Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Information store service stops for no reason

Posted on 2004-11-09
10
Medium Priority
?
312 Views
Last Modified: 2011-09-20
Small Business Server SP4 with Exchgange server SP3

Repairs and fixed 6 weeks ago and has been running fine with no problems till last weekend

At 6am Sunday morning the information store service stopped,  There were no other errors.  Restarted manually on Monday morning with no problems.

Happened again this moring at 6am.  Restarted manually with no problems

How can i stop this happening?
0
Comment
Question by:jimcrint
  • 6
  • 4
10 Comments
 
LVL 104

Expert Comment

by:Sembee
ID: 12539755
The store doesn't just stop for no reason. Something is causing it.
Look through the event logs to see if there is anything Exchange related around that time.
How big is your Exchange database?

Simon.
0
 
LVL 1

Author Comment

by:jimcrint
ID: 12540015
This error was reported at 4:07 in the application log

Event Type:      Error
Event Source:      MSExchangeDSAccess
Event Category:      Topology
Event ID:      2102
Date:            10/11/2004
Time:            4:07:42 a.m.
User:            N/A
Computer:      SBS
Description:
Process MAD.EXE (PID=2080). All Domain Controller Servers in use are not responding:

This was followed at same time with "MAD process is initializing: also at 4:07

This error is reported in the system log
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7031
Date:            10/11/2004
Time:            6:13:22 a.m.
User:            N/A
Computer:      SBS
Description:
The Microsoft Exchange Information Store service terminated unexpectedly.  It has done this 2 time(s).  The following corrective action will be taken in 0 milliseconds: No action.

0
 
LVL 104

Expert Comment

by:Sembee
ID: 12540082
Had to be 7031.
There are about 100 reasons why the store will stop. Unfortunately it is gone midnight here (in the UK), so I will point you to a source of many of the reasons, as I didn't want to leave you with nothing:

http://www.eventid.net/display.asp?eventid=7031&eventno=465&source=Service%20Control%20Manager&phase=1

Specifically look at this list of Q articles at Microsoft, and a couple of the others in that page.

- Service: Microsoft Exchange Information Store - See Q317482, Q814924, Q822949, Q824467, Q831276, Q835437, and Q842000.

To view the ariticles, change the number in the link below, dropping the Q:
http://support.microsoft.com/?kbid=317482

If you think you have found something, post back.

Simon.
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
LVL 1

Author Comment

by:jimcrint
ID: 12540448
had a look at these articles, most are fixed with post SP3 which i had already installed.  The only other issue related to Norton Corporate whic i am running but the exchange version.

I have set the service to restart as sugested in the first article and will monitor it the next few days
0
 
LVL 1

Author Comment

by:jimcrint
ID: 12548153
yesterday it stopped at 6:13
This morning it stopped again at 6:03

There is nothing else of note in the event logs

Other errors I can see however

Schedular is not remembering passwords and scheduled evenst like backup are not occuring
There is also a warning about a lack of synchronisation within AD, when I explore this it seems to be related to the power user.

Some history
I did s ome repairs 6 weeks ago which involved a repair of SBS, reinstall SP4 and SP 3 for exchange.  Lost the SYS VOL directory, was also not in the backup so it had been gone for a while.  Rebuilt this manually and every thing seems to be working except for this warning

Event Type:      Warning
Event Source:      SceCli
Event Category:      None
Event ID:      1202
Date:            9/11/2004
Time:            4:20:05 p.m.
User:            N/A
Computer:      SBS
Description:
Security policies are propagated with warning. 0x534 : No mapping between account names and security IDs was done.

For best results in resolving this event, log on with a non-administrative account and search http://support.microsoft.com for "troubleshooting 1202 events".
A user account in one or more Group policy objects (GPOs) could not be resolved to a SID. This error is possibly caused by a mistyped nor deleted user account referenced in either the User Rights or Restricted Groups branch of a GPO.  To resolve this event, contact an administrator in the domain to perform the following actions:

1.Identify accounts that could not be resolved to a SID: From the command prompt, type: FIND /I "Cannot find" %SYSTEMROOT%\Security\Logs\winlogon.log
The string following "Cannot find" in the FIND output identifies the problem account names.
Example: Cannot find JohnDough.
In this case, the SID for username "JohnDough" could not be determined. This most likely occurs because the account was deleted, renamed, or is spelled differently (e.g. "JohnDoe").

2.Identify the GPOs that contain the unresolvable account name:
From the command prompt type FIND /I "JohnDough" %SYSTEMROOT%\Security\templates\policies\gpt*.*
      The output of the FIND command will resemble the following:
      ---------- GPT00000.DOM
      ---------- GPT00001.DOM
      SeRemoteShutdownPrivilege=JohnDough
      This indicates that of all the GPO’s being applied to this machine,  the unresolvable account exists only in one GPO.  Specifically, the cached GPO named GPT00001.DOM.
      Now we need to determine the friendly name of this GPO in the next step.

3. Locate the friendly names of each of the GPOs that contain an unresolvable account name.  These GPOs were identified in the previous step.
From the command prompt, type: FIND /I "[Mapping]" %SYSTEMROOT%\Security\Logs\winlogon.log
      The string following "[Mapping] gpt0000?.dom =" in the FIND output identifies the friendly names for all GPO’s being applied to this machine.
      Example: [Mapping] gpt00001.dom = User Rights Policy
      In this case, the GPO that contains the unresolvable account (gpt00001.dom) has a friendly name of "User Rights Policy".

4. Remove unresolved accounts from each GPO that contains an unresolvable account.
      a. Start -> Run -> MMC.EXE
      b. From the File menu select "Add/Remove Snap-in…"
      c. From the "Add/Remove Snap-in" dialog box select "Add…"
      d. In the "Add Standalone Snap-in" dialog box select "Group Policy" and click "Add"
      e. In the "Select Group Policy Object" dialog box click the "Browse" button.
      f. On the "Browse for a Group Policy Object" dialog box choose the "All" tab
      g. Right click on the first policy identified in step 3 and choose edit
      h.      Review each setting under Computer Configuration/ Windows Settings/ Security Settings/ Local Policies/ User Rights
       Assignment or Computer Configuration/ Windows Settings/ SecuritySettings/ Restricted Groups for accounts identified in step 1.
      i. Repeat steps 3g and 3h for all subsequent GPOs identified in step 3.
the account in quextioni s the power user
0
 
LVL 104

Expert Comment

by:Sembee
ID: 12549087
I don't think that error would cause the store to stop.
Is anything happening elsewhere on the server around that time? Antivirus scan for example?

Simon.
0
 
LVL 1

Author Comment

by:jimcrint
ID: 12549609
Virus scan runs at 1 am on Sunday but is finished within an hour and did not run the last 2 days.  

I can not see any thing else that is running at that time.
0
 
LVL 1

Author Comment

by:jimcrint
ID: 12612126
I am desparate for some solutions to this problem.  I have monitored it all week and the store stops between 6 and 6:15 in the morning.

Is there any monitoriing I can set up that will help me isolate the problem?

Is there a command line switch that will enable me a scheduled restart of the information store at 6:30 every morning?
0
 
LVL 104

Accepted Solution

by:
Sembee earned 2000 total points
ID: 12616499
Having to restart the information store isn't really a valid solution. Something is interfering with the operation of the store.

If it was my server I would strip everything but Exchange out. AV, Antispam, any other application that wasn't installed with Exchange from the CD. Something has to be running at that point but only by stripping the server out can you even start to isolate what is happening.

Simon.
0
 
LVL 1

Author Comment

by:jimcrint
ID: 14057454
My scipt worked OK but I am upgrading to 2003 now so that will solve all problems
0

Featured Post

Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Steps to fix error: “Couldn’t mount the database that you specified. Specified database: HU-DB; Error code: An Active Manager operation fail”
Mailbox Corruption is a nightmare every Exchange DBA wishes he never has. Recovering from it can be super-hectic if not entirely futile. And though techniques like the New-MailboxRepairRequest cmdlet have been designed to help with fixing minor corr…
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…
Suggested Courses

564 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question