Suspect Desktop Search Installed on Clients

[This topic is intended to address a specific issue called out by the Exchange Server Analyzer Tool. You should apply it only to systems that have had the Exchange Server Analyzer Tool run against them and are experiencing that specific issue. The Exchange Server Analyzer Tool, available as a free download, remotely collects configuration data from each server in the topology and automatically analyzes the data. The resulting report details important configuration issues, potential problems, and nondefault product settings. By following these recommendations, you can achieve better performance, scalability, reliability, and uptime. For more information about the tool or to download the latest versions, see "Microsoft Exchange Analyzers" at]  

Topic Last Modified: 2006-09-05

The Microsoft® Exchange Server Analyzer Tool has determined that you have many users who are using a desktop search engine. Desktop search engines may create many remote procedure calls (RPCs) against a user's mounted mailboxes, as well as substantial traffic against the public folders as these search engines crawl the file structure of the public folder store. Many search engines only crawl the public folders if they are in the user's public folder Favorites list. Therefore, you may or may not see load on the public folder servers from desktop search.

Actions that you can take to mitigate this issue include the following:

  • Have your users turn off the scanner's Microsoft Office Outlook® features, or limit the scan to just their personal mailbox.

  • Run Outlook in Cached Exchange Mode so that the scans only affect the local workstation and not the server.

  • Follow the guidance of Microsoft Knowledge Base article 889086, "You may experience unexpected behavior in a Windows XP-based computer when you try to access public folders on Exchange 2000 Server" ( to obtain the hofix and set the MaxObjsPerMapiSession registry key on computers that are running Exchange Server that are accessed by desktop search users.

To verify if the desktop search application is the cause of high load for a particular user, use Microsoft Exchange Server User Monitor (ExMon) to monitor the RPC operations the search engine's actions, make sure you gather data for an adequate time period (at least five minutes). Then, remove the search engine and run the ExMon tool again. If there is a significant decrease in the RPC rate, you have confirmed that desktop search engine is causing the increase in load. If you observe that the average RPC latency decreases, you have confirmed that the high load resulted in higher RPC latencies.


RPC latency rates vary considerably throughout the day. Therefore, a five-minute test may be inadequate. You may need to measure for a longer period of time.

To download ExMon, see the Microsoft Download Center (

For More Information