We have a two-server MBAM setup in our enterprise. It has been in use for eight months with good results.
Lately I found some clients have never been able to contact the MBAM server. Neither compliance data or recovery keys are uploaded.
When checking the client's event log - I find the following admin messages:
Event ID 4
An error occurred while sending encryption status data.
Error code:
0x803d0008
Details:
A quota was exceeded.
Event ID 2
An error occured while applying MBAM policies.
Volume ID:\\?\Volume{7a6627e1-abf4-11e0-b703-5c260a5c8847}\
Error code:
0x803d0008
Details:
A quota was exceeded.
No Operational logs exist.
I would be very thankful for some advice on how to resolve this issue.
What I tried so far is:
-Added NoStartupDelay=1 and reduced the check-in frequency for the MBAM client.
-Added DisableMachineVerification=1 on the MBAM server
-Reinstalled the MBAM agent
-Restalled Visual C++ 2008 redist

Need to support users over the internet? click here try our remote control online beta

Detailed XML view of the log messages:
- <Event xmlns="
http://schemas.microsoft.com/win/2004/08/events/event">
;
- <System>
<Provider Name="Microsoft-Windows-MBAM" Guid="{1C6E854B-3DF3-4A6F-9401-F58F1D1C504D}" />

<EventID>4</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2012-06-11T12:43:01.224500900Z" />
<EventRecordID>269</EventRecordID>
<Correlation />
<Execution ProcessID="2704" ThreadID="6636" />
<Channel>Microsoft-Windows-MBAM/Admin</Channel>
<Computer>CLIENT_NAME.xxx.yyy.com</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData>
<Data Name="ErrorCode">0x803d0008</Data>
<Data Name="ErrorString">A quota was exceeded.</Data>
</EventData>
</Event>
- <Event xmlns="
http://schemas.microsoft.com/win/2004/08/events/event">
;
- <System>
<Provider Name="Microsoft-Windows-MBAM" Guid="{1C6E854B-3DF3-4A6F-9401-F58F1D1C504D}" />

<EventID>2</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2012-06-11T06:05:45.867679900Z" />
<EventRecordID>268</EventRecordID>
<Correlation />
<Execution ProcessID="2704" ThreadID="3908" />
<Channel>Microsoft-Windows-MBAM/Admin</Channel>
<Computer>CLIENT_NAME.xxx.yyy.com</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData>
<Data Name="VolumeId">\\?\Volume{7a6627e1-abf4-11e0-b703-5c260a5c8847}\</Data>

<Data Name="ErrorCode">0x803d0008</Data>
<Data Name="ErrorString">A quota was exceeded.</Data>
</EventData>
</Event>

There is an amazing pack of free network admin tools. click here to download it

Solved!
With help from Microsoft - we found out what's causing it.

This happens when there are more than approx. 50 user profiles on the machine. According to Microsoft, the stability of the system is compromised when the number of profiles hit >50.
Checking the MBAM report, I find systems that have as many as 135 profiles. Anything above that will cause the MBAM client to fail with "A quota was exceeded" and no data is uploaded.

To make the MBAM client work, simply delete the extra profiles from c:\users and from the registry.

Step 1) Remove all the unused profiles from C:\Users. Leave the Public profile intact.
Step 2) Open Regedit.msc. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. Remove the unused profiles.
Do not remove S-1-5-18 / 19 / 20. If you do that, you can no longer login again.

Need to support users over the internet? click here try our remote control online beta

Hi,




Thanks for your sharing, it benefits us a lot.

Thanks.



Jeremy Wu
TechNet Community Support

There is an amazing pack of free network admin tools. click here to download it