Lost mail - OWA?

Situation: I'm away from the 2003 SBS but have access to it via a PCAnywhere-type program.  I had just upgraded a program on the server and may have inadvertently screwed something up.  I can no longer get into the server using
mail.myserver.net/exchange.  Nor can my PDA send (via the server "access denied") or get mail pushed out to it.

Is this the function of OWA?  I went into Server Management and IIS and I see my server but nothing referring to OWA.  Do i have to reinstall?  Activate?

As I said, I can access and take control of the server so I can make changes.

Please spell it out as for a 3 year old! <g>
FrittersAsked:
Who is Participating?
 
Andrew OakeleyConsultantCommented:
OK you have emailed me with enough information that we have established that the only thing on the C: of your computer is the OF. The exchange files and all your data are on D:

Therefore I recommend we recover from an earlier Acronus image

here is your procedure to fix this.

1. Use Exchange System Manager to "dismount" both the mailbox store and bublic folder store
2. Stop the service "ms exchange information store"
3. check your databases are in "clean Shutdown" state -- important
#> "C:\program files\exchsrvr\bin\exeutil.exe" /mh "d:\program files\exchsrvr\mdbdata\priv1.edb"
#> "C:\program files\exchsrvr\bin\exeutil.exe" /mh "d:\program files\exchsrvr\mdbdata\priv1.edb"
--- check the output to se that the exchange database says "Clean Shutdown"
--- do the same for pub1.edb
Make a copy of the pub1.edb, pub1.stm, priv1.edb, priv1.stm files. If the files are in "clean shutdown" you do not need the transaction log files, but make a copy of them anyway

Boot off the acronius CDROM and restore C: Drive
Boot the server on the recovered drive

Now given that the log files and the database files are on a separate disk to the C: then they might all just mount OK. But if they do not.....
1. Mark the mailbox database and public folder database as "able to be over written by a restore"
2. Stop all the microsoft exchange services
3. Delete all the log files
4. Copy your Clean Shutdown databases from the backup you made earlier into the correct folder
3. Do not do anything with the log files - remember we do not need these if we have a clean shuutdown database. Infact if there are any log files they will corrupt our clean shutdown.
4. Start the exchange services.
5. Exchange should mount and bobs your uncle.
0
 
FrittersAuthor Commented:
Some additional information.  I have only a Self Cert.  I have the PDA set to "Server Uses SSL" and "Search and Accept SSL" and that always worked in the past.  
But this is, I think, more basic since I can't even get a login screen when I go to \\mail.myserver.net/exchange.
0
 
FrittersAuthor Commented:
More info:
I went into Server Management,  Internet and Email Wizard.  I got the expected error regarding not configuring the Router (I had told it to ignore that) but also got an error re configuring the Internet email (the fourth item).  

Also spoke to Trend Micro.  The virus protection is not supposed to have changed email in any way.  Plus, I disabled it and still have the same problem.  So I seem to be down to a configuration of IIS OWA problem?
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
Delphineous SilverwingGood Ol' GeekCommented:
In IIS manager, check and reset your IP settings for the OWA and default sites.  Although the Anti-virus isn't supposed to change e-mail, it will change the bindings on your network adapter - especially if you are using it's firewall.

Speaking of the firewall - did the anti-virus enable it's firewall, resulting in the blockage?  Double check those settings too.
0
 
Jian An LimSolutions ArchitectCommented:
what application you are working on? it looks like it change the IIS settings....
0
 
Andrew OakeleyConsultantCommented:
I think @limjianan is correct in saying try to figure out what the application you installed did to IIS. Maybe created another website using port 80/443 which has stopped the default site? maybe something else.

This KB http://support.microsoft.com/kb/883380 tells you how to recreate the Exchange VDIRS. But it is not going to do you much good if the default website is stopped because something interfered with it.

If you do not understand IIS at all you could post us some screen shots as well as telling us what you installed

0
 
FrittersAuthor Commented:
Sorry for the delay.  
"In IIS manager, check and reset your IP settings for the OWA and default sites."
When I'm in IIS, under the Server Name on the left, the only entry is "FTP Sites (service is disabled)"  (as it should be).  I see no default Web Site, nothing referring to OWA, in short, nothing to check the properties of.

Seems like I need to reconstruct that?
0
 
Jian An LimSolutions ArchitectCommented:
yup. follow the article on id:35696977
0
 
FrittersAuthor Commented:
I followed the article referenced as much as I could.  There was no Default Web Site to Save Configuration of.  Therefore there were no virtual directories.  
I ran the Metabase Explorer and deleted the DS2MB.  Then restarted the MS Exchange System Attendant.
After no change seen, I restarted as directed.
The new IIS is shown attached.  Things were added but there is still no Default Web Site or virtual folders.

Should the Delete and Restart be run again now that there is a Web Site Folder?
What else can I try?

IIS-Image.jpg
0
 
Andrew OakeleyConsultantCommented:
Looks like you somehow deleted the Default Website... We can re-create it or restore a backup of the metabase which would brobably be quicker if you have a backup available.

Right click "Dell1420"
All Tasks
Backup/Restore Configuration
- Hopefully you have some backups from prior to it getting broken (IIS occasionally takes automatic backups).
Restore a backup and restart IIS (or restart server)

0
 
Andrew OakeleyConsultantCommented:
If you do not have a backup and have to recreate it from scratch start with manually recreating the default website
http://www.dotnetscraps.com/dotnetscraps/post/Did-you-know-How-to-recreate-e2809cDefault-Web-Sitee2809d-in-IIS-7-75.aspx 

once you have recreated the site check you can browse to a test file in wwwroot.  If you have an authentication issue you might need to re-sync the IUSR/IWAM passwords.
http://support.microsoft.com/kb/822699 OR http://support.microsoft.com/?id=332167

then delete and recreate the Exchange VDIRS with
http://support.microsoft.com/kb/883380 
0
 
FrittersAuthor Commented:
I manually recreated the default Website.  The instructions about setting the identifier "cscript adsutil.vbs move /w3svc/998577302 /w3svc/1 " generated an error but that apparently was because it was already number 1 ("apppools" was the only thing before in in "enum").  But the result looks like what was desired with Default Web Site being #1.

I was able to browse to wwwroot so didn't seem that doing anything with passwords was necessary.

I then did the "delete and recreate the Exchange VDIRS with http://support.microsoft.com/kb/883380 but I don't see any virtual directories under Default Web site in IIS.

It's been 15 minutes and as per article I'm about to restart the Server.
IIS-Image-2.jpg
0
 
FrittersAuthor Commented:
I've restarted the SBS server.  No change to the above structure.  I'm assuming that I should be seeing 6 virtual directory folders under Default Web Site, yes?

I went into the event viewer. In Applications there is and error:
Metabase Update failed to properly initialize its context. It will retry initialization every 60 seconds until succeeds or shutdown is requested.

That error was then followed by a warning (don't know if it is related in any way)

Event Type:      Warning
Event Source:      WinMgmt
Event Category:      None
Event ID:      5603
Date:            5/8/2011
Time:            10:08:28 AM
User:            NT AUTHORITY\SYSTEM
Computer:      DELL1420
Description:
A provider, PerfProv, has been registered in the WMI namespace, ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the HostingModel property.  This provider will be run using the LocalSystem account.  This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.  Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.  

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


That was and still is then followed repeatedly by:
 Event Type:      Information
Event Source:      MSExchangeMU
Event Category:      General
Event ID:      1046
Date:            5/8/2011
Time:            10:19:43 AM
User:            N/A
Computer:      DELL1420
Description:
Metabase Update agent has determined that Internet Information Services is running in IIS 5 Isolation mode. Exchange Server requires that IIS 6 is using Worker Process Isolation mode. Metabase Update agent will now change the IIS configuration from IIS 5 Isolation mode to Worker Process Isolation mode. During this process, both 'World Wide Web Publishing' and 'HTTP SSL' services will be restarted.

For more information, click http://www.microsoft.com/contentredirect.asp.

What now?
0
 
FrittersAuthor Commented:
In case it's not clear from the image, the Default Web Site is Stopped and I haven't been able to restart it.  Just doesn't respond to the Restart.

Wow.  Now users can't connect to the Outlook Server to get to public folders!

Also, when right click Properties on Default Web Site, I get the mesage "Unable to read the current logging plugin value".

0
 
Andrew OakeleyConsultantCommented:
OK. Sounds like something in the meatbase is corrupt.
- Were there any online backups? even a really old backup?
-

I would delete the default website again and create it again. obviously the exchange VDIRS cannot be re-created if the website is stopped.

Here is an alternate methos for recreting it http://www.it-notebook.org/iis/article/create_default_website.htm 
0
 
FrittersAuthor Commented:
I have Acronis backups of the server.  Not sure if any of those would be of help.  But I don't think that a backup from IIS was ever done.  Didn't show any when I tried went to the create/restore option a few posts ago.

I again deleted and went thru all the steps again.  Still can't start the website.  I don't get any message, just nothing happens.

Next?  
0
 
FrittersAuthor Commented:
I just did a search for Default Web Stopped and found ID:18616133 which makes reference to Apache.  When I got back to the office, I notices that Apache HTTP Server was on the machine and running.  No idea how that happened.  I've since uninstalled that.  However, could Apache have grabbed 443 and/or 80 and still "have" it.  

How do I check and undo that if that's the problem?
0
 
Andrew OakeleyConsultantCommented:
Yes apache would have grabbed port 80 and/or 443 which would have been stopping the default website from starting

from command prompt
# netstat -anb > netstat.txt

then open netstat.txt in notepad will show you every port in use, and what is using it.

0
 
Andrew OakeleyConsultantCommented:
Just as a temporary measure - to see if the website starts - you could change the default website ports to 81 and 4431 that would confirm it is a port conflict. Obviuusly you will need to change them back, but this would be a good test.
0
 
FrittersAuthor Commented:
The only entries containing :443 in Netstat.txt were:

TCP    192.168.1.5:10164      96.7.105.83:443        CLOSE_WAIT      1384
  [coreServiceShell.exe]

  TCP    192.168.1.5:10225      96.7.105.83:443        CLOSE_WAIT      1384
  [coreServiceShell.exe]

  TCP    192.168.1.5:10271      96.7.105.83:443        CLOSE_WAIT      1384
  [coreServiceShell.exe]

No idea what the 96.7 IP address is or whether this indicates that 443 is being used by something else.  

In IIS, I right clicked on Default Web Site/Properties and got the dialog:
Unable to read the Current logging plugin value.
So I can't seem to change anything on the default web site.


Next?
0
 
Andrew OakeleyConsultantCommented:
I would not worry about the remote IP Address. the above means that
coreserviceshell on port 10164 is talking to remote computer 96.7.105.83 on port 443
- so you no longer have anything listening on port 443 on your computer that is good.
- Is anything listining on port 80?

Now that you have removed apache can you delete and recreate the default website correctly using the MS Approved method?
If the MS approved methoed doen not work no - Do these steps work to create the default website http://www.it-notebook.org/iis/article/create_default_website.htm 

I am afraid I have no information on "Unable to read the Current logging plugin value" witth IIS
- obviously fixing this is going to be key to getting everything working again
0
 
FrittersAuthor Commented:
I have already deleted and recreated the default website, 3 times as per ID 35716002 above.  I've made sure I can browse to the root as above, and I've restarted the Microsoft services per the article.

I ahve also made sure that the Default Web Site has an ID number of 1 per site in 35717098 above.

While there are now more folders under the Default Web Site in IIS, I cannot start the Default Web Site.  

As a result, per your earlier post, I can't create virtual directories.

So, I can't start it, I have no virtual directories, my workstations cannot access public folders in Outlook (related, I assume), I can't change the properties of the Default Web Site.

Am I down to a restall of some portion of the SBS 2003?  And if so, what effect on which data/mailboxes/public folders, etc.  

Since there was very little action involving the server while I was away, I'm considering doing a restore from an Acronis backup.  But I'd much rather avoid problems that would be caused by that.

Next?
0
 
Andrew OakeleyConsultantCommented:
I understand your frustration...

I don't understand how you can possibly browse to the root via a browser if the default website is stopped.

Reinstalling IIS on SBS2003 is not a trivial task, and will involve a re-install of MS Exchange along the way (http://support.microsoft.com/kb/320202) so this is not really an option for you.

You could do a "clean shutdown" of exchange, then restore the server via Acronis, and then restore the databases. You may have to resort to this, but lets see if we can't fix it first. I have finished work for the day so I can respond a bit faster to your queries now.

Give me 5 mins to re-review what we have been through.......
0
 
Andrew OakeleyConsultantCommented:
I think you should restore the IIS Metabase from a time prior to the issue occurring.

you have previously stated that there are no online backups available in IIS (Right Click Servername, All tasks, Backup/Restore) so you will have to get a copy from elsewhere.

this technote explains how to restore the metabase from an offline backup (such as tape). Assuming you can explore your Acronis image you should be able to follow the instructions here http://support.microsoft.com/kb/234429 
0
 
Andrew OakeleyConsultantCommented:
BTW - was the program you upgraded on the server Trend Micro? Upgrade to V7 from V6?
0
 
FrittersAuthor Commented:
>>I don't understand how you can possibly browse to the root via a browser if the default website is stopped.<<
It appears I misunderstood the prior instruction "once you have recreated the site check you can browse to a test file in wwwroot.".

I "browsed" using a Windows Explorer-type program rather than IE since the "via a browser" wasn't in the sentence.  <g> See, I told you.... a three year old!

I'll check out the Acronis route and get back to you.
0
 
FrittersAuthor Commented:
I tried following the restore from an offline article.  First confusion was it is referring to IIS Version 5.0.  
IAC, I stopped the services.  I browsed to Windows/system32/inetsrv and lo and behold, there WAS no file Metafile.bin to rename.  Only a Metafile.xml.  So, thinking that that could be the problem i.e. a missing file, or that V6 changed the name, I went to Acronis and searched back thru a months full and incremental backups.  While the backups did, in fact, backup the Inetsvr DIRECTORY, none of the files WITHIN the directory were backed up.

This gets weirder and weirder.

The beginning of the article suggests upgrading to Version 7.  Possible route to a fix? Or is a working system required before an upgrade?
0
 
FrittersAuthor Commented:
Just spoke to TrendMicro.  It appears that the install of Version 7 installed Apache HTTP on the system.  I'm guessing it broke IIS (which is the other option in the install).   They said that removing Apache, which I did, and then uninstalling TM should return the system to where it way.  I'm trying that now.  So, hold up.
0
 
FrittersAuthor Commented:
Uninstall TrendMicro.  Then went thru the entire "delete Web Site, create new one, set property label to 1, etc. etc.  No joy.

Next?  

Am I down to unstalling and reinstalling?  I just want to try to avoid losing the public folder data.  
0
 
FrittersAuthor Commented:
More info:
In Exchange System Manager, I tried to open Public Folders.  I get the message:

The connection was refused. Ensure that your HTTP Virtual servers are all started and check that the WWW service is running.
ID no: c103b401
Exchange System Manager

I went into Services and don't see either such service being listed.  Web Client (no running and manual) was the closest thing.
0
 
FrittersAuthor Commented:
I created a Backup in IIS.  But since there doesn't seem to be any virtual directories listed in Default Web Site, I'm concerned whether the backup would prove to be useable if I uninstalled and reinstalled.  
Where do the items in Public Folders stored and how would I back that up?  And, since I can't even list them when on the server, would they even be backed up?
0
 
FrittersAuthor Commented:
I have started the uninstall and reinstall per MS Article ID: 320202.
Backing up the Metabase, Exchange Store and System State data.
0
 
Andrew OakeleyConsultantCommented:
How old is your acronius backup? is it more than 30 days?

Andrew

0
 
FrittersAuthor Commented:
I have 5 full backups with 5 daily incrementals for each.  Fulls are dated 4/6, 4/12/ 4/18/ 4/24 and 5/1.  

0
 
Andrew OakeleyConsultantCommented:
Is there other data on the sever that you need? or is it only MS Exchange? i.e. user shares? redirected folders?

I am trying to assess the possibility of restoring from a backup for you.
0
 
Andrew OakeleyConsultantCommented:
It is frowned upon, but if we can establish a way of communicating faster I can assist you in getting to a resolution faster. My email address is in my profile.

Asl long as we post the final resolution back here at the end the Mods will not get too upset.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.