E2K16 CU22 Event 4023 and 4028 EWS related AD Access for default Discovery Mailbox

jremmc 56 Reputation points
2022-03-07T20:11:59.907+00:00

Exchange 2016 CU22 with 1 DAG of 4 servers. CU22 was installed on 2/23/2022. We are getting MSExchange AD Access errors 4023 and 4028 concerning the default Discovery system mailbox, on the server that has the active copy. The mailbox exists and as should be, is disabled and hidden. I don't see any other errors related to it.

Events started on Saturday 3/5/2022 5:41 AM. Event 4023 (EWS-budget locked) occurs about every 20 minutes, followed about 6 minutes later by 4028 (EWS-4028 budget unlocked). Example from today:

Event 4023 at 2:06 PM:
Process w3wp.exe (EWS) (PID=xxxx). The budget for user 'Sid~<SID of default Discovery Mailbox>~Ews~true~ExchangeInternalEwsClient-AuditLog-w3wp-AdminAuditLogSearchWorker' is locked out until 3/7/2022 7:11:22 PM. Max Burst: 300000, Recharge Rate: 1800000, CutoffBalance: 0

Event 4028 at 2:14 PM:
Process w3wp.exe (EWS) (PID=same xxxx). The budget for user 'Sid~<SID of default Discovery Mailbox>~Ews~true~ExchangeInternalEwsClient-AuditLog-w3wp-AdminAuditLogSearchWorker' has been unlocked.

We (our company) did not make any changes to Exchange config or any Exchange servers since installing CU22, or changes to any users since Thursday 3/3. No backups were running. *However, a company with which we sysnc GALs (their users/rooms/DLs come in as contacts) did a sync on 3/5 of over 15,000 users; it started at 4:58 AM and ended 5:15 AM. Could that be the cause?

(Note: I've seen posts about events 4023 and 4028 related to users, and fixes being increase throttling policy threshholds and/or updating their phone OS versions. But these errors are for the default Discovery Mailbox. No errors for a particular user.)

I can't figure this out, or how to correct. Any ideas?

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,390 questions
{count} votes