Solved

Exchange 2007 Information Store and Service Attendant shutting down

Posted on 2009-04-03
10
2,383 Views
Last Modified: 2012-05-06
We have a single homed Exchange 2007 server with all roles installed.  Over the past two weeks the Information Store service and Service Attendant service have been shutting down in the middle of the night.  I've noticed at about the same time the follow errors (the errors are sequential).  Any suggestions? Memory issues?  I have plenty of available disk space.  The server has 2gigs of physical memory and the page file is set to 4 gig min - 6 gig max.

Event Type:	Information
Event Source:	MSExchange ADAccess
Event Category:	Topology 
Event ID:	2080
Date:		4/3/2009
Time:		3:13:09 AM
User:		N/A
Computer:	"servername"
Description:
Process STORE.EXE (PID=3912). Exchange Active Directory Provider has discovered the following servers with the following characteristics: 
 (Server name | Roles | Enabled | Reachability | Synchronized | GC capable | PDC | SACL right | Critical Data | Netlogon | OS Version) 
In-site:
adserver1.domain.com	CDG 1 7 7 1 0 1 1 0 1
adserver2.domain.com	CDG 1 7 7 1 0 1 1 0 1
 Out-of-site:
 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
Event Type:	Error
Event Source:	MSExchange ADAccess
Event Category:	Topology 
Event ID:	2114
Date:		4/3/2009
Time:		3:13:09 AM
User:		N/A
Computer:	"servername"
Description:
Process STORE.EXE (PID=3912). Topology discovery failed, error 0x80040a02 (DSC_E_NO_SUITABLE_CDC). Look up the Lightweight Directory Access Protocol (LDAP) error code specified in the event description. To do this, use Microsoft Knowledge Base article 218185, "Microsoft LDAP Error Codes." Use the information in that article to learn more about the cause and resolution to this error. Use the Ping or PathPing command-line tools to test network connectivity to local domain controllers.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
Event Type:	Error
Event Source:	MSExchangeFBPublish
Event Category:	General 
Event ID:	8207
Date:		4/3/2009
Time:		3:17:51 AM
User:		N/A
Computer:	"servername"
Description:
Error updating public folder with free/busy information on virtual machine "servername". The error number is 0x80004005.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
Event Type:	Error
Event Source:	MSExchangeSA
Event Category:	General 
Event ID:	9385
Date:		4/3/2009
Time:		3:20:53 AM
User:		N/A
Computer:	"servername"
Description:
Microsoft Exchange System Attendant failed to read the membership of the universal security group '/dc=com/dc="domain"/ou=Microsoft Exchange Security Groups/cn=Exchange Servers'; the error code was '8007203a'. The problem might be that the Microsoft Exchange System Attendant does not have permission to read the membership of the group. 
 
If this computer is not a member of the group '/dc=com/dc="domain"/ou=Microsoft Exchange Security Groups/cn=Exchange Servers', you should manually stop all Microsoft Exchange services, run the task 'add-ExchangeServerGroupMember,' and then restart all Microsoft Exchange services. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
Event Type:	Error
Event Source:	MSExchange Common
Event Category:	General 
Event ID:	4999
Date:		4/3/2009
Time:		3:23:55 AM
User:		N/A
Computer:	"servername"
Description:
Watson report about to be sent to dw20.exe for process id: 4760, with parameters: E12N, c-rtl-AMD64, 08.00.0813.000, mad.exe, RPCRT4.dll, 8475f, c0000005, 6777, 5.2.3790.4115 (srv03_sp2_gdr.070709-2335)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
Event Type:	Information
Event Source:	MSExchange ADAccess
Event Category:	Topology 
Event ID:	2080
Date:		4/3/2009
Time:		3:28:09 AM
User:		N/A
Computer:	"servername"
Description:
Process STORE.EXE (PID=3912). Exchange Active Directory Provider has discovered the following servers with the following characteristics: 
 (Server name | Roles | Enabled | Reachability | Synchronized | GC capable | PDC | SACL right | Critical Data | Netlogon | OS Version) 
In-site:
adserver1.domain.com	CDG 1 7 7 1 0 1 1 7 1
adserver2.domain.com	CDG 1 7 7 1 0 1 1 7 1
 Out-of-site:
 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
Event Type:	Error
Event Source:	.NET Runtime
Event Category:	None
Event ID:	0
Date:		4/3/2009
Time:		3:29:22 AM
User:		N/A
Computer:	"servername"
Description:
The description for Event ID ( 0 ) in Source ( .NET Runtime ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: .NET Runtime version : 2.0.50727.1433 - Application ErrorApplication has generated an exception that could not be handled.
Process ID=0x1448 (5192), Thread ID=0xfd8 (4056).
Click OK to terminate the application.
Click CANCEL to debug the application..
 
Event Type:	Error
Event Source:	MSExchangeIS
Event Category:	General 
Event ID:	9673
Date:		4/3/2009
Time:		3:38:55 AM
User:		N/A
Computer:	"servername"
Description:
An exception with code 0xc00000fd was thrown in module ; some parameters and their values were <Exception address - af54a7>. A significant section of the call stack is in the data section. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
00000: a0 90 81 34 00 00 00 00    4....
00008: ea a5 9e 00 00 00 00 00   ꥞.....
00010: 9b 3d a1 00 00 00 00 00   ›=¡.....
00018: 00 00 00 00 00 00 00 00   ........
00020: 00 00 00 00 00 00 00 00   ........
00028: 09 00 00 00 00 00 00 00   ........
00030: 04 00 00 00 00 00 00 00   ........
00038: fb 7f 00 00 00 00 00 00   û......
00040: 40 72 b8 00 00 00 00 00   @r¸.....
00048: 00 00 00 00 00 00 00 00   ........
There were too many of these addresses to list here
10000: 5b 44 49 41 47 5f 43 54   [DIAG_CT
10008: 58 5d 00 00 16 00 00 00   X]......
10010: ff f0 05 00 00 00 00 00   ÿð......
10018: 00 02 08 00 00 00 3a 67   ......:g
10020: f0 1f fe 00 00 00         ð.þ...  
 
Event Type:	Error
Event Source:	MSExchangeIS
Event Category:	General 
Event ID:	9659
Date:		4/3/2009
Time:		3:38:55 AM
User:		N/A
Computer:	"servername"
Description:
The Microsoft Exchange Information Store encountered an unexpected exception 0xC00000FD at address 0000000000AF54A7 while processing a request for user "username". 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 45 00 63 00 44 00 6f 00   E.c.D.o.
0008: 52 00 70 00 63 00 45 00   R.p.c.E.
0010: 78 00 74 00 32 00 00 00   x.t.2...
0018: 5b 44 49 41 47 5f 43 54   [DIAG_CT
0020: 58 5d 00 00 16 00 00 00   X]......
0028: ff f0 05 00 00 00 00 00   ÿð......
0030: 00 02 08 00 00 00 3a 67   ......:g
0038: f0 1f fe 00 00 00         ð.þ...

Open in new window

0
Comment
Question by:taltomare
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
  • 2
10 Comments
 
LVL 15

Expert Comment

by:zelron22
ID: 24060775
Have you checked this out from the log?

 
If this computer is not a member of the group '/dc=com/dc="domain"/ou=Microsoft Exchange Security Groups/cn=Exchange Servers', you should manually stop all Microsoft Exchange services, run the task 'add-ExchangeServerGroupMember,' and then restart all Microsoft Exchange services.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
If this isn't it, what changed when this started?  Was the server account moved to another OU?  Is DNS set correctly?

Check out this thread.

http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/Q_23048451.html
0
 

Author Comment

by:taltomare
ID: 24060854
What "log" are you referring to?  This server has been running in this domain for about a year.  Is there a way I can check the membership of the server in group?  I've checked all of our documented info about the server and nothing has changed in the past month.  We were going to run the SP1 update this week but since we're having these problems I was holding off from doing this.  DNS is functioning for everything else and nothing has change there.  I'll check the event logs on the DNS server to make sure everything is ok with that.
0
 

Author Comment

by:taltomare
ID: 24061331
Another note to point out is that the exchange server does communicate properly with the AD servers.  Check the first event id in the list and you'll see what I'm talking about.
0
Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

 
LVL 15

Expert Comment

by:zelron22
ID: 24061382
The log I was referring to was the one you posted, and I quoted from it below.

You check the membership by opening up the computer account in AD Users and Computers and look at the Member Of tab.

Is the DNS set up properly on the Exchange server TCP/IP settings?  It should be pointing to (and ONLY to) an AD aware DNS server, generally a domain controller.

0
 

Author Comment

by:taltomare
ID: 24061421
The DNS on the Exchange server should not be pointing directly to the internal DNS server but to an AD server that is pointed to the DNS server?
0
 
LVL 15

Expert Comment

by:zelron22
ID: 24061588
There's two kinds of DNS in the Windows world.  Active Directory aware DNS, and everything else.

I don't know what you mean by "internal DNS server", but if it is NOT an Active Directory aware DNS server, then your Exchange server should not point to it at all.  It should point to an AD DNS server, and then the AD DNS server should be set to forward to the other DNS server, if needed.  

If that doesn't make sense, perhaps you could tell me more about your DNS set up.
0
 

Author Comment

by:taltomare
ID: 24062212
Ok, Yes our internal DNS server is an Active Directory DNS server.  
0
 
LVL 65

Expert Comment

by:Mestha
ID: 24064687
It looks like your server is struggling to see the domain controllers correctly. That causes all the other errors. Therefore I would be looking at that as the cause of the problem - networking for example.

Simon.
0
 

Author Comment

by:taltomare
ID: 24064806
I tested / certified all the cabling involved and changed the port on the network switch that the server is plugged into.  Everything seems to be working in that area.  I even updated the network driver.  Anything else you think I should do to rule out the network connections?
0
 
LVL 65

Accepted Solution

by:
Mestha earned 500 total points
ID: 24069490
It doesn't have to be network connections to that server, it could be the domain controller. Exchange hooks on to a specific DC and doesn't go looking for another DC for 35 minutes if that DC is not available. If you only have one DC that is a GC then Exchange wouldn't have any others to choose from.

Simon.
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
Active Directory security has been a hot topic of late, and for good reason. With 90% of the world’s organization using this system to manage access to all parts of their IT infrastructure, knowing how to protect against threats and keep vulnerabil…
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

710 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question