You may have noticed since installed Exchange 2013 CU4 or Exchange 2013 CU5 that your event log is filled with Event ID 16028 and that this event will occur almost every 1 to 5 minutes and from numerous sources.
event id 16028, sources MsExchangeTransport, MSExchangeFrontEndTransport, MSExchangeTransportSubmission and MSExchangeTransportDelivery.A forced configuration update for Microsoft.Exchange.Transport….. has successfully completed.
First do not worry this is just the transport service being updated that changes have occurred such as queued messages or updates to spam rules etc.. A similar issue occurred in Exchange 2010 and Microsoft confirmed that this is not an issue and can be safely ignored.
Microsoft said they would patch this is CU5 however it looks like they have not, in the meantime we can filter this event from cluttering up out event logs.
Filter Event IDs Server 2012
Here we create a custom view and hide event ID 16028:
- Open event Viewer and in your event log click on “Filter Current Log” in the action pane.
- Select by logs and select the Exchange logs and/or system logs in which the event appears
- Then in the following box simply enter the event id number of 16028 and any other events you would like to stop cluttering up event viewer.
- Click “OK” on the dialog box.
- In the action pane you now click “Save Filter to Custom View”
