Event IDs 10001/4010: Poison Queue - Fix Guide 2025

Log Name:      Application
Source:        MSExchangeTransport
Event ID:      10001
Level:         Warning
Description:   Message with ID <message-id@domain.com> has been
               moved to the poison message queue because it caused
               the transport service to crash.

Log Name:      Application
Source:        MSExchangeTransport
Event ID:      4010
Level:         Error
Description:   The transport service encountered a message that
               caused an unexpected exception. The message has
               been quarantined.

# View messages before deletion
Get-Message -Queue "Poison" |
  Select-Object Identity, FromAddress, Subject | Format-Table

# Delete specific message
Remove-Message -Identity "ServerName\Poison\123456" -Confirm:$false

# Delete ALL messages in poison queue
Get-Message -Queue "Poison" | Remove-Message -Confirm:$false

# Verify queue is empty
Get-Queue -Identity "Poison"

# Resume specific message for retry
Resume-Message -Identity "ServerName\Poison\123456"

# Resume all poison messages
Get-Message -Queue "Poison" | Resume-Message

# Monitor if they process successfully
Get-Queue | Select-Object Identity, Status, MessageCount

# If messages become poisoned again, the fix didn't work
Get-Queue -Identity "Poison"

# Export all poison messages
$exportFolder = "C:\Temp\PoisonExport_$(Get-Date -Format 'yyyyMMdd')"-Format 'yyyyMMdd')"
New-Item -ItemType Directory -Path $exportFolder -Force

Get-Message -Queue "Poison" | ForEach-Object {
    $fileName = "$($_.FromAddress)_$(Get-Date $_.DateReceived -Format 'HHmmss').eml"Get-Date $_.DateReceived -Format 'HHmmss').eml"
    $filePath = Join-Path $exportFolder $fileName
    # Export logic depends on Exchange version
}

# After export, delete from queue
Get-Message -Queue "Poison" | Remove-Message -Confirm:$false

# Manually review exported messages
# Redeliver valid ones via SMTP relay or other method

# Disable all third-party agents temporarily
Get-TransportAgent | Where-Object {$_.Identity -notlike "Microsoft*"} |
  ForEach-Object { Disable-TransportAgent $_.Identity -Confirm:$false }

# Restart Transport
Restart-Service MSExchangeTransport

# Resume poison messages and see if they process
Get-Message -Queue "Poison" | Resume-Message

# If successful, re-enable agents one at a time
Enable-TransportAgent "Agent Name"
Restart-Service MSExchangeTransport

# Test with poison-prone message again
# The agent that causes re-poisoning is the culprit

# Contact agent vendor for fix or configure agent to skip problematic content

# Check current Exchange version
Get-ExchangeServer | Select-Object Name, AdminDisplayVersion

# Check for available updates
# Visit: https://docs.microsoft.com/exchange/new-features/build-numbers-and-release-dates-numbers-and-release-dates

# After applying CU/SU, test poison messages
Restart-Service MSExchangeTransport
Get-Message -Queue "Poison" | Resume-Message

# Verify processing succeeds
Get-Queue -Identity "Poison"

# If poison messages come from specific sender/domain
# Create transport rule to reject

New-TransportRule -Name "Block Poison Sender" `
  -FromAddressContainsWords "badactor@malicious.com" `
  -RejectMessageReasonText "Message blocked by policy" `
  -RejectMessageEnhancedStatusCode "5.7.1"7.1"

# Or block at connector level
$connector = Get-ReceiveConnector "Default Frontend*"
# Add IP to block list if identifiable

# For pattern-based blocking
New-TransportRule -Name "Block Malformed Messages" `
  -HeaderContainsMessageHeader "X-Malformed-Header"-Header" `
  -HeaderContainsWords "malformed-pattern" `
  -RejectMessageEnhancedStatusCode "5.7.1"7.1"

# Poison threshold is in EdgeTransport.exe.config
# Default: PoisonMessageDetectionEnabled = true
# Default: PoisonThreshold = 3

# Edit: C:\Program Files\Microsoft\Exchange Server\V15\Bin\EdgeTransport.exe.config
# Add or modify in appSettings:
# <add key="PoisonThreshold" value="5" />"5" />

# To temporarily disable poison detection (NOT recommended for production)
# <add key="PoisonMessageDetectionEnabled" value="false" />"false" />

# After editing, restart Transport
Restart-Service MSExchangeTransport

# Find crash dump files
$dumpPath = "C:\ProgramData\Microsoft\Windows\WER\ReportArchive"
Get-ChildItem $dumpPath -Recurse -Filter "*.dmp" |
  Sort-Object LastWriteTime -Descending | Select-Object -First 5

# For detailed analysis, use WinDbg or send to Microsoft Support
# Dump location also in: %LOCALAPPDATA%\CrashDumps

# Quick stack trace with procdump (if captured)
# procdump -ma EdgeTransport.exe

# Key things to look for:
# - Third-party DLL names in stack
# - Specific Exchange component (categorizer, routing, etc.)
# - Memory address patterns suggesting corruption

# 1. Confirm poison queue is empty or manageable
Get-Queue -Identity "Poison" | Select-Object MessageCount

# 2. Verify Transport service stability
Get-Service MSExchangeTransport | Select-Object Name, Status
# Check no restarts in last hour
Get-EventLog -LogName System -Source "Service Control Manager" -Newest 20 |
  Where-Object {$_.Message -like "*MSExchangeTransport*"}

# 3. Test mail flow
Send-MailMessage -From "admin@company.com" -To "test@external.com" `
  -Subject "Post-Poison Test $(Get-Date)"Get-Date)" -Body "Testing mail flow" `
  -SmtpServer localhost

# 4. Check message tracking
Get-MessageTrackingLog -Start (Get-Date).AddMinutes(-10) -EventId DELIVER |
  Select-Object Timestamp, Sender, Recipients | Format-Table

# 5. Monitor for new poison events
Get-EventLog -LogName Application -Source MSExchangeTransport -Newest 20 |
  Where-Object {$_.EventID -in @(10001, 4010)}

# Limit message size to reduce oversized message issues
Set-TransportConfig -MaxReceiveSize 35MB -MaxSendSize 35MB

# Limit attachment count and nesting
# These settings help prevent resource exhaustion
Set-TransportConfig -MaxRecipientEnvelopeLimit 500

# Configure connector limits
Get-ReceiveConnector | Set-ReceiveConnector -MaxMessageSize 35MB

# Run hourly via Task Scheduler
$poisonCount = (Get-Queue -Identity "Poison" -ErrorAction SilentlyContinue).MessageCount

if ($poisonCount -gt 0) {
    $messages = Get-Message -Queue "Poison" |
      Select-Object DateReceived, FromAddress, Subject |
      Out-String

    Send-MailMessage -To "admin@company.com" -From "alerts@company.com" `
      -Subject "Alert: $poisonCount Poison Messages Detected" `
      -Body "Messages in poison queue:\n$messages" `
      -SmtpServer "backup-smtp.company.com"
}