XCON: How to Generate Application Log Events for Non-Delivery Report Failures (262308)

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SUMMARY

A provision to identify the root cause of a non-delivery report (NDR) is available after you set diagnostic logging on the Transport Categorizer to Field Engineering (Level 7). The resulting Event identifies the function, reason for failure, recipient name, and recipient type. After you enable Field Engineering diagnostic logging on the Categorizer, the following event is generated for messages that produce NDRs:

Messageid=9000
Facility=Interface
Severity=Informational
SymbolicName=PHATCAT_NDR_REASON
The function '%1' failed for reason '%2' when processing the recipient '%3' of type '%4'.
A DSN has been generated.

MORE INFORMATION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

You must manually change the Categorizer registry entry to enable Field Engineering (Level 7) diagnostic logging. To do so:

Start Registry Editor (Regedt32.exe).
Locate the Categorizer value under the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeTransport\Diagnostics
Double-click the Categorizer entry in the right pane, and then change the value to 7.
Quit Registry Editor.

This works most of the time, but there may be scenarios when the resulting Event ID 9000 is missing some or all of the troubleshooting information, including the identity of the function, reason for failure, recipient name, or recipient type, and therefore, will not be useful.