0

I'm new here - sorry if this isn't quite the right forum for a question such as this, in which case I'd be most grateful if you could point somewhere else.

I'm acting as the sysadmin for a small firm (but I have virtually no experience or training, so please don't assume I know anything) and I'm having a mysterious problem: Two of my users are having intermittent Outlook crashes. They're using Outlook 2010 as a client for Exchange 2003. (Exchange 2003 is running on Windows Server 2003.)

The crashes occur when they switch to calendar view, and cause Outlook to freeze up. Mostly these crashes are unpredictable, but one of the two has found a calendar date that always causes a crash. This crash seems to happen in the same way regardless of which workstation the user has logged into.

One of the crashes was recorded in the event log as follows:

Event Type: Error
Event Source: Microsoft Office 14
Event Category: None
Event ID: 5000
Date:  07/02/2013
Time:  13:59:05
User:  N/A
Computer: TERMSERVER [<-- in this instance, the user had RDP'd into the terminal server, but the user normally runs Outlook locally.]
Description:
EventType officelifeboathang, P1 outlook.exe, P2 14.0.6126.5003, P3 mso.dll, P4 14.0.6129.5000, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.

These crashes have been happening - again, intermittently - for several weeks now.

What follows may or may not be relevant, it's just a report of my 'detective work' so far.

Looking through the system event log of the exchange server, I notice that a certain type of warning message keeps occurring, in batches of 10-15, every two hours. Here is an instance of one such message:

Event Type: Warning
Event Source: PlugPlayManager
Event Category: None
Event ID: 257
Date:  09/02/2013
Time:  15:35:14
User:  N/A
Computer: VEX1
Description:
Timed out sending notification of target device change to window of "LDM Service"

These batches of warnings begin on the same day that the Outlook crashes begin. On the Exchange Server I use both Backup Exec 2010 and Arcserve D2D as online backup solutions. Arcserve is set to perform incremental backups every two hours, and the batches of warnings take place during Arcserve backups.

The night before all of this started happening, I was doing something unusual: I had just changed the network administrator password, and was reconfiguring Backup Exec and Arcserve to use the new password. I can't remember what I did any more precisely than that. (If it makes any difference, Arcserve is still working: I'm still able to restore from Arcserve recovery points.)

Here are some things I have done since then, which have not solved it:

  • Used scanpst to repair local .pst files on each user's machine.
  • Tried de-activating third-party add-ins in Outlook.
  • Done a repair installation of Outlook 2010 on one of the machines.
  • Run an offline virus scan on one of the machines, which didn't find anything.
  • Dismounted the exchange database and ran eseutil /G. It didn't report any problems. (I'm planning to do an eseutil /P anyway, though.)

Does anyone have any ideas or suggestions?

EDIT: Dismounted the information store again and ran ISINTEG, which fixed a few errors. So far we haven't had any recurrences of the problem, so hopefully it's fixed, though to be fair, I've been in this situation several times before over the past few weeks. Time will tell...

TheFlanCalculus
  • 13
  • 3
  • Sounds like a client issue for those two users machines. I'd try doing a complete uninstall and clean reinstall of Office 2010, because there are just so many [stupid] little things in the user's Outlook client that can cause this - corrupt offline address book or calendar files, plug-ins, even seen moronically "fancy signatures cause this kind of problem. So give the problem users a fresh install and see if that clears up the issue, or at least narrows down the source of the problem a bit. – HopelessN00b Feb 11 '13 at 14:32
  • Thank you for taking the time to respond. I will try an uninstall/reinstall (if only out of lack of other ideas), but what makes me doubt very much that this will work is the fact that we got the same crash even when the user had RDP'ed into a completely different machine. And none of my other (20) users are getting this problem so it seems unlikely that all of the Outlook installations are broken. – TheFlanCalculus Feb 11 '13 at 15:01
  • @FlanCalculus Yeah, wonder if it's a corrupt calendar entry or something of that nature - but the fact that only these two users have this problem greatly reduces the probability of the issue being server-side. – HopelessN00b Feb 11 '13 at 15:06

1 Answers1

0

This sounds like the users have corrupt items in their mailboxes. Have the user with the easily reproducible problem log in to OWA and delete everything on their calendar for that day. For the other crashes, the problem may also be calendar related. When you bring up your calendar, Outlook tries to display items with approaching due dates and upcoming calendar entries. It may be that one of those items is corrupt.

Alternatively, you could try queuing the mailbox for a move to another database (check "suspend before completing"). You may find that during the move it discovers some corrupt items. You could then use MFCMAPI to remove those corrupt items and cancel the move.

longneck
  • 22,793
  • 4
  • 50
  • 84
  • Thank you for these excellent suggestions. I was just beginning to read up about OWA, but the 'queuing a mailbox for a move to another database' trick is something I'd never have thought of. I'll let you know how it goes. – TheFlanCalculus Feb 11 '13 at 15:34
  • It's a bit anticlimactic, but in the end I just dismounted the IS again and ran ISINTEG, which fixed a few errors. So far the users haven't reported anything, and I logged in as one of them and spent a while trying to make it crash but couldn't, so I'm tentatively assuming it's fixed. But thanks for your help in any case - always happy to learn something new. – TheFlanCalculus Feb 13 '13 at 03:06