Topic Last Modified: 2007-01-05

The Microsoft® Exchange Server Analyzer Tool reads the following registry entry to determine the count of the number of entries in the PoisonIDs value:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS \<ExchangeServerName> \Private- <PrivateInformationStoreGUID>

If the Exchange Server Analyzer determines that the number of entries in the PoisonIDs value is greater than 0, a warning is displayed.

Versions of Exchange Server later than Exchange Server 2003 Service Pack 1 implement behavior that helps prevent corrupted or bad messages from causing the Microsoft Exchange Information Store service to stop unexpectedly or from preventing the Exchange Information Store service to start successfully.

In Exchange Server 2003 Service Pack 1 or later versions, messages that cause the Exchange Information Store service to stop unexpectedly during conversion from MAPI format to MIME format are tracked. The message ID of the corrupted message is stored in the registry when the crash occurs. If a corrupted message causes the store to stop unexpectedly three times, this information is used to prevent the message from being processed again when the Exchange Information Store service is restarted the fourth time.

When the Exchange Information Store service stops unexpectedly because of a corrupted message, the PoisonIDs registry value is created at:

HKLM\System\CurrentControlSet\Services\MSExchangeIS \<ExchangeServerName> \Private- <PrivateInformationStoreGUID>

Additionally, an administrator can create the PoisonThreshold registry entry. The PoisonThreshold key controls the maximum number of times a message can pass through the Exchange information store before it is added to the PoisonIDs registry key. By default, this threshold value is 2. To trigger the behavior, the threshold must be exceeded. Therefore, the Exchange Information Store service can stop 3 times because of a corrupted message before that message is blocked. For example, if a message is involved in 3 crashes, the message is blocked because three is more than the threshold value of 2.

When a corrupted message event is written to the registry, error event messages (Event IDs 9680 and 9681) will appear in the Application event log. After the Exchange Information Store service is successfully started, Exchange then blocks the message and tries to send a non-delivery report for it. In some cases, Exchange may be unable to send a non-delivery report. In these cases, the blocked message may remain in the queue until it expires. The PoisonIDs registry key contains up to ten message ID values. When the limit of ten is exceeded, a new corrupted message event is added. The corrupted message event that contains the oldest crash date is removed.

To correct this warning

  1. If you have a mailbox store that has problems with a corrupted message, you must further investigate the issue. For information about how Microsoft IT recovers from damaged Exchange databases, see

  2. If you are experiencing problems with Exchange Server 2003 shutdowns because of corrupted messages, it may help to enable automatic error reporting on the Exchange Server computer. Error report data is used to find and to fix problems in the software that you use. For more information about how to enable Exchange Error Reporting, see Exchange Error Reporting is disabled.

For more information about Exchange Server 2003 Service Pack 1, see "Service Pack 1 for Exchange Server 2003" (