Event ID 9548 & System Performance

Have you ever disabled a Windows account when an employee has left your company, only to see the following event ID logged by Exchange 200x?

It can also occur on the disabled Windows accounts that the ADC creates.

Well, if you're like me, you would have merely thought this to be nothing more than annoying. As it happens, there's more to this error than meets the eye. First, let's take a look at why this error is logged. We'll then go on to talk about why this error can cause you problems you might not have expected it to.

Event 9548 is just an indicator but it does tell you what the problem is - the account listed in the event text does not have a master account SID. What does that mean? Well, the method used to grant permissions in Exchange 200x information store Access Control Lists (ACLs) varies depending on whether the Windows account is enabled or disabled.

* Disabled Windows account permissions are calculated by using the msExchMasterAccountSID attribute.

* Enabled Windows account permissions are calculated by using the objectSID or sidHistory attributes.

If a disabled Windows account does not have the msExchMasterAccountSID attribute set, the 9548 event ID may be logged under certain conditions. The logging of this event ID can easily be fixed by granting the SELF account the Associated External Account right to the mailbox. This is fully documented in MSKB 278966.

Merely ensuring that event ID 9548 isn't logged in the application event log for cosmetic purposes isn't the only reason you should set the SELF account with Associated External Account rights. Every time this event is logged (and remember there is one per disabled account) you are contributing to a possible performance problem with your Exchange server. This is because one of the Information Store threads will hang trying to resolve the disabled user account that is more than likely listed somewhere in an ACL on another object. In other words, every time someone tries to access an ACL that contains the disabled user account, there will be a performance hit whilst the Information store tries to determine who the disabled user really is.

This may not be a problem on smaller systems but Microsoft PSS has already seen numerous cases where resolving the 9548 event IDs has resolved system performance problems. The message here is loud and clear: don't let event ID 9548 multiply and go unnoticed on your system, as it will eventually show as reduced system performance.