iJeff555
asked on
Losing connection to Win2008 DC and Exchange - Event ID 205
I'm having a problem with a DC & Exchange setup. It seems that every night at 03:00 it goes down. After 03:00 I get a bunch of errors in Application and System logs but the first one is this:
Log Name: Application
Source: MSExchange Common
Date: 10/4/2012 3:00:27 pµ
Event ID: 205
Task Category: General
Level: Error
Keywords: Classic
User: N/A
Computer: dc.domain.local
Description:
No DNS servers could be retrieved from network adapter 00000000-0000-0000-0000-00 0000000000 . Check if the computer is connected to a network and Get-NetworkConnectionInfo returns any results.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="MSExchange Common" />
<EventID Qualifiers="49156">205</Ev entID>
<Level>2</Level>
<Task>1</Task>
<Keywords>0x80000000000000 </Keywords >
<TimeCreated SystemTime="2012-04-10T00: 00:27.0000 00000Z" />
<EventRecordID>10030</Even tRecordID>
<Channel>Application</Chan nel>
<Computer>dc.domain.local< /Computer>
<Security />
</System>
<EventData>
<Data>00000000-0000-0000-0 000-000000 000000</Da ta>
</EventData>
</Event>
Any ideas where I should start?
Log Name: Application
Source: MSExchange Common
Date: 10/4/2012 3:00:27 pµ
Event ID: 205
Task Category: General
Level: Error
Keywords: Classic
User: N/A
Computer: dc.domain.local
Description:
No DNS servers could be retrieved from network adapter 00000000-0000-0000-0000-00
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="MSExchange Common" />
<EventID Qualifiers="49156">205</Ev
<Level>2</Level>
<Task>1</Task>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2012-04-10T00:
<EventRecordID>10030</Even
<Channel>Application</Chan
<Computer>dc.domain.local<
<Security />
</System>
<EventData>
<Data>00000000-0000-0000-0
</EventData>
</Event>
Any ideas where I should start?
Also is it working again by the time you get in? You dont need to do anything to get services back up and running?
How many NICs in the exchange server?
How many NICs in the exchange server?
ASKER
Yes, I thought of the backup possibility too, I have a DPM server, it did have a schedule for recovery points at that time (03:00), I changed that to see if it has any relation to the errors.
It's a Hyper-V VM, maybe there was some mix up with the virtual networks so I simplified those too. It's now using only one NIC and one virtual network. At the Hyper-V host I was getting a 4319 error:
Log Name: System
Source: NetBT
Date: 9/4/2012 3:00:04 µµ
Event ID: 4319
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: hyperv.domain.local
Description:
A duplicate name has been detected on the TCP network. The IP address of the computer that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="NetBT" />
<EventID Qualifiers="49152">4319</E ventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000 </Keywords >
<TimeCreated SystemTime="2012-04-09T12: 00:04.6594 20800Z" />
<EventRecordID>2943</Event RecordID>
<Channel>System</Channel>
<Computer>hyperv.domain.lo cal</Compu ter>
<Security />
</System>
<EventData>
<Data>
</Data>
<Binary>000000000100320000 000000DF10 00C0050100 000310A8C0 6800000000 0000000000 0000000000 00</Binary >
</EventData>
</Event>
It's a Hyper-V VM, maybe there was some mix up with the virtual networks so I simplified those too. It's now using only one NIC and one virtual network. At the Hyper-V host I was getting a 4319 error:
Log Name: System
Source: NetBT
Date: 9/4/2012 3:00:04 µµ
Event ID: 4319
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: hyperv.domain.local
Description:
A duplicate name has been detected on the TCP network. The IP address of the computer that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="NetBT" />
<EventID Qualifiers="49152">4319</E
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2012-04-09T12:
<EventRecordID>2943</Event
<Channel>System</Channel>
<Computer>hyperv.domain.lo
<Security />
</System>
<EventData>
<Data>
</Data>
<Binary>000000000100320000
</EventData>
</Event>
ASKER
No, it's not working when I get in. It needs a restart. After that everything is OK.
One NIC on the server. By the way, it's a DC too, DC & Exchange are installed on the same VM.
I also get a "shutting down microsoft echange replication service" message while shutting down which stays on for about 2 minutes or so...
One NIC on the server. By the way, it's a DC too, DC & Exchange are installed on the same VM.
I also get a "shutting down microsoft echange replication service" message while shutting down which stays on for about 2 minutes or so...
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I did but after I switched back to just one NIC on the host and one virtual network. The results with this setup at this time are:
Hyper-V LAN 1:
Node IpAddress: [192.168.16.2] Scope Id: []
NetBIOS Local Name Table
Name Type Status
-------------------------- ---------- ---------
DOMAIN <00> GROUP Registered
HYPERV <00> UNIQUE Registered
HYPERV <20> UNIQUE Registered
\Device\NetBT_Tcpip_{03E1F 6F4-E247-4 7F0-BB51-7 5289CD80E1 5}:
Node IpAddress: [0.0.0.0] Scope Id: []
NetBIOS Local Name Table
Name Type Status
-------------------------- ---------- ---------
DOMAIN <00> GROUP Registered
HYPERV <00> UNIQUE Registered
HYPERV <20> UNIQUE Registered
LAN 3:
Node IpAddress: [0.0.0.0] Scope Id: []
No names in cache
LAN 4:
Node IpAddress: [0.0.0.0] Scope Id: []
No names in cache
--------------
No, the server was not cloned from a physical box.
Hyper-V LAN 1:
Node IpAddress: [192.168.16.2] Scope Id: []
NetBIOS Local Name Table
Name Type Status
--------------------------
DOMAIN <00> GROUP Registered
HYPERV <00> UNIQUE Registered
HYPERV <20> UNIQUE Registered
\Device\NetBT_Tcpip_{03E1F
Node IpAddress: [0.0.0.0] Scope Id: []
NetBIOS Local Name Table
Name Type Status
--------------------------
DOMAIN <00> GROUP Registered
HYPERV <00> UNIQUE Registered
HYPERV <20> UNIQUE Registered
LAN 3:
Node IpAddress: [0.0.0.0] Scope Id: []
No names in cache
LAN 4:
Node IpAddress: [0.0.0.0] Scope Id: []
No names in cache
--------------
No, the server was not cloned from a physical box.
When did this start happening? What changed on your network on that day.
You you have ANY systems or VM's that autostart around that time of day?
You you have ANY systems or VM's that autostart around that time of day?
ASKER
The backup is the first thing that comes to mind that was setup recently.
But let's see if the backup rescheduling or the network changes resolve this today and we'll take it from there I guess.
But let's see if the backup rescheduling or the network changes resolve this today and we'll take it from there I guess.
ASKER
I believe the simplification of the network on the host has resolved the problem. I had no problem for the past 24hours.
But I'll wait a couple more days until I consider this fixed...
But I'll wait a couple more days until I consider this fixed...
ASKER
After a week no problem at all. The simplification of the network on the host has resolved the problem.
Thanks, your answer pointed to the right direction!
Thanks, your answer pointed to the right direction!
Is this a physical or a virtual server?