usage is 106.4%. Tell me more about this issue and how to resolve it. Processor performance issue Time Range: 05/27/2009 09:30:29 - 05/27/2009 09:35:55 The average value of '\Processor(_Total)\% Processor Time' should always be below 90%. The measured value is 100%. This indicates the server has a processor bottleneck. Tell me more about this issue and how to resolve it. Processor queue performance issue Time Range: 05/27/2009 09:30:29 - 05/27/2009 09:35:55 The average value of '\System\Processor Queue Length' should be less than 2. The measured value is 25.51. This indicates the server has a processor bottleneck. Tell me more about this issue and how to resolve it.

Ok so it looks like mad.exe is the Exchange System Attendant

????????????????????????? User Name Packets Operations CPU Time (ms) CPU (%) Avg. Server Latency (ms) Max. Server Latency (ms) Bytes In Bytes Out Client Versions Carrie Compton 5312 10033 2295 41.69% 0 272 439453 55072161 12.0.6315.5000 8.1.359.2 Eric Ferland 4621 11292 1950 35.42% 0 393 1418884 1038722 12.0.6423.1000 8.1.359.2 ? 1779 2895 495 8.99% 2 520 8621564 8397014 8.1.359.2 Menta Martel 820 2993 315 5.72% 4 359 9582772 187653 8.1.359.2 12.0.6315.5000 Karin Nelson 633 2346 135 2.45% 0 12 49970 46904 11.0.8200.0 8.1.359.2 Microsoft System Attendant 294 684 90 1.63% 0 15 26084 55804 8.1.359.2 Vikki Fogg 63 206 45 0.82% 0 8 5856 32393 8.1.359.2 12.0.6315.5000 Mike Harper 133 399 30 0.54% 0 5 17199 65002 8.1.359.2

I think I found my problem. That first user with CPU at 41.69% I went to her desk and ran a virus scan and found something about *ecard* . So I asked her if she remembered that email I sent to everyone not to click on the link in any email that talks about a ecard? She yes. I said did you click on a link? She yes it was her birthday that day. I shutdown her email and everything was is fine so far. I have also clamped down the spam filter SCL rating to 5 now lets see what happens. The funny part is she was my biggest complainer of not being able to use email, and then when I had to clean her system she seemed annoyed, WTF? /rant