?
Solved

Exchange Certificate and IIS Problems

Posted on 2011-10-03
19
Medium Priority
?
2,009 Views
Last Modified: 2012-05-12
hi there

i hope someone can urgently help me.
i'm looking after an sbs 2008 with exchange. everything was working up until two days ago and i cant fiigure out what the problem might be. i just know it has something to do with IIS and the security certificate.
the reason why i'm saying this is that even if i'm on the server and i go to IE and type https://127.0.0.1 it brings up the security certificate warning. one can then click on continue (not reccommended) but then nothing happens. normally you can also type in https://127.0.0.1/owa and the exchange web app will open so view mail via internet explorer but even that doesnt work.
this is causing a huge problem for people working outside the lan that connects to the exchange via http and all the people whos blackberries cant connect anymore.

please help if you can

thank you


0
Comment
Question by:stevenvanheerden
  • 11
  • 7
19 Comments
 
LVL 6

Expert Comment

by:Gerald26
ID: 36904990
This does not look like a certificate issue, think the warning page is displayed. 127.0.0.1 is not a name protected by the self-signed certificate.

Try https://<netbios name> or https://<local FQDN> and warning should not appear

The problem you're facing looks like a misconfigured or messy IIS server. First try to reset IIS (cmd /IISRESET) then check the eventlogs (eventvwr) for warnings and error in applications logs.

you can turn on expert logs using this powershell command:
get-eventloglevel | set-eventloglevel -level expert

and back on standard logging with :
get-eventloglevel | set-eventloglevel -level lowest

Tell us more about the errors that appear in event logs

0
 
LVL 24

Expert Comment

by:Radhakrishnan R
ID: 36905019
Have you checked whether your exchange certificate expired? IIS manager>>Select OWA virtual directory>>Properties>>Directory security>>View Certificate and see the date of certificate. Incase if it is expired you need to renew it.

Is outlook working fine?
0
 

Author Comment

by:stevenvanheerden
ID: 36905409
The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again.

Context: Application 'Search', Catalog 'index file on the search server Search'


-------------------------------------

An error has occurred. The problem may resolve itself. The service will retry the operation in 15 minutes. Message:

Unable to create Internet Information Services (IIS) directory entry. Error message is: Server execution failed
. HResult = -2146959355.


----------------------------------------------------------------------------

The start address <sts3s://devvalhot.dyndns.org:987/contentdbid={01409a05-a444-4932-b298-bd625bef8756}> cannot be crawled.

Context: Application 'Search index file on the search server', Catalog 'Search'

Details:
      Error in the Site Data Web Service.   (0x80042616)

-----------------------------------------------


these are 3 of the application logs that i can see that look like it indicates errors



0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 

Author Comment

by:stevenvanheerden
ID: 36905417
Attempting stop...
Internet services successfully stopped
Attempting start...
Restart attempt failed.
The IIS Admin Service or the World Wide Web Publishing Service, or a service dep
endent on them failed to start.  The service, or dependent services, may had an
error during its startup or may be disabled.

this is what happens when i run iisreset
0
 

Author Comment

by:stevenvanheerden
ID: 36905949
hi

i have checked if the any of the certificates have expired, but it all seems to be fine.
the earliest one will expire June next year.
0
 
LVL 6

Expert Comment

by:Gerald26
ID: 36906059
That's what I was expecting. The problem comes from IIS or any service related with it.

Have you modified Sharepoint configuration recently ? Wsus ?
You will see some red 'service control manager' events in eventlogs. There will also be the reason why W3SVC doesnt start. You want to check if a specific dependant service that can not start.

Have you renamed the server / changed admin password during these 2 days ?

Anything else RED in APPLICATIONS logs that appeared 2 days ago ?
0
 

Author Comment

by:stevenvanheerden
ID: 36906121
An error has occurred. The problem may resolve itself. The service will retry the operation in 15 minutes. Message:

Unable to create Internet Information Services (IIS) directory entry. Error message is: Server execution failed
. HResult = -2146959355.

-----------------------------

Process MSExchangeFDS.exe (PID=5752). Failed to read property Path from metabase object IIS://DEVONSRV.devonvalley.local/W3SVC/3/ROOT/OAB. OAB synchronization suspended.


these are the 1st two i see...
0
 

Author Comment

by:stevenvanheerden
ID: 36906128
i havent changed any passwords or the server name...
0
 

Author Comment

by:stevenvanheerden
ID: 36906146
also getting this one, it refers to asp.net


    Machine name: DEVONSRV
 
Process information:
    Process ID: 9272
    Process name: w3wp.exe
    Account name: NT AUTHORITY\NETWORK SERVICE
 
Exception information:
    Exception type: COMException
    Exception message: Access is denied.
 
 
Request information:
    Request URL: https://devvalhot.dyndns.org:987/_vti_bin/sitedata.asmx 
    Request path: /_vti_bin/sitedata.asmx
    User host address: 192.168.10.2
    User:  
    Is authenticated: False
    Authentication Type:  
    Thread account name: NT AUTHORITY\NETWORK SERVICE
 
Thread information:
    Thread ID: 3
    Thread account name: NT AUTHORITY\NETWORK SERVICE
    Is impersonating: False
    Stack trace:    at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
   at System.DirectoryServices.DirectoryEntry.Bind()
   at System.DirectoryServices.DirectoryEntry.get_IsContainer()
   at System.DirectoryServices.DirectoryEntries.ChildEnumerator..ctor(DirectoryEntry container)
   at System.DirectoryServices.DirectoryEntries.GetEnumerator()
   at Microsoft.SharePoint.ApplicationRuntime.SPRequestModule.System.Web.IHttpModule.Init(HttpApplication app)
   at System.Web.HttpApplication.InitModulesCommon()
   at System.Web.HttpApplication.InitInternal(HttpContext context, HttpApplicationState state, MethodInfo[] handlers)
   at System.Web.HttpApplicationFactory.GetNormalApplicationInstance(HttpContext context)
   at System.Web.HttpApplicationFactory.GetApplicationInstance(HttpContext context)
   at System.Web.HttpRuntime.ProcessRequestInternal(HttpWorkerRequest wr)
 
 
Custom event details:
0
 
LVL 6

Expert Comment

by:Gerald26
ID: 36906490
There are several points to check, but I won't be able to help you with anything related to SharePoint.

Let's stop a second on this error:
 Process MSExchangeFDS.exe (PID=5752). Failed to read property Path from metabase object IIS://DEVONSRV.devonvalley.local/W3SVC/3/ROOT/OAB. OAB synchronization suspended

Apparently your OAB virtual directory has been changed or renamed or damaged or the data in Metabase are incorrect. File distribution service fails.

http://technet.microsoft.com/en-us/library/ff360326(EXCHG.140).aspx


what do these command return using exchange powershell ?
get-oabvirtualdirectory
get-owavirtualdirectory

Just in case, do you have a vaild recent system backup ?
0
 

Author Comment

by:stevenvanheerden
ID: 36908033
hi. ok when i run the first command i get this error:


Get-OabVirtualDirectory : Unable to create Internet Information Services (IIS)
directory entry. Error message is: Server execution failed
. HResult = -2146959355.
At line:1 char:23
+ get-oabvirtualdirectory <<<<


and when i do the second one:


Get-OwaVirtualDirectory : Unable to create Internet Information Services (IIS)
directory entry. Error message is: Server execution failed
. HResult = -2146959355.
At line:1 char:23
+ get-owavirtualdirectory <<<<

0
 

Author Comment

by:stevenvanheerden
ID: 36908194
ok, i have run the windows server backup wizard, to restore applications to a week ago.

it restored (Exchange and Windows Sharepoint services)

didnt help, still having the same problem
0
 
LVL 6

Expert Comment

by:Gerald26
ID: 36908339
Hello, sorry about the delay, it was night time and bed called me!

I wasnt talking about restoring Exchange or Sharepoint but only IIS Metabase.
Check if you have a valid backup of %systemroot%\inetsrv. (Do not restore yet !!)
Also check if you have history of modifications made do database in C:\Windows\System32\inetsrv\History

If you dont have any backup of this directory, do one now
Then you will want to get the most recent versions of Metabase.XML AND MBSchema.xml in C:\WINDOWS\system32\inetsrv\History them Metabase.xml and MBSchema.xml, and then copy/paste them into the C:\WINDOWS\system32\inetsrv

That wil rollback IIS configuration in a working state.

Waiting for your comments
0
 
LVL 6

Expert Comment

by:Gerald26
ID: 36908349
If you dont have any backup of this directory, do one now
Then you will want to get the most recent versions of Metabase.XML AND MBSchema.xml in C:\WINDOWS\system32\inetsrv\History them Metabase.xml and MBSchema.xml, and then copy/paste them into the C:\WINDOWS\system32\inetsrv

I know this grammatically means nothing, I moved the words and forgot to erase them in the sentence !

Correct sentence :

Then you will want to get the most recent versions of Metabase.XML AND MBSchema.xml in C:\WINDOWS\system32\inetsrv\History, and then copy/paste them into the C:\WINDOWS\system32\inetsrv
0
 

Author Comment

by:stevenvanheerden
ID: 36908580
hi Gerald

no worries - we get little sleep anyway our IT guys.

thanks for your help so far.

i went to check if i can find a directory in the system root called Inetsrv but there is nothing.

i went into Windows\system32\inetsrv\history and found a few of these xml files dating back to June.

i do run a windows server backup which obviously backs up everything on the server and can be dated back as much as 66 days currently.

i'm not sure why i dont have a c:\inetsrv directory? i have changed the view so that we can see all system and hidden files and directories.

??
0
 
LVL 6

Accepted Solution

by:
Gerald26 earned 2000 total points
ID: 36908636
Do not use c:\inetsrv directories, everything is happening in C:\WINDOWS\SYSTEM32\INETSRV

You dontwant to modify site datas (like pages, scripts and so on) but Metabase (like virutal directories names, security and so on). So it's not a worry if you don't have a c:\inetsrv directory

If your system has not changed a lot since June , you might want to copy current C:\WINDOWS\system32\inetsrv\Metabase.XML AND MBSchema.xml in a safe place and replace them with 2 older files you will find in History. (You will need to rename these files, because in history they looks like metabase_000000_11111.xml and MBDSchema_000000000_11111.xml)


Once again, the whole scenario takes place in C:\windows\system32\inetsrv, not in c;\inetsrv

Once files replaced, restart iis !
Good luck


0
 

Author Comment

by:stevenvanheerden
ID: 36908891
ok, will give it a shot now...

thank you
0
 

Author Closing Comment

by:stevenvanheerden
ID: 36909002
Gerald

great stuff! thanks so much - seems like i can access outlook via the web again.

my client will test and get back to me....really hope it stays fine now.
0
 
LVL 6

Expert Comment

by:Gerald26
ID: 36909333

Makes me happy to see you happy !
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Are you looking for the options available for exporting EDB files to PST? You may be confused as they are different in different Exchange versions. Here, I will discuss some options available.
Exchange administrators are always vigilant about Exchange crashes and disasters that are possible any time. It is quite essential to identify the symptoms of a possible Exchange issue and be prepared with a proper recovery plan. There are multiple…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
This video shows how to quickly and easily deploy an email signature for all users in Office 365 and prevent it from being added to replies and forwards. (the resulting signature is applied on the server level in Exchange Online) The email signat…
Suggested Courses

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question