WORKAROUND
MTA associations are managed by control blocks. With Exchange Server 5.5, one control block manages each association to a remote MTA over an X.400 Connector.
The registry setting that affects X.400 Connector traffic over the TCP protocol stack is set by default to 20 (decimal), and is found in the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeMTA\Parameters\TCP/IP Control blocks
The control block allocation TP4 protocol stack is found at:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeMTA\Parameters\TP4 Control blocks
If there are more than two X.400 Connectors on the same Exchange Server 5.5 computer, you should increase this registry value to
(10 * number of X.400 connectors) + (number of sites)
for the appropriate protocol stack. For example, if there are five X.400 Connectors installed on an Exchange Server computer and 10 Site, set this registry string to a value of 60 (decimal). This setting allows 10 control blocks for each X.400 Connector, which is the maximum number of allowable associations for each X.400 Connector.
If you adjust the Control Block registry parameter as noted above, and the Event ID 9156 is still logged, then try this second possible resolution.
On each X.400 Connector's property page, on the
Override tab, increase the
Association Parameters, Disconnect (sec) setting to a value between 300-600 seconds (the default is 120).
When an MTA needs to open an association, an open request is passed down the Open Systems Interconnection (OSI) stack, each layer in the stack maintains a timer. The problem occurs when an open association to another MTA fails due to a network problem. The disconnect timer at the session layer expires before the transport layer has abandoned its attempt to open a transport connection. The transport layer timers are not configurable, but the session layer disconnect time can be adjusted (on the Disconnect (sec) value on the Override tab of the X.400 Connector).
This discrepancy in disconnect time leads to a dropped control block, which is not recovered by the MTA, and thus a shortage of control blocks. The 9156 errors that you see in the event log require the MTA to be restarted for mail flow to be resumed. Increasing this value to 300-600 seconds will allow the session layer to keep the association open longer, and thus reduce the chance that the session layer disconnect timer will expire before the network layer closes the network connection.
If the above procedures have been implemented (registry setting for TCP/IP control blocks and Disconnect time increased), see the following article in the Microsoft Knowledge Base:
193894 MTA stops processing messages and generates 9156 events