I was getting the following error in the logs on an Exchange 2010 server(SP3 with RU5).

There is a limit of attachments in a single message that the content indexer will process. If the indexer encounters more than 32 attachments, the event 9875 is thrown.

The errormessage also has information about the affected Database, Folder ID, Message ID and Document ID.

For now, the only useful information is the database name which holds the problematic message, rest of the values are hex numbers. We can assume there are a bunch of users and messages in a database, therefor we need to find the correct mailbox and item.

 

..this is where ExFolders come in handy.

Download ExFolders, import the regfile and copy the .exe-file to C:\Program Files\Microsoft\Exchange Server\V14\Bin\. You must run ExFolders.exe from that folder.


Launch ExFolders and select “Mailboxes” and “Database”. If you want to run against a preferred GC, make that selection, otherwise select the database.
 

 

exfolders3
Choose “Selected folder and subfolders” and set an output file (example: c:\folderids.txt).
Unmark all other properties and select the FolderID “ptagFID: 0x67480014“.

This will export ALL folder ID:s in every mailbox in the selected database. Note: You need full access permissions to be able to traverse the folders.

 

Search the exported file for the FolderID that matches the one in the errormessage. Now you know in which mailbox, and folder, the message is in.

In my case the FolderID matched with the “Recoverable Items”-folder in a mailbox.

 


Launch ExFolders, select the folder and “Export Item Properties”.

 

Add MessageID property, ptagMID:0x674A0014, in the field click “Add property to list” and OK

You have now exported all MessageIDs in that folder and one of them should match with the MessageID in the errormessage.

 

Depending on where the message is and what kind of action you choose to take, you can use powershell, outlook or mfcmapi to remove the message.