Sequence of Event Processing

Information Store Communicates Changes to Event Service

When changes are made to Exchange information store, it notifies Exchange Event Service (events.exe). Then the Exchange Event Service requests details from the information store via Incremental Change Synchronization (ICS) interfaces. It does not happen immediately, though, as a programmer would want. Instead, Exchange server information store uses default delay of 60 seconds when sending replication change notifications. This means that your script will not be invoked right away, but rather with some delay. There is a way to change this default interval. It is described in the MSDN article Q179303 named "XADM: Reducing Event Service Firing Delays". You need to introduce a DWORD value named "ICS Notification Interval" under the following key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\ParametersSystem
 
The value will specify a new delay interval in seconds. You need to be careful when doing this, however, because of extra overhead associated with every replication session.
 

Event Service Runs Scripting Agent in Security Context of Script Author

If a monitored event occurs in a folder, the Event Service instantiates Scripting Agent in security context of script author. Scripting Agent is a Microsoft provided component that implements IExchangeEventHandler interface. Event Service then calls IExchangeEventHandler::ExecuteEvent. The Scripting Agent then executes one of the four handlers of the script, depending on the event.

You can also develop custom agents. Most likely your agents will handle things differently. For example, you might develop them in C++ for performance reasons. You may improve it in some way. However, make sure you understand that agents are invoked by the Event Service, which in turn is notified by Exchange information store, and this does not happen fast. Writing custom agents is out of scope of this book.
 

Where Scripts Are Stored

Scripts are stored as associated messages in folders. You can examine their properties with mdbvu32.exe. If you install a simple script and then examine associated contents table of the folder, you should see a pair of messages there with subject equal to the name of your agent. Their message classes should be IPC.Microsoft.EventBinding and IPC.Microsoft.ICS.EventBinding.
 
When Things Go Wrong

It is very easy to write a bogus script. Outlook provides a notepad like editing tool for script writing. You can put anything in there, including invalid commands. This script will be given a chance to run. If something goes wrong the script will be disabled until you modify it. In this case the Event Service (MSExchangeES) will put a message into Application Event Log (Event ID 12) describing the reason of failure. For example, it may say something like this:

"A fatal error (0x86664004) occurred in an IExchangeEventSink while processing message [Subject = "Test"]. 09/06/98 11:00:47 Run time error at line 19. Source: Microsoft VBScript runtime error Error: 800a01f4. Description: Variable is undefined: 'command'"

As you see, script line number is listed, as well as other related information, which may help to eliminate the problem. Additionally, properties of IPC.Microsoft.ICS.EventBinding message in the folder's associated contents will change. Property 0x780C (PT_STRING8) may appear. It holds the reason of failure.

Also, subsequent events that normally should invoke the script will generate another event (Event ID 25) in the Application Event Log:

"Script failed with a run time or syntax error on the last event. Since the script was not modified since the last failure, the script will not be run again until the error is fixed. Please refer to agent log for more information about the failure."