Solved

Can boot SBS 2003 only if Exchange Information Store is disabled

Posted on 2011-03-09
20
539 Views
Last Modified: 2012-05-11
Hi

Perhaps due to forced shutdowns the server is in bad shape. I can only boot it if all exchange services are disabled and then carefully starting those services manually (after changing startup type back to automatic). The last service I start manually is Exchange Information Store. In that way I can have the server working. If I restart the server normally it will freeze to "Applying computer settings" stage.

I have once fixed the Exchange DB (offline Defrag (eseutil \d). It were this EE case:
http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/SBS_Small_Business_Server/Q_25783350.html

The server is not fully WinUpdatet. It may lack last 8 months updates.

There is a Journal Wrap error after rebooting to safe mode:

************************************************************************************************
Event Type:      Error
Event Source:      NtFrs
Event Category:      None
Event ID:      13568
Date:            9.3.2011
Time:            8:49:10
User:            N/A
Computer:      MPKYHP
Description:
The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.
 
 Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
 Replica root path is   : "c:\windows\sysvol\domain"
 Replica root volume is : "\\.\C:"
 A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons.
 
 [1] Volume "\\.\C:" has been formatted.
 [2] The NTFS USN journal on volume "\\.\C:" has been deleted.
 [3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
 [4] File Replication Service was not running on this computer for a long time.
 [5] File Replication Service could not keep up with the rate of Disk IO activity on "\\.\C:".
 Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
 [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
 [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
 
WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.
 
To change this registry parameter, run regedit.
 
Click on Start, Run and type regedit.
 
Expand HKEY_LOCAL_MACHINE.
Click down the key path:
   "System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.
 
If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
************************************************************************************************
 
I'm planning to try to fix the server today after working hours starting at 16.00 GMT +2. Will be at Site then. Any ideas how to carry on? How should I check if there are any problems with disks? Suppose I can't run chkdsk while the server is running and providing services to end users. I’m capable to run pretests if you have any suggestions. Will come back to this forum after 2 hours.

Rgs,

Juha
0
Comment
Question by:RimFire007
20 Comments
 
LVL 74

Accepted Solution

by:
Glen Knight earned 500 total points
ID: 35081303
Sound slike you have an Active Directory and/or DNS issue, this would prevent Exchange from starting and cause a very long delay when booting.

First thing to check, make sure that the server is using only it's own IP address in the DNS properties of the network card.

If it isn't change it so that it is.  Then restart the NETLOGON service.

Can you post the output of DCDIAG and NETDIAG.

Looks like you also have a Journal Wrap issue.

Also follow this guide for resetting the DFS using the Burflags value: http://support.microsoft.com/kb/290762
0
 
LVL 3

Expert Comment

by:perfectpc
ID: 35081305
If you have done a forced shutdown, exchange will usually stick at that point whilst it check the databases are not corrupt. I have had these on sites many times and it can take 45 minutes to an hour to complete before it gives you a login.

Glenn
0
 

Author Comment

by:RimFire007
ID: 35081317
FYI

The max Exchange db size is 75 GB. The Exchange file sizes are now:

priv1.edb 15,5 GB
pub1.edb. 92 MB
priv1.stm 14,4 GB
pub1.stm 210 MB

0
 

Author Comment

by:RimFire007
ID: 35081388
perfectpc:

Aha, if I remember correctly I have waited 1-2 hours to see Ctrl-Alt-Del but because it never came up rebooted the server in the hard way. Any events to monitor to see if it is fixing Exchange DBs?

But in the other hand. This server freezes often (once a week now) propably because Echange. I would love to fix this issue too now. It seems that I lost application logs after freeze last night. The server freeze seems to happen when Exchange tries to maintain the Exchange DB. The server freeze should not be NTbackup related since I NTbackup the server only in the weekends and the total freeze happens between Mon-Fri.
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 35081395
The Exchange DB will not fix itself and hanging on bootup is not a cause of "database checking"

Can you check the details of my post?
0
 

Author Comment

by:RimFire007
ID: 35082384
Thanks demazter:

I can access the server after 30 mins from here. I were at another site. Still planning to fix this today after office hours which will stary after 1 hour 50 min from now.

Rgs, Juha
0
 
LVL 19

Expert Comment

by:R--R
ID: 35082454
Please check if the database is in dirty shutdown. If yes then that is the reason for the late boot.
Go to the exchange mailbox store database and public store database and select do not mount at startup.
Then boot and check if its boot properly.

If the database is in dirty shutdown then you have to run recovery or repair.
0
 

Author Comment

by:RimFire007
ID: 35083133
HI

I'm at Site now. Hera are the DCDIAG and NETDIAG results:


Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests
   
   Testing server: Default-First-Site-Name\MYDOMAINHP
      Starting test: Connectivity
         ......................... MYDOMAINHP passed test Connectivity

Doing primary tests
   
   Testing server: Default-First-Site-Name\MYDOMAINHP
      Starting test: Replications
         ......................... MYDOMAINHP passed test Replications
      Starting test: NCSecDesc
         ......................... MYDOMAINHP passed test NCSecDesc
      Starting test: NetLogons
         ......................... MYDOMAINHP passed test NetLogons
      Starting test: Advertising
         ......................... MYDOMAINHP passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... MYDOMAINHP passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... MYDOMAINHP passed test RidManager
      Starting test: MachineAccount
         ......................... MYDOMAINHP passed test MachineAccount
      Starting test: Services
            IsmServ Service is stopped on [MYDOMAINHP]
         ......................... MYDOMAINHP failed test Services
      Starting test: ObjectsReplicated
         ......................... MYDOMAINHP passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... MYDOMAINHP passed test frssysvol
      Starting test: frsevent
         There are warning or error events within the last 24 hours after the

         SYSVOL has been shared.  Failing SYSVOL replication problems may cause

         Group Policy problems.
         ......................... MYDOMAINHP failed test frsevent
      Starting test: kccevent
         ......................... MYDOMAINHP passed test kccevent
      Starting test: systemlog
         ......................... MYDOMAINHP passed test systemlog
      Starting test: VerifyReferences
         ......................... MYDOMAINHP passed test VerifyReferences
   
   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
   
   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
   
   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
   
   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
   
   Running partition tests on : MYDOMAIN
      Starting test: CrossRefValidation
         ......................... MYDOMAIN passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... MYDOMAIN passed test CheckSDRefDom
   
   Running enterprise tests on : MYDOMAIN.local
      Starting test: Intersite
         ......................... MYDOMAIN.local passed test Intersite
      Starting test: FsmoCheck
         ......................... MYDOMAIN.local passed test FsmoCheck

***********************************************



......................................

    Computer Name: MYDOMAINHP
    DNS Host Name: MYDOMAINhp.MYDOMAIN.local
    System info : Microsoft Windows Server 2003 (Build 3790)
    Processor : x86 Family 6 Model 15 Stepping 11, GenuineIntel
    List of installed hotfixes :
        KB2079403
        KB2115168
        KB2121546
        KB2124261
        KB2141007
        KB2207559
        KB2229593
        KB2259922
        KB2286198
        KB2296011
        KB2296199
        KB2345886
        KB2347290
        KB2360937
        KB2378111
        KB2387149
        KB2416400-IE8
        KB2416451
        KB2423089
        KB2436673
        KB2440591
        KB2443105
        KB2443685
        KB2467659
        KB915800-v9
        KB921503
        KB923561
        KB924667-v2
        KB925398_WMP64
        KB925876
        KB925902
        KB926122
        KB927891
        KB929123
        KB930178
        KB931784
        KB932168
        KB933714
        KB933729
        KB933854
        KB935839
        KB935840
        KB936021
        KB936357
        KB936594
        KB936782
        KB938127
        KB938127-IE7
        KB938464
        KB941202
        KB941568
        KB941569
        KB941644
        KB941672
        KB942615
        KB942763
        KB942830
        KB942831
        KB942840
        KB943055
        KB943460
        KB943484
        KB943485
        KB944338-v2
        KB944533
        KB944653
        KB945553
        KB946026
        KB948496
        KB948590
        KB948745
        KB949014
        KB950762
        KB950974
        KB951066
        KB951072-v2
        KB951698
        KB951746
        KB951748
        KB952004
        KB952069
        KB952954
        KB953298
        KB954155
        KB954211
        KB954550-v5
        KB954600
        KB955069
        KB955759
        KB955839
        KB956263
        KB956390
        KB956391
        KB956572
        KB956744
        KB956802
        KB956803
        KB956841
        KB956844
        KB957095
        KB957097
        KB958215
        KB958469
        KB958644
        KB958687
        KB958869
        KB959426
        KB960225
        KB960714
        KB960803
        KB960859
        KB961063
        KB961118
        KB961371-v2
        KB961501
        KB967715
        KB967723
        KB968389
        KB968537
        KB968816
        KB969059
        KB969805
        KB969883
        KB969947
        KB970238
        KB970430
        KB970483
        KB970653-v3
        KB971032
        KB971468
        KB971486
        KB971513
        KB971557
        KB971633
        KB971657
        KB971737
        KB971961
        KB971961-IE8
        KB972270
        KB973037
        KB973354
        KB973507
        KB973525
        KB973540
        KB973687
        KB973815
        KB973869
        KB973904
        KB973917-v2
        KB974112
        KB974318
        KB974392
        KB974455
        KB974571
        KB975025
        KB975467
        KB975558_WM8
        KB975560
        KB975562
        KB975713
        KB976323
        KB976325-IE7
        KB976662-IE8
        KB977165-v2
        KB977290
        KB977816
        KB977914
        KB978037
        KB978207
        KB978207-IE7
        KB978251
        KB978262
        KB978338
        KB978542
        KB978601
        KB978695
        KB978706
        KB979306
        KB979309
        KB979482
        KB979559
        KB979683
        KB979687
        KB979907
        KB980182-IE7
        KB980195
        KB980218
        KB980232
        KB980436
        KB981322
        KB981332-IE8
        KB981349
        KB981550
        KB981793
        KB982132
        KB982214
        KB982381-IE7
        KB982381-IE8
        KB982632-IE8
        KB982666
        Q147222


Netcard queries test . . . . . . . : Passed



Per interface results:

    Adapter : Server Local Area Connection

        Netcard queries test . . . : Passed

        Host Name. . . . . . . . . : MYDOMAINhp
        IP Address . . . . . . . . : 192.168.100.4
        Subnet Mask. . . . . . . . : 255.255.255.0
        Default Gateway. . . . . . : 192.168.1.1
        Primary WINS Server. . . . : 192.168.100.4
        Dns Servers. . . . . . . . : 192.168.100.4


        AutoConfiguration results. . . . . . : Passed

        Default gateway test . . . : Passed

        NetBT name test. . . . . . : Passed
        [WARNING] At least one of the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names is missing.

        WINS service test. . . . . : Passed


Global results:


Domain membership test . . . . . . : Passed


NetBT transports test. . . . . . . : Passed
    List of NetBt transports currently configured:
        NetBT_Tcpip_{CF2DA773-80AC-461A-BCA0-2A5B04A8A361}
    1 NetBt transport currently configured.


Autonet address test . . . . . . . : Passed


IP loopback ping test. . . . . . . : Passed


Default gateway test . . . . . . . : Passed


NetBT name test. . . . . . . . . . : Passed
    [WARNING] You don't have a single interface with the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names defined.


Winsock test . . . . . . . . . . . : Passed


DNS test . . . . . . . . . . . . . : Passed
    PASS - All the DNS entries for DC are registered on DNS server '192.168.100.4'.


Redir and Browser test . . . . . . : Passed
    List of NetBt transports currently bound to the Redir
        NetBT_Tcpip_{CF2DA773-80AC-461A-BCA0-2A5B04A8A361}
    The redir is bound to 1 NetBt transport.

    List of NetBt transports currently bound to the browser
        NetBT_Tcpip_{CF2DA773-80AC-461A-BCA0-2A5B04A8A361}
    The browser is bound to 1 NetBt transport.


DC discovery test. . . . . . . . . : Passed


DC list test . . . . . . . . . . . : Passed


Trust relationship test. . . . . . : Skipped


Kerberos test. . . . . . . . . . . : Passed


LDAP test. . . . . . . . . . . . . : Passed


Bindings test. . . . . . . . . . . : Passed


WAN configuration test . . . . . . : Skipped
    No active remote access connections.


Modem diagnostics test . . . . . . : Passed

IP Security test . . . . . . . . . : Skipped

    Note: run "netsh ipsec dynamic show /?" for more detailed information


The command completed successfully


***************************

Rgs, Juha
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 35083184
That all looks fine, did you check the MS KB article I posted?
0
 

Author Comment

by:RimFire007
ID: 35083439
Hi demazter

KB seems to be related. Which procedure you suggest will suite to me:

Nonauthoritative restore
or
Authoritative FRS restore?

FYI. I have had problems with deletd users which still seem to exist on some distribution groups.

Rgs, Juha
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 74

Expert Comment

by:Glen Knight
ID: 35083694
Go for the Authoritative FRS restore
0
 

Author Comment

by:RimFire007
ID: 35083736
Hi

Just did Nonauthoritative restore and saw eventid 13516 very soon. Nonauthoritative restore shoud went fine. I disabled Exchange InformationStore and rebooted the server and Journal Wrap error is dissappeared now.

What next?

Rgs, Juha
0
 

Author Comment

by:RimFire007
ID: 35083761
Aha

Notised too late your suggestion to do Authoritative FRS restore. Should I do it next?

Rgs, Juha
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 35083782
Don't worry, if the journal wrap error has gone that should be it.

How is Exchange Stores now? Can you mount them?
0
 

Author Comment

by:RimFire007
ID: 35083965
Ok

I have rebooted the server when Exchange Information Store Service is disabled (and all other Exchange related services set to start automatic). It boots fast. After that I can Start and stop Exchange Information Store service without problems.

I can also mount dismount Mailbox Store and Public Folder Store without problems. I have not tested if I can now just restart the server while Information Exchange Information Store is setup to start automaticly. Should I just test it?

Rgs, Juha
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 35083991
Sounds like a good idea to me ;)
0
 

Author Comment

by:RimFire007
ID: 35084039
Heh,

Lets see what happens. Restarted the server at 17:47 local time.

Rgs, Juha
0
 

Author Comment

by:RimFire007
ID: 35084141
Great!

The server booted up fine. Any other tests I should do? Will drive now to home and continue via VPN if there is anything else to do.

Rgs, Juha
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 35084169
Noohing else to do, I would say it's fixed ;)
0
 

Author Closing Comment

by:RimFire007
ID: 35092230
Thanks demazter

The KB290762 suited to this situation. Also great thanks to demazter for guiding me through this case!

Rgs, Juha
0

Featured Post

Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

Join & Write a Comment

Check out this infographic on what you need to make a good email signature that will work perfectly for your organization.
Scam emails are a huge burden for many businesses. Spotting one is not always easy. Follow our tips to identify if an email you receive is a scam.
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now