Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 923
  • Last Modified:

Exchange 2013 VM on Hyper-V BSOD

Hi there,

I have 4 VM's 2012 on Hyper-V and Exchange 2013 on them (2 CAS + 2 MBX) i get a BSOD from time to time on all 4 servers. Event log shows only "The computer has rebooted from a bugcheck." The bugcheck was: 0x000000ef
Event ID 1001.

Memory dump can be found here
https://www.dropbox.com/sh/q46vifj4tpyp1vg/AAC93s1lQR-Jvx6cKvL5sw6da?dl=0 

Thanks!
Untitled.png
0
thomaschalmers
Asked:
thomaschalmers
  • 6
  • 5
  • 2
1 Solution
 
VB ITSSpecialist ConsultantCommented:
Have you installed at least Cumulative Update 3 on your Exchange servers? Have a look at this article and see if it applies to you: http://support.microsoft.com/kb/2883203

If it does apply to you, look at upgrading to CU3 at the very least. Ideally though your environment would be up to date (I believe the most current is CU7)
0
 
thomaschalmersAuthor Commented:
Yes, exchange has the most current update CU7 so i don't think article applies...
0
 
VB ITSSpecialist ConsultantCommented:
Have you checked to see if it's the Managed Availability feature that's forcing the server reboots though?

The Managed Availability feature detects issues with your server and in the event of an issue attempts to fix the problematic component. Fixes can range from simple restarts of the component (e.g. restarting the service) to doing a bugcheck.  Bugchecks occur when the earlier simple fixes don't work.

To confirm if Managed Availability is the cause of the bugchecks, run the below command in PowerShell:
(Get-WinEvent -LogName Microsoft-Exchange-ManagedAvailability/* | % {[XML]$_.toXml()}).event.userData.eventXml| ?{$_.ActionID -like "*ForceReboot*"} | ft RequesterName

Open in new window


If you do find that the server is being bugchecked by the ActiveDirectoryConnectivityConfigDCServerReboot responder that's part of the Managed Availability service then run the below command to delay the responder for 60 days:
Add-GlobalMonitoringOverride -Identity Exchange\ActiveDirectoryConnectivityConfigDCServerReboot -ItemType Responder -PropertyName Enabled -PropertyValue 0 -Duration 60.00:00:00

Open in new window

If you would like to do some more reading on the Managed Availability feature you can do so here: http://technet.microsoft.com/en-us/library/dn482056%28v=exchg.150%29.aspx
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
thomaschalmersAuthor Commented:
Thank you for your reply. I have tried that and it look like the ActiveDirectoryConnectivityServerReboot is causing the bugcheck and restart however the property value is not changing with override and stays on 1...
0
 
VB ITSSpecialist ConsultantCommented:
I'm assuming you used the below command to confirm this?
(Get-WinEvent -LogName Microsoft-Exchange-ActiveMonitoring/responderdefinition | % {[XML]$_.toXml()}).event.userData.eventXml | ?{$_.Name -like “ActiveDirectoryConnectivityConfigDCServerReboot"} | ft name,enabled

Open in new window

If the Enabled property is set to 0 then the responder is disabled.

One thing I didn't note is that the override will only be in affect from the date you implement it. To have it override the responder permanently, you can create a global override to apply to specific Exchange build numbers. This way, you don't have to constantly re-run the command every 60 days. The below will implement the override for all Exchange servers running CU7:
Add-GlobalMonitoringOverride -Identity Exchange\ActiveDirectoryConnectivityConfigDCServerReboot -ItemType Responder -PropertyName Enabled -PropertyValue 0 -ApplyVersion “​15.0.1044.25”

Open in new window

To get the build number for your servers, run this command:
Get-ExchangeServer | Select Name, AdminDisplayVersion

Remember to update the override with the new build number when you install the next Cumulative Update.
0
 
VB ITSSpecialist ConsultantCommented:
Sorry, forgot to mention that if you have multiple domain controllers then it's best to force replication, then wait about 10-15 minutes for the Microsoft Exchange Health Manager Service to pick up the override setting.
0
 
thomaschalmersAuthor Commented:
Thanks,

Yes, i tried that command to confirm and it's still on 1. Tried version override as well and same still on 1... :(
override.png
0
 
VB ITSSpecialist ConsultantCommented:
Try forcing AD replication then wait about 10-15 minutes. Re-run the command then to check if the override has taken effect.
0
 
Philip ElderTechnical Architect - HA/Compute/StorageCommented:
Are you seeing clock drift warnings in the logs (blog post on the matter) as well?

If yes, is your PDCe physical or virtual as well?
0
 
Philip ElderTechnical Architect - HA/Compute/StorageCommented:
Download finished.

Mbx and Cas DMP: WinInit.exe
A critical system process died
Arguments:
Arg1: ffffe00191cf2080, Process object or thread object

Both are the same.
0
 
thomaschalmersAuthor Commented:
I had some problems with the access list on the core switch and they are now fixed. Since then there was no reboot or crash of any kind. Could that be the issue from the beginning? No i do not have any clock drifts and all my DC are virtual.
0
 
VB ITSSpecialist ConsultantCommented:
Is the ActiveDirectoryConnectivityServerReboot responder disabled though?
0
 
thomaschalmersAuthor Commented:
No, ActiveDirectoryConnectivityServerReboot is not disabled.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 6
  • 5
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now