On a Windows 2003 server SP1 + Exchange 2003 SP2 + Symanntec mail security for exchange 6 that was running for 2 years now. the server is also a DC. Symantec product was 5.5 and was upgraded a month ago to v6.
starting last week (15/8/2007) the server stops every 18 hours:
Exchange Services although all running inaccessible, the server is logging 1 million error/hour in the App log, and after few hours looses netwrok connectivity, and finally stops responding at all.
Restarting the server gets everything back to normal for again another 18 hours!!!!!!!!!
I suspected a recently installed MS updates, I removed all of them, but the problem is still there.
I ran on the server MBSA and Exchange BPA and got no errors.
The CPU usage is most of the time 100% and sometimes the snmp process is the highest, and sometimes it is the system process.
I tried to stop the services one by one, and the error being logged stopped when the information store service is stopped. However the information store service was not stopped untill I ended the "store.exe" process.
I tried to start the exchange services but did not start, until I stopped the snmp service, only then the exchange services started, but a lot of services did not run the proper way.
The error being logged 1m/hour is:
MSExchangeAL - Event ID 8026 - Category: LDAP operations
LDAP Bind was unsuccessful on directory servername.domainfor distinguished name ''. Directory returned error:[0x51] Server Down.
There are also some errors that the AD is not running.
Other errors are the common 1053 and 1058 errors.
The following errors started before the problem occurred:
Event 1053: Windows cannot determine the user or computer name. (Not enough storage is available to complete this operation. ). Group Policy processing aborted.
Event ID: 2104: Process WMIPRVSE.EXE -EMBEDDING (PID=4724). All the DS Servers in domain are not responding.
event ID: 4096: The Windows system call NetSessionEnum returned an error for server (PDC). Error Code: 31 : A device attached to the system is not functioning.
Event 8355: LDAP Operations: The description for Event ID ( 8355 ) in Source ( MSExchangeAL ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event )server name)
Event 8026: MSExchangeAL/LDAP Operations: LDAP Bind was unsuccessful on directory servername.domainfor distinguished name ''. Directory returned error:[0x51] Server Down.
And then this error is repeated 1m/hour.
Event 2102: MSExchangeDSACCESS/LDAP Operations: Process MAD.EXE (PID=3960). All Domain Controller Servers in use are not responding: