What is exact version of Exchange??
What Roles is the server fulfilling?? (HUB\MB\Edge)
Is Patch 1 installed for MSME?
If server is running Mailbox role do you have Background Scanning enabled??
Exchange Server 2010
Role is MailBox only.
Patch 1 is installed:
Product Name McAfee Security for Microsoft Exchange Product Version 7.6.7718.105 Service Pack None Hotfixes HF718833;HF735863;Patch1 Buffer Overflow Protection Not Applicable
Thera are no error events in Windows application and system logs associated with RPCserv.exe (or MSME).
Afte firs time we have disabled BGS by ePO policy (see attach).
So this detail is from configuration of Mailbox server(s) which suggests you will have Hub server(s) (and maybe edge server(s))??
Was the issue witnessed on the Mailbox server(s)?? Did an OnDemandScan of Mailboxes run into normal business hours or is there anything common to when this issue happens??
Or was the issue actually on the HUB or Edge servers??? Any evidence there of issue??
we have 5 virtual servers with next roles:
2 servers (DAG) are Mailbox role only;
2 servers are Hub role only;
1 servers is Edge role only.
As you can see on my previos post the BGS is disabled in epo policy.
Also there are no VSE installed on servers.
On the first time we faced the problem the issues were on MB, Hub and Edge servers. All of them had high CPU usage by rpcserv.exe.
We updated MSME to the lasted DAT and restart all servers. After that it has looked ok.
But after some days we faced the same issue on Mailbox server only. We have restarted msme service and total CPU load became less than 5%.
Now we enable the CPU counts on MB servers and especially on two process RPCserv.exe. If the problem repeats we'll have the evidences.
We suggest, that the reason was in bad DAT update.