Error Message

Application Event ID:

Description: Faulting application name: JournalTask.EXE, version: 10.0.3.1090, time stamp: 0x50c7634a
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9

Exception code: 0xc0000417
Fault offset: 0x0005a7d8
Faulting process id: 0x2b74
Faulting application start time: 0x01d0b0366aab3548
Faulting application path: D:\Program Files (x86)\Enterprise Vault\JournalTask.EXE
Faulting module path: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll
Report Id: aac76553-1c29-11e5-82ac-e4115b9b1da9
​V-437-1000

Dtrace of the Journal task will show the problematic thread enter the {CDLHelper::GetDistributionList:#225}: function but not successfully exit as follows:

112924        14:14:24.928         [3992]        (JournalTask)        <12316>        EV:L        {FindGroup:#1497} pre-cleanup
112925        14:14:24.928         [3992]        (JournalTask)        <12316>        EV:L        {FindGroup:#1505} done cleanup
112926        14:14:24.928         [3992]        (JournalTask)        <12316>        EV:M        {CExchangeArchivableItem::ProcessDistributionList:#2855} Setting List info in XML [dn=Prod_Support]
112927        14:14:24.928         [3992]        (JournalTask)        <12316>        EV:M        {CExchangeArchivableItem::ProcessDistributionList:#2871} Setting List info in XML [ea=Prod_Support@veritas.com]
112928        14:14:24.928         [3992]        (JournalTask)        <12316>        EV:L        {CSMTPBoundary::IsInternalDomain:#498} Domain [@citizensfla.com] is an [internal] domain (cached result).
112929        14:14:24.928         [3992]        (JournalTask)        <12316>        EV:L        {CExchangeArchivableItem::ProcessDistributionList:#2890} Setting Modified time of Distribution List in XML
112930        14:14:24.928         [3992]        (JournalTask)        <12316>        EV:L        {CDLHelper::GetRecipient:#148} entry
112931        14:14:24.944         [3992]        (JournalTask)        <12316>        EV:M        {CExchangeArchivableItem::ProcessDistributionList:#2940} Setting recipient of DL [dn=User Name]
112932        14:14:24.944         [3992]        (JournalTask)        <12316>        EV:M        {CExchangeArchivableItem::ProcessDistributionList:#2955} and set further info of recipient [ea=User.Name@veritas.com]
112933        14:14:24.944         [3992]        (JournalTask)        <12316>        EV:L        {CSMTPBoundary::IsInternalDomain:#498} Domain [@veritas.com] is an [internal] domain (cached result).
112934        14:14:24.944         [3992]        (JournalTask)        <12316>        EV:L        {CDLHelper::GetDistributionList:#225} entry

Review of the Dump File generated will show the exception code as follows:

EXCEPTION_CODE: (NTSTATUS) 0xc0000417 - An invalid parameter was passed to a C runtime function.

A closer look at the exception thread using WinDGB will show the following: 

 # ChildEBP RetAddr 
09 0722e614 7177a962 msvcr90!_wcsnicoll+0xd7
0a 0722e638 7177a98b msvcr90!_wcsupr_s_l+0x23
0b 0722e64c 6a50f0c4 msvcr90!_wcsupr_s+0x12
0c 0722e674 6a4e6b01 ExchangeItemsU!CMailboxUsage::CMailboxUsage(
class std::set<_bstr_t,std::less<_bstr_t>,std::allocator<_bstr_t> > * pmbxsBeingUsed = 0x00abe2f8,
void * MailboxInUseMutex = 0x00001320,
wchar_t * pMailboxDn = 0x00000000 "")+0x84 [v:\agents\archserver\mailboxusage.cpp @ 150]
0d 0722e828 6a4e8f95 ExchangeItemsU!CExchangeArchivableItem::ProcessDistributionList(
class CDLHelper * distList = 0x0a11baf0,
struct MSXML2::IXMLDOMDocument2 * doc = 0x01f7c058,
struct MSXML2::IXMLDOMNode * node = 0x01f747c0,
struct IMAPISession * pMAPISession = 0x01fb0db8,
bool * bExternalRecipientFound = 0x0722ec72,
class CStringCache * pP2Recipients = 0x0722e9c0,
class std::set,std::allocator >,std::less,std::allocator > >,std::allocator,std::allocator > > > * allDLRecipients = 0x0722ea18,
int * bGenerateXML = 0x0722ebc4,
int * bArchiveifFailedExpandDL = 0x0722ee20,
int * bLogRecursiveDLs = 0x0722ee24,
int * bUseActiveDirectoryDLExpansion = 0x0722ee28)+0x951 [v:\agents\exchangeitems\exchangearchivableitem.cpp @ 2998]

Where pMailboxDn = 0x00000000 ""  shows a pointer to the legacyExchangeDN attribute of the Distribution List in question. It shows an empty string.

Review of the Distribution List in ADSI Edit will show that the attribute 'legacyExchangeDN'  = .

The cause of this issue is Exchange attribute legacyExchangeDN not being set. During the Enterprise Vault archiving process the Journal Task attempts to expand Distribution Lists when the Exchange Journaling policy for Enterprise Vault is set to on.   During the Distribution List expansion the task will also gather other standard and necessary Exchange attributes on the DL such as legacyExchangeDN .  In cases where the DL is corrupted or the Exchange attributes are removed from the DL the Journal task will throw an exception as it is expecting to receive a valid value for the attribute. The result is a crash of the Journal Task when Enterprise Vault  attempts to find the exchange attribute for the Distribution list in active directory.