Microsoft Exchange Event service will not start

Check out this article .. it references Exchange 5.5 (which handled Outlook installed on the server worse than 2K) but it is still relevant ..

http://support.microsoft.com/?kbid=270855

There are numerous reasons that the event service will fail to start.  The first one (which I'm not sure it pertains to you) is that the event service is not supported on a cluster.  Don't have a cluster?  Ok, read on...

The Event service uses a public folder named "EventConfig_<servername>".  If more than one of these folders exist, the service will not start.  Delete ALL instances of this folder in the PF tree and then try to start the service again.

From KB 265397-
"Ensure that the Events.exe process is not running in Task Manager.
In Exchange 2000 System Manager, view system folders.For additional information, click the article number below to view the article in the Microsoft Knowledge Base:
244588 XADM: How to View System Folders in Exchange 2000 Server

Rename one of the instances so that both can be deleted. If you try to delete one while a duplicate exists, you will get a warning informing you that you must rename one of the folders.
Delete both instances of the EventConfig_servername folder.
Restart the Event Service. This recreates a single instance of the EventConfig_servername."


Another possibility is that the account being used to start the service is incorrect.  This service is not configured properly upon installation..  You need to change the account used to run this service to an account that has service account administrator permissions.

HTH,
exx

Outlook on the server? That will cause problems and is not recommended.
Both Outlook and Exchange use MAPI, but there are different versions of the dll. Depending on which was installed first (Exchange or Outlook) will depend on the level of problems that you get. This looks like a MAPI interface error.

Remove Outlook from the server, then re-run Exchange install from the CD, reapply SP3 and rollup patches. That should bring the service back online.

Simon.

I'm telling you, it's the logon account..  This is a quote from KB 277844:

Using Exchange Event Service with Exchange 2000
Exchange Event Service is provided in Exchange 2000 for backward-compatibility with Exchange Server 5.5 event scripts. New applications written specifically for Exchange 2000 should use native Web Storage System Events instead of Exchange Event Service, as described in Exchange 2000 Software Development Kit (SDK). To use Event Service on an Exchange 2000 server, complete the following steps regardless of whether you are upgrading an existing Exchange Server 5.5 computer or installing a new Exchange 2000 server.

To use Exchange Event Service:
In Active Directory Users and Computers, right-click the domain user account under which Event Service will run, and then select Properties.
On the Member Of tab, if Event Service will run on a member server, add the domain account user to the built-in group Administrators. If Event Service runs on a domain controller, add the user to Domain Administrators.
To allow full access to all Exchange resources, add the user to the Exchange Domain Servers group in the server's domain. You can also allow full access to selective Exchange resources by opening the properties of each public and private store where event scripts may be installed, and on the Security tab, grant the user Full Control permissions.
You must also grant Owner permissions to any public folder which contains an event script. You cannot grant ownership permissions on a root folder, such as the default Public Folder node. To grant ownership rights on a specific folder, right-click any folder below the root folder, and then choose Properties. On the Permissions tab, click Client Permissions, select the domain account administrator, and in Roles, select Owner.
Click Start, point to Programs, click Administrative Tools, and then click Services.
Right-click Microsoft Exchange Event Service, and then click Properties.
On the Log On tab, in Logon, type the user name of the account used by Event Service. In Password, type the password.
By default, Event Service is set to Manual startup. To ensure Event Service is always available, set Event Service to Automatic startup by clicking OK.
In Services, right-click Event Service, and then click Start.


Please let me know if this solved your issue.

HTH,
exx

BTW - I have Outlook installed locally on ALL of my Exchange Servers, both 2000 and 5.5, both clustered and standalone, and have yet to have the issues that the gentlemen above describe.  The unexpected MAPI error referenced in your error message is the inability to authenticate....

I've seen numerous times where admins loaded Outlook on the machine and caused the issue .. It's not so bad in later versions of Exchange 2k thru 2k3 but it still can occur.

At a command prompt, type cd %windir%\system32, and then press ENTER.
Type the following commands, and press ENTER after each line:
regsvr32 exchangedir\bin\scripto.dll
regsvr32 exchangedir\bin\ss.dll
regsvr32 exchangedir\bin\esconf.dll

where exchangedir is the directory where Exchange Server is installed (by default, C:\Exchsrvr).
In Control Panel, double-click Services, and then double-click Event Service.

FYI ... straight from KB 212933

SYMPTOMS

If you run the Windows Installer to install Outlook and other Microsoft Office 2000 components on a Microsoft Exchange Server system and subsequently remove the Office 2000 components, the Exchange Event Service will fail to start.

If the server is Windows 2000, the Microsoft Management Console displays the following error:

Could not start the Microsoft Exchange Event Service on Local Computer. The service did not return an error. This could be an internal Windows error or an internal service error. If the problem persists, contact your system administrator.

CAUSE
The removal of Office unregistered a shared server and client library, Esconf.dll. This file is the Microsoft Exchange Event Service Configuration Object Library

RESOLUTION
Manually register the copy of Esconf.dll installed by Exchange Server.   regsvr32 exchangedir\bin\esconf.dll

NOTE: In the scenario described above, there will actually be two copies of Esconf.dll on the server, one installed originally by Exchange Server and the other by Office. The uninstallation of Office removes only the copy that was installed by Office.

Ok, well, I've never tried to REMOVE it before, I've always just installed it and left it there, and everything works fine.

However, like I have said twice already, the Event Service will not run under local system, since localsystem does not have the proper permissions to authenticate to every mailbox.  Believe me..  I went through this EXACT same thing about 4 months ago when I had a need to use the Event Service for the first time..

exx

Wow, fantastic input everyone.

I have re-registered the DLLs before posting here, but I tried it again.  Didn't help.

Outlook has been put on and taken off this machine a couple times, so I wouldn't be surprised if the problem is what several of you mentioned.  However, in order to reload Exchange and re-apply the service packs, I'm going to need to take the server offline, and that can't happen for a couple of days.  I will try it, however.

Finally, exx, I did what you said and created an "exchange_events" user to run the service under.  It still wouldn't start, but, curiously, it spent a LOT more time thinking about it.  It spent about 30 seconds pondering whether or not to start under that service, where it usually rejects my start attempt after two or three seconds.  No idea what that means.

Stay tuned.  I'll clean out Outlook and refresh Exchange from the CDs later this week.  Thanks again for all the input.

After you re-registered the DLL's and tried to start the service ... what error(s) was recorded in the event logs?

Exact same error, down to the same MAPI error code.

The Exchange_events user...  Did it have the proper permissions??  How long did you wait for replication?  When I set mine up, I used an existing account that already had permissions to everything to avoid the replication waiting game...

I know this seems simple ... but your account does have local admin correct? <Don't smack me!!> =)

Elaborate a little...which account?  It was attempting to start under local system, then I created a Domain Admin and Exchange Domain Server account called "exchange_events."  Same problem under either.

You should never need to add a server to the Exchange Domain server group ... and you should not remove any server unless it is decomissioned. By default, when you install exchange it should add the server to the Exchange Domain servers group. This is the default group for computer accounts with assigned perms to public folders, mailboxes etc ... The default group, Exchange Domain Server is not an administrative group used for administering exchange servers.

If you are logged in with an account that has delegated full administrator to exchange - that account should also be a member of the local admins group. If the same account is a member of domain admins it should already have local admin on your server unless you have a custom security configuration.

The account you are logged in with - while trying to troubleshoot, should be a full exchange administrator and a member of the local admin group.

Make any sense?

The accounts needs those permissions to run, period, not just to troubleshoot...

I juat want to verify with everyone what I'm planning to do.  I understand that I'm at my own risk here, but just bear with me a sec.

1.  Backup everything in nauseating detail.

2.  Insert the Exchange 2000 disc from Small Business Server 2000, and run Setup.exe.

3.  Essentially re-install Exchange over itself.

4.  Reapply all installed service packs.

Now, I will backup everything up, but I assume that this will just re-installed the executables and such, and won't touch the Exchange or AD data, so my groups and such will remain intact?

Deane

BNettles73,

(Let me preface this note by pointing out that I'm NOT a system administrator.  I'm an application and database developer at a small company, trying to survive as the default sysadmin, so bear with me...)

Based on the feedback frrom exx, I created a new User in Active Directory Users and Computers.  I told the system NOT to create an Exchange mailbox for the user (not sure if that was the right thing to do...)

The user was a "Domain User" by default, and I added it to the "Domain Admin" and "Exchange Domain Servers" group (it strikes me that this is actually a computer group, but I dutifully followed directions...).

I then went into Services and changed the Microsoft Exchange Events service to log on with this account instead of the Local System Account.

Again, I got the same result when I tried to start the service, but the server did think about it quite a bit longer than usual.  I don't know if that means anything.

Deane

OK ....

The new account should be delegated as Full Exchange Administrator -
Open the Exchange System Manager snap-in in the Microsoft Management Console (MMC).
Right-click Organization Name and click Delegate Control.
Click Next.
Click Add, click Browse, click the user or group that you want to delegate permissions to, and then click OK.
Under Role, click Exchange Full Administrator, and then click OK.
Click Next, and then click Finish to complete the wizard.


Next you should add the account to the local administrator's group of the server and not domain administrator unless you plan on using it for other domain wide administration. I typically add a service account to local admin to tighten security etc ...

The user account definitely does not need to be a member of the Exchange Domain Servers, only the actual computer account of the exchange server. You should not be modifying this group.

After you make the account an Exchange Full Admin and Local Admin - then you can try exx1976's troubleshooting steps ...

Okay, what I did -- just for giggles -- is have the service try to logon as ME.  I know I have access to everything, because I'm a Domain Admin and I've been administrating the thing for 18 months.  Still no luck -- same error.

As for delegating Exchange Full Administrator rights to the account --

I went in to do this, per the excellent instructions above, and found that the Domain Admin group already had this right, which should encompass both me and the exchange_events user I was playing with before.

However, I went ahead and tried to add myself and exchange_events explicitly as Exchange Full Administrators.  I was greeted with this:

"Failed to grant permissions for [Domain]\[User] on this object [LDAP Path]"

Then:

"The delegation wizard could not grant/change permissions for [Domain]\[User]"

Note that this only happened when trying to set Exchange Full Administrator rights.  It would take the other two roles (Exchange Administrator and Exchange View Only Administrator) just fine.

Am I back to the last plan of uninstalling Outlook and re-installing Exchange?

Raising the point value here, given the apparent complexity of the problem and the great help I'm getting.

I would logon to the forest and rerun forest prep ... first you should create a group (for example: Exchange Administrators) and an Exchange Service account to put in the group (example: ExchangeSvc) ... make your exchangesvc account a member of domain admins, schema admins and enterprise admins and then rerun forest prep while logged in as that user (ExchangeSvc) ...

Add your user account to Exchange Administrators group and then once replication occurs ... login as ExchangeSvc and delegate full exchange administrator to your Exchange Admins group.

This should effectively recreate the permissions ...

You can also go back and check the perms and make sure domain admins or any other groups you are in have the "deny" option checked ...

If none of this works ... I'd uninstall outlook and re-register the dlls as mentioned above ... if none of this works, I'd consider uninstalling and redeploying ...


As always, make sure you have a good backup ....

I meant ... logon to the forest root ... lol ... this may be a bit overkill but all I can think about for now! =)

In order to grant someone Exchange Full Admin permissions, you need to be logged on as the user that you were logged in as when Exchange was installed.  This account has these permissions, and is needed when you want to grant this permission to another account...

In Active Directory check to see where the Global Security Groups are for both Exchange Services and Exchange Domain Servers.  If you have moved them out of their default location then it will cause the Exchange Service to fail.  The default location is the User folder.  Exchange does not look any where else in AD for these accounts.

Ummm...  Over 2 months with no comment?  Shouldn't this have been closed by the mods already??

Yeah, I need to close this question.  Here's where we ended up:

I was going to reinstall Exchange over the current install.  However, this is a production server, and I haven't been able to block out the time.

Then, last week, I was presented with a new copy of Small Business Server 2003 and a new server on which to put it, which makes the entire thing moot because I have a new server and a new install.

Still, you guys provided a lot of help and I understand the system better because of it, so I'm going to split the point between the two guys that contributed the most.

Thanks again.

Well, I opened a support ticket with Microsoft on this one.  They had me do a ton of stuff, then said this:

"The Microsoft Exchange Event Service is used to monitor folders and fires events, for Exchange 5.5-compatible server applications. I notice you are using Small Business Server 2000, therefore I suppose you do not have Exchange 5.5 Server in your organization. If this is the case, the Exchange Event Service does not need to start up on your server."

So, the Exchange Event Service is legacy to 5.5.  I eventually got it started anyway using the information on this page:

http://support.microsoft.com/kb/277844

It was an account/permissions problem after all.  I just needed to grant permissions in about 10 different places.