Hello all,

I'm glad I came across this great forum, I have a feeling I'll be spending a lot of time here as blackberries are popping up on networks more and more.

I recently took over a network that was a bit of a mess. Most issues have been resolved, except for an issue with the CEO's blackberry, which of course makes it a big issue!

The phone works fine, and gets / sends email, but it no longer sychronizes his contacts, which is very annoying for him.

I logged into the exchange servers where BES is installed (yes, BES for just one blackberry...) I was poking around, and found that under the Windows system logs, there are tens of thousands of failure audits, event ID 861.

I've copied some of them below, but noticed that the port numbers are not always the same for the EXE calling them. I assume there is obviously some large configuration issue related to BES here, but I am not yet a BES guru. This is an application server running exchange 2003 overtop of Windows 2003, with BES 4.1.4.15 installed by previous technician. The database is sitting on the domain controller.

I tried to search here, and came up with nothing. Has anyone seen this before?


The Windows Firewall has detected an application listening for incoming traffic.

Name: -
Path: C:\Program Files\Research In Motion\BlackBerry Enterprise Server\BESAlert.exe
Process identifier: 3456
User account: BESAdmin
User domain: LAN
Service: Yes
RPC server: No
IP version: IPv4
IP protocol: UDP
Port number: 35347
Allowed: No
User notified: No
11:19:22 am 26-Aug-08
Matt Weaver .he Windows Firewall has detected an application listening for incoming traffic.

Name: -
Path: C:\Program Files\Research In Motion\BlackBerry Enterprise Server\AttachServer\BBConvert.exe
Process identifier: 12152
User account: SYSTEM
User domain: NT AUTHORITY
Service: Yes
RPC server: No
IP version: IPv4
IP protocol: UDP
Port number: 35350
Allowed: No
User notified: No

The Windows Firewall has detected an application listening for incoming traffic.

Name: -
Path: C:\Program Files\Research In Motion\BlackBerry Enterprise Server\AttachServer\BBConvert.exe
Process identifier: 10828
User account: SYSTEM
User domain: NT AUTHORITY
Service: Yes
RPC server: No
IP version: IPv4
IP protocol: UDP
Port number: 35348
Allowed: No
User notified: No



The Windows Firewall has detected an application listening for incoming traffic.

Name: -
Path: C:\Program Files\Research In Motion\BlackBerry Enterprise Server\SyncServer\BlackBerrySyncServer.exe
Process identifier: 8736
User account: BESAdmin
User domain: LAN
Service: Yes
RPC server: No
IP version: IPv4
IP protocol: UDP
Port number: 35349
Allowed: No
User notified: No



the Windows Firewall has detected an application listening for incoming traffic.

Name: -
Path: C:\Program Files\Research In Motion\BlackBerry Enterprise Server\AttachServer\BBConvert.exe
Process identifier: 12152
User account: SYSTEM
User domain: NT AUTHORITY
Service: Yes
RPC server: No
IP version: IPv4
IP protocol: UDP
Port number: 35350
Allowed: No
User notified: No

For more information, see Help and Support Center at
11:17:20 am 26-Aug-08

he Windows Firewall has detected an application listening for incoming traffic.

Name: -
Path: C:\Program Files\Research In Motion\BlackBerry Enterprise Server\SyncServer\BlackBerrySyncServer.exe
Process identifier: 8736
User account: BESAdmin
User domain: LAN
Service: Yes
RPC server: No
IP version: IPv4
IP protocol: UDP
Port number: 35351
Allowed: No
User notified: No

For more information, see Help and Support Center at

I fixed the sycn issue, that was unrelated. But seriously, has anyone ever seen this "failure audit" issue?

I see it happening to me now and was hoping to find an answer. If I find one, I'll post back here.

I never found a solution, but really want to. I hate having anything in the event logs that I don't understand. I've been so busy fixing bigger issues on this mess of a network that I haven't looked back at this to much, but would love to hear if you figure anything out!

Those are part of the BES services that needs to run.
You can configure windows firewall to allow those to run.

Is there an FAQ somewhere that says what settings Windows Firewall needs to have for BES? Or do I honestly have to troll my event log 'till I've found them all?

I have no fire wall on my BES.
I do have ISA on the perimiter.