Link to home
Start Free TrialLog in
Avatar of mlcurry
mlcurryFlag for United States of America

asked on

LDAP bind errors on Exchange 2003 server - some users get kicked out or server goes down.

We are running a single Windows 2000 PDC (used to have Exchange 5.5 on it) called MAIL.  We removed the Exchange 5.5 and setup a new server (MAILSERVER) with Windows 2003 server and installed Exchange 2003 on it.  The MAIL computer is still acting as the PDC for the office.

A few weeks after getting the Exchange 2003 server up and going, it started acting strange and giving TOPOLOGY errors.  Some Exchange and IIS services would then shutdown and no one could get into their Outlook.  

Here are some of the even log errors.  If there is a better way to display them here, please let me know:

FYI:
Exchange Drive = 55GB with 25GB used.

Event Type:      Information
Event Source:      ESE
Event Category:      Online Defragmentation
Event ID:      701
Date:            9/24/2004
Time:            4:00:01 AM
User:            N/A
Computer:      MAILSERVER
Description:
Information Store (3212) First Storage Group: Online defragmentation has completed a full pass on database 'D:\Program Files\Exchsrvr\mdbdata\pub1.edb'.

For more information, click http://www.microsoft.com/contentredirect.asp.

Event Type:      Information
Event Source:      MSExchangeIS Public Store
Event Category:      General
Event ID:      1221
Date:            9/24/2004
Time:            4:00:01 AM
User:            N/A
Computer:      MAILSERVER
Description:
The database "First Storage Group\Public Folder Store (MAILSERVER)" has 11 megabytes of free space after online defragmentation has terminated.

For more information, click http://www.microsoft.com/contentredirect.asp.

Event Type:      Error
Event Source:      MSExchangeDSAccess
Event Category:      Topology
Event ID:      2102
Date:            9/24/2004
Time:            6:35:12 AM
User:            N/A
Computer:      MAILSERVER
Description:
Process MAD.EXE (PID=1468). All Domain Controller Servers in use are not responding:
MAIL.ruleco.com
 

For more information, click http://www.microsoft.com/contentredirect.asp.

Event Type:      Error
Event Source:      MSExchangeDSAccess
Event Category:      Topology
Event ID:      2114
Date:            9/24/2004
Time:            6:35:33 AM
User:            N/A
Computer:      MAILSERVER
Description:
Process MAD.EXE (PID=1468). Topology Discovery failed, error 0x80040a02.

For more information, click http://www.microsoft.com/contentredirect.asp.

Event Type:      Error
Event Source:      MSExchangeSA
Event Category:      General
Event ID:      9154
Date:            9/24/2004
Time:            6:38:13 AM
User:            N/A
Computer:      MAILSERVER
Description:
DSACCESS returned an error '0x80004005' on DS notification. Microsoft Exchange System Attendant will re-set DS notification later.

For more information, click http://www.microsoft.com/contentredirect.asp.

Event Type:      Information
Event Source:      MSExchangeSA
Event Category:      Monitoring
Event ID:      9095
Date:            9/24/2004
Time:            6:40:56 AM
User:            N/A
Computer:      MAILSERVER
Description:
The MAD Monitoring thread is initializing.

For more information, click http://www.microsoft.com/contentredirect.asp.

Event Type:      Information
Event Source:      MSExchangeSA
Event Category:      Monitoring
Event ID:      9096
Date:            9/24/2004
Time:            6:40:56 AM
User:            N/A
Computer:      MAILSERVER
Description:
The MAD Monitoring thread is initialized.

For more information, click http://www.microsoft.com/contentredirect.asp.

Event Type:      Error
Event Source:      MSExchangeAL
Event Category:      LDAP Operations
Event ID:      8026
Date:            9/24/2004
Time:            7:09:53 AM
User:            N/A
Computer:      MAILSERVER
Description:
LDAP Bind was unsuccessful on directory MAIL.ruleco.com for distinguished name ''. Directory returned error:[0x51] Server Down.  DC=ruleco,DC=com

For more information, click http://www.microsoft.com/contentredirect.asp.

Event Type:      Error
Event Source:      MSExchangeDSAccess
Event Category:      Topology
Event ID:      2102
Date:            9/24/2004
Time:            7:10:34 AM
User:            N/A
Computer:      MAILSERVER
Description:
Process MAD.EXE (PID=1468). All Domain Controller Servers in use are not responding:
MAIL.ruleco.com
 

For more information, click http://www.microsoft.com/contentredirect.asp.





Those are the most popular errors.  Yesterday, there was a long streak of these errors though:


Event Type:      Error
Event Source:      MSExchangeSA
Event Category:      RFR Interface
Event ID:      9074
Date:            9/23/2004
Time:            1:11:40 PM
User:            N/A
Computer:      MAILSERVER
Description:
The Directory Service Referral interface failed to service a client request. RFRI is returning the error code:[0x3f0].

For more information, click http://www.microsoft.com/contentredirect.asp.



If anyone needs any more information, please feel free to post it and I will get back to you ASAP.  I am at a loss.

Thanks ahead.

Mike
Avatar of BNettles73
BNettles73

You can safely ignore the informational events 9095, 9096,  701 and 1221 - the 701 and 1221 events are generated during when the maintenance runs and performs the online defrag. This is a pretty routine process.

Did you run /Forestprep and /Domainprep from the Exchange 2003 CD before introducing it in your environment?

Check your DNS settings on the Exchange 2003 server and make sure it only points to an internal DNS server.

Most of the errors look like the server is having a communication problem between DC/GC and Exchange ... you may check the server properties and make sure Exchange is discovering the DC and GC properly ...

Make sure the Domain Controller is also a Global Catalog server ...

Additionally ... run netdiag and dcdiag from the exchange server and make sure everything passes ... if not, then post the results here ...
Avatar of mlcurry

ASKER

Yes, I ran Forestprep and Domainprep.  Then I imported all of the data from PSTs using Exmerge.

Yes, the DNS only points to the DNS server, which is the PDC.

There are no other PDCs on the network, but where can I go anyway to confirm it is a Global Catalog Server?

Where can I go to see that Exchange is discovering the DC and GC properly?  I went to Recipietnt Update Services and confirmed that it was pointed to the MAIL server for the domain. (please excuse the name of the PDC - MAIL, it is no longer the "mail server" as the mail server is actually called MAILSERVER)

I ran NETDIAG:
Per interface results:

    Adapter : Onboard

        Netcard queries test . . . : Passed

        Host Name. . . . . . . . . : MAIL
        IP Address . . . . . . . . : 192.168.0.1
        Subnet Mask. . . . . . . . : 255.255.255.0
        Default Gateway. . . . . . : 192.168.0.253
        Dns Servers. . . . . . . . : 192.168.0.1


        AutoConfiguration results. . . . . . : Passed

        Default gateway test . . . : Passed

        NetBT name test. . . . . . : Passed
            No remote names have been found.

        WINS service test. . . . . : Skipped
            There are no WINS servers configured for this inter


Global results:


Domain membership test . . . . . . : Passed


NetBT transports test. . . . . . . : Passed
    List of NetBt transports currently configured:
        NetBT_Tcpip_{922129FE-E68B-453B-8FB1-7209FBD63473}
    1 NetBt transport currently configured.


Autonet address test . . . . . . . : Passed


IP loopback ping test. . . . . . . : Passed


Default gateway test . . . . . . . : Passed


NetBT name test. . . . . . . . . . : Passed


Winsock test . . . . . . . . . . . : Passed


DNS test . . . . . . . . . . . . . : Passed
    PASS - All the DNS entries for DC are registered on DNS ser
.


Redir and Browser test . . . . . . : Passed
    List of NetBt transports currently bound to the Redir
        NetBT_Tcpip_{922129FE-E68B-453B-8FB1-7209FBD63473}
    The redir is bound to 1 NetBt transport.

    List of NetBt transports currently bound to the browser
        NetBT_Tcpip_{922129FE-E68B-453B-8FB1-7209FBD63473}
    The browser is bound to 1 NetBt transport.


DC discovery test. . . . . . . . . : Passed


DC list test . . . . . . . . . . . : Passed


Trust relationship test. . . . . . : Skipped


Kerberos test. . . . . . . . . . . : Passed


LDAP test. . . . . . . . . . . . . : Passed


Bindings test. . . . . . . . . . . : Passed


WAN configuration test . . . . . . : Skipped
    No active remote access connections.


Modem diagnostics test . . . . . . : Passed

IP Security test . . . . . . . . . : Passed
    IPSec policy service is active, but no policy is assigned.


The command completed successfully

And this is what I got from DCDIAG:


Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\MAIL
      Starting test: Connectivity
         ......................... MAIL passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\MAIL
      Starting test: Replications
         ......................... MAIL passed test Replications
      Starting test: NCSecDesc
         ......................... MAIL passed test NCSecDesc
      Starting test: NetLogons
         ......................... MAIL passed test NetLogons
      Starting test: Advertising
         ......................... MAIL passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... MAIL passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... MAIL passed test RidManager
      Starting test: MachineAccount
         ......................... MAIL passed test MachineAccount
      Starting test: Services
            IsmServ Service is stopped on [MAIL]
            IISADMIN Service is stopped on [MAIL]
            SMTPSVC Service is stopped on [MAIL]
         ......................... MAIL failed test Services
      Starting test: ObjectsReplicated
         ......................... MAIL passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... MAIL passed test frssysvol
      Starting test: kccevent
         ......................... MAIL passed test kccevent
      Starting test: systemlog
         An Error Event occured.  EventID: 0x00000457
            Time Generated: 09/24/2004   10:48:25
            Event String: Driver Xerox Phaser 8400N PS required for printer
         An Error Event occured.  EventID: 0x00000451
            Time Generated: 09/24/2004   10:48:25
            Event String: Printer security information for the printer
         An Error Event occured.  EventID: 0x00000452
            Time Generated: 09/24/2004   10:48:25
            Event String: The printer could not be installed.
         An Error Event occured.  EventID: 0x00000457
            Time Generated: 09/24/2004   10:48:25
            Event String: Driver HP LaserJet 4000 Series PCL6 required for
         An Error Event occured.  EventID: 0x00000451
            Time Generated: 09/24/2004   10:48:25
            Event String: Printer security information for the printer
         An Error Event occured.  EventID: 0x00000452
            Time Generated: 09/24/2004   10:48:25
            Event String: The printer could not be installed.
         ......................... MAIL failed test systemlog

   Running enterprise tests on : ruleco.com
      Starting test: Intersite
         ......................... ruleco.com passed test Intersite
      Starting test: FsmoCheck
         ......................... ruleco.com passed test FsmoCheck



Hope that helps?  Any more advice?  As you can see, some of the services have already stopped by the time I ran this test.

Mike
Avatar of mlcurry

ASKER

Woops - ignore the comment on the services stopped.  SMTP is running on the Exchange server fine, those results above were from the DC.
right click the server in system manager and go to the DSAccess tab ... click on the drop down and go to global catalog and make sure you see your PDC listed ... if not let me know ... I'll be back in 15 minutes or so
Avatar of mlcurry

ASKER

Yes, it has three entries in there and they all say the correct PDC.
If the mail services are stopping then the exchange server is possibly losing connection to the Global Catalog ...


FYI ....  to configure a DC as a GC you can do the following:

To configure a Windows 2000/2003 Domain Controller as a GC server, perform the following steps:
Start the Microsoft Management Console (MMC) Active Directory Sites and Services Manager. (From the Start menu, select Programs, Administrative Tools, Active Directory Sites and Services Manager).
Select the Sites branch.
Select the site that owns the server, and expand the Servers branch.
Select the server you want to configure.
Right-click NTDS Settings, and select Properties.
Select the Global Catalog Server checkbox, which the Screen shows.
Click Apply, OK


Obviously if the services are running then it probably isn't occurring at this time .... you might want to turn up logging on DSAccess and watch the event logs. You can turn up logging by going to the server properties in system manager and then click on Diagnostics Logging.

Have you looked at the event logs on your DC/GC?
Avatar of mlcurry

ASKER

IT is setup correctly as a Global Catalog Server already.

Here is what the event log has a lot of:

Event Type:      Error
Event Source:      MSADC
Event Category:      LDAP Operations
Event ID:      8026
Date:            9/27/2004
Time:            5:56:34 AM
User:            N/A
Computer:      MAIL
Description:
LDAP Bind was unsuccessful on directory MAIL for distinguished name 'administrator'. Directory returned error:[0x51] Server Down.   (Connection Agreement 'RULECO' #2088)

For more information, click http://www.microsoft.com/contentredirect.asp.



There are hundreds of these same messages on the screen.  Does this have something to do with it?
Avatar of mlcurry

ASKER

Here are a few errors we are getting on the Exchange Server (MAILSERVER):
App log.

Event Type:      Error
Event Source:      MSExchangeDSAccess
Event Category:      Topology
Event ID:      2102
Date:            9/27/2004
Time:            11:39:49 AM
User:            N/A
Computer:      MAILSERVER
Description:
Process WMIPRVSE.EXE -EMBEDDING (PID=3868). All Domain Controller Servers in use are not responding:
MAIL.ruleco.com
 

For more information, click http://www.microsoft.com/contentredirect.asp.

Event Type:      Information
Event Source:      MSExchangeDSAccess
Event Category:      General
Event ID:      2078
Date:            9/27/2004
Time:            11:39:43 AM
User:            N/A
Computer:      MAILSERVER
Description:
Process WMIPRVSE.EXE -EMBEDDING (PID=3868). DSAccess is shutting down.

For more information, click http://www.microsoft.com/contentredirect.asp.

Event Type:      Error
Event Source:      MSExchangeDSAccess
Event Category:      Topology
Event ID:      2102
Date:            9/27/2004
Time:            11:37:10 AM
User:            N/A
Computer:      MAILSERVER
Description:
Process INETINFO.EXE (PID=1828). All Domain Controller Servers in use are not responding:
MAIL.ruleco.com
 

For more information, click http://www.microsoft.com/contentredirect.asp.

Any ideas?
Avatar of mlcurry

ASKER

Event Type:      Error
Event Source:      MSExchangeDSAccess
Event Category:      Topology
Event ID:      2102
Date:            9/27/2004
Time:            11:36:31 AM
User:            N/A
Computer:      MAILSERVER
Description:
Process STORE.EXE (PID=3212). All Domain Controller Servers in use are not responding:
MAIL.ruleco.com
 

For more information, click http://www.microsoft.com/contentredirect.asp.
ASKER CERTIFIED SOLUTION
Avatar of BNettles73
BNettles73

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of mlcurry

ASKER

It was a DNS problem.  Found that there was a second DNS listed in the TCP/IP settings of the MAILSERVER computer that was pointing to the external DNS.  Microsoft support pointed this out, after a reboot everything was fine.

We found this out when we pinged the DC through its computer name, it showed up with an external IP address.

Lesson learned: only use the internal DNS (DC in this case) in the IP settings for an Exchange server.

I will give points to BNettles since he was on track with it and tried the hardest.

Thanks BNettles for all your efforsts!

Mike