Overview

Users may experience an issue with Kerio Connect Server continuously writing to the message store, causing problems with replications and backups. This issue is not related to user interaction, as it occurs continuously, and it is not limited to a specific time or day. It happens across multiple mailboxes, particularly the larger ones, and appears to be continuously rewriting the inboxes. This issue is particularly prevalent in installations with a majority of Exchange ActiveSync (EAS) clients, including Outlook EAS.

The behavior affects Kerio Connect Server installations in some Windows environments, and it can be observed via the Windows Resource Monitor or any other software with disk monitoring capabilities.

Solution

In order to resolve the issue, please follow the below procedure:

1. If you notice in the Resource Monitor > Disk tab that the writes seem to be happening for specific user accounts only, apply the steps for Errors seen when User is Accessing Kerio Connect Mailbox
   • While the behavior depicted in the linked article is different, manual reindexing and removal of the metadata files has show success in some instances
2. If the Resource Monitor does not show a specific user pattern or the above step did not resolve the issue, proceed to check and adjust the LastAccessTimeStamp parameter in Windows registry
   • Kerio Connect touches a lot of files and directories, and because the LastAccessTimeStamp is by default ON in some Windows installations, this causes a write on each file and each directory each time they are touched by Kerio Connect.
   • You can access the Windows Registry and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
   • Take a backup of the NtfsDisableLastAccessUpdate registry key and proceed to configure its value to 1
     
   • Reboot the Kerio Connect server 

Summary

By reindexing the mailboxes and adjusting the LastAccessTimeStamp in Windows, users can resolve the issue of Kerio Connect continuously writing to the message store, thereby preventing problems with replications and backups.

FAQ

1. What causes Kerio Connect to continuously write to the message store?
   This issue is caused by Kerio touching a lot of files and directories (which is by design), and because the LastAccessTimeStamp is default on in some Windows deployments, this causes a write on each file and each directory each time they are touched by Kerio.
2. What is the NtfsDisableLastAccessUpdate registry key?
   The registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate controls the behavior of NTFS file system regarding the logging of the last access timestamp on files and directories. 
3. What are the effects of changing the above registry key?
   By default, Windows operating systems maintain a record of when a file or directory is last accessed, which includes reading, writing, or executing the file. Disabling the last access timestamp can be beneficial for performance, particularly on servers or systems where the access time data is not needed. In more recent versions of Windows, this feature is often disabled by default to strike a balance between system performance and the utility of having access timestamps available for files and directories.