Active Directory and Exchange 2013 Communication Issues??

Infinity Solutions
Infinity Solutions used Ask the Experts™
on
Recently we have been having some issues with our 2013 Exchange.

Every now and then throughout the day, our exchange will go through a small period of 10-15 minutes where it locks up a bunch of mailboxes causing them to longer have connectivity to the exchange. When we checked the Event Viewer, we noticed a lot of application errors going on. They Event IDs are 4023, 1006, 12023, 2119, 2142, and 12014.

The 4023 Error ID probably is the most common of the errors we are receiving. This event seems to always be related to some sort of mobile device and tells us that it is locked out for X amount of time.

The 1006 Error ID talks about how the performance counter in megabytes has sustained a value of '240.00' for the 15 minute interval.

The 12023 Warning ID says that ecchange could not load the certificate thumbprint of xxx from the personal store on the local computer.

The 2119 Error ID says Error DNS_ERROR_RCODE_NAME_ERROR occured when DNS was queried for the service location resource record used to locate a domain controller for domain [domain_name].

The 2142 Error ID  lets me know that the topology discovery failed. and that no suitable directory servers wer found in the domain forest.

-----

I cannot tell if these errors are relevant or related. I just know these events pop up everywhere in the event viewer around the time that exchange decides to kick all the users out.

We only have one active directory (also the GC) and only one exchange server.
----
I will be happy to fill in any missing information that may be required to help troubleshoot. Thanks for any guidance.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Is this a physical or a virtual Exchange server? Whats the patch level (CU xx)
Can you check with perfmon if there is a bottleneck regarding CPU/RAM or disk?

Please post all the details (source, details) of the error events you're seeing…
Infinity SolutionsData, Voice, Internet Services

Author

Commented:
It is happening right now so I am able to get a better idea of what Events are needing to be mentioned..

We get the event 1006 and 12014 about once every 10 or so minutes.


Log Name:      Application
Source:        MSExchangeDiagnostics
Date:          7/16/2019 10:58:35 AM
Event ID:      1006
Task Category: Triggers
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      hostexch1.HostExch.local
Description:
The performance counter '\\HOSTEXCH1\LogicalDisk(HarddiskVolume1)\Free Megabytes' sustained a value of '239.00', for the '15' minute(s) interval starting at '7/16/2019 3:41:00 PM'. Additional information: None. Trigger Name:DatabaseDriveSpaceTrigger. Instance:harddiskvolume1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeDiagnostics" />
    <EventID Qualifiers="49156">1006</EventID>
    <Level>2</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-07-16T15:58:35.000000000Z" />
    <EventRecordID>23671834</EventRecordID>
    <Channel>Application</Channel>
    <Computer>hostexch1.HostExch.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\\HOSTEXCH1\LogicalDisk(HarddiskVolume1)\Free Megabytes</Data>
    <Data>239.00</Data>
    <Data>15</Data>
    <Data>7/16/2019 3:41:00 PM</Data>
    <Data>None</Data>
    <Data>DatabaseDriveSpaceTrigger</Data>
    <Data>harddiskvolume1</Data>
  </EventData>
</Event>




Log Name:      Application
Source:        MSExchangeTransport
Date:          7/16/2019 10:43:03 AM
Event ID:      12014
Task Category: TransportService
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      hostexch1.HostExch.local
Description:
Microsoft Exchange could not find a certificate that contains the domain name hostexch.isnetworking.com in the personal store on the local computer. Therefore, it is unable to support the STARTTLS SMTP verb for the connector outbound with a FQDN parameter of hostexch.isnetworking.com. If the connector's FQDN is not specified, the computer's FQDN is used. Verify the connector configuration and the installed certificates to make sure that there is a certificate with a domain name for that FQDN. If this certificate exists, run Enable-ExchangeCertificate -Services SMTP to make sure that the Microsoft Exchange Transport service has access to the certificate key.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeTransport" />
    <EventID Qualifiers="49156">12014</EventID>
    <Level>2</Level>
    <Task>12</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-07-16T15:43:03.000000000Z" />
    <EventRecordID>23671685</EventRecordID>
    <Channel>Application</Channel>
    <Computer>hostexch1.HostExch.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>hostexch.isnetworking.com</Data>
    <Data>outbound</Data>
  </EventData>
</Event>


---------------


Then we get hit with an error code 2119 & 2142 simultaneously. After the first 2119 error we get a bunch of 2142's accompanied by a 2107 warning.



Source:        MSExchange ADAccess
Date:          7/16/2019 11:26:06 AM
Event ID:      2119
Task Category: Topology
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      hostexch1.HostExch.local
Description:
Process Microsoft.Exchange.Directory.TopologyService.exe (PID=16428). Error DNS_ERROR_RCODE_NAME_ERROR (0x8007232B) occurred when DNS was queried for the service location (SRV) resource record used to locate a domain controller for domain HostExch.local
 The query was for the SRV record for _ldap._tcp.dc._msdcs.HostExch.local
 Common causes of this error include the following:
 - The DNS SRV records required to locate a domain controller for the domain are not registered in DNS. These records are registered with a DNS server automatically when a domain controller is added to a domain. They are updated by the domain controller at set intervals. This computer is configured to use DNS servers with following IP addresses:
fec0:0:0:ffff::1Microsoft.Exchange.Directory.TopologyService.exe
fec0:0:0:ffff::2Microsoft.Exchange.Directory.TopologyService.exe
fec0:0:0:ffff::3Microsoft.Exchange.Directory.TopologyService.exe
208.61.202.220
208.61.202.20

 - One or more of the following zones do not include delegation to its child zone:
HostExch.local
local
. (the root zone)

         
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchange ADAccess" />
    <EventID Qualifiers="49156">2119</EventID>
    <Level>2</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-07-16T16:26:06.000000000Z" />
    <EventRecordID>23672096</EventRecordID>
    <Channel>Application</Channel>
    <Computer>hostexch1.HostExch.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Microsoft.Exchange.Directory.TopologyService.exe</Data>
    <Data>16428</Data>
    <Data>8007232B</Data>
    <Data>HostExch.local</Data>
    <Data>_ldap._tcp.dc._msdcs.HostExch.local</Data>
    <Data>fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
208.61.202.220
208.61.202.20
</Data>
    <Data>HostExch.local
local
. (the root zone)
</Data>
  </EventData>
</Event>




Log Name:      Application
Source:        MSExchange ADAccess
Date:          7/16/2019 11:27:04 AM
Event ID:      2107
Task Category: Topology
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      hostexch1.HostExch.local
Description:
Process Microsoft.Exchange.Directory.TopologyService.exe (PID=16428). Exchange Active Directory Provider failed to obtain an IP address for DS server hostexchdc.HostExch.local, error 11001 (No such host is known).  This host will not be used as a DS server by Exchange Active Directory Provider.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchange ADAccess" />
    <EventID Qualifiers="32772">2107</EventID>
    <Level>3</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-07-16T16:27:04.000000000Z" />
    <EventRecordID>23672158</EventRecordID>
    <Channel>Application</Channel>
    <Computer>hostexch1.HostExch.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Microsoft.Exchange.Directory.TopologyService.exe</Data>
    <Data>16428</Data>
    <Data>hostexchdc.HostExch.local</Data>
    <Data>11001</Data>
    <Data>No such host is known</Data>
  </EventData>
</Event>


----------


We then get an error code 22 which is followed by errors 2077, 2142, 10006 and 2454




Log Name:      Application
Source:        MSExchange RBAC
Date:          7/16/2019 11:29:05 AM
Event ID:      22
Task Category: RBAC
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      hostexch1.HostExch.local
Description:
(Process w3wp.exe, PID 19108) "Exchange AuthZPlugin Fails to finish method AuthorizeUser due to the transient error: Microsoft.Exchange.Data.Directory.ADTransientException: Could not find any available Global Catalog in forest HostExch.local.
   at Microsoft.Exchange.Data.Directory.ConnectionPoolManager.GetConnection(ConnectionType connectionType, String partitionFqdn, ADObjectId domain, String serverName, Int32 port, NetworkCredential credential)
   at Microsoft.Exchange.Data.Directory.ConnectionPoolManager.GetConnection(ConnectionType connectionType, String partitionFqdn)
   at Microsoft.Exchange.Data.Directory.ADDataSession.GetConnection(String preferredServer, Boolean isWriteOperation, String optionalBaseDN, ADObjectId& rootId, ADScope scope)
   at Microsoft.Exchange.Data.Directory.ADDataSession.GetReadConnection(String preferredServer, String optionalBaseDN, ADObjectId& rootId, ADRawEntry scopeDeteriminingObject, DualSearchMode dualSearchMode)
   at Microsoft.Exchange.Data.Directory.ADGenericReader.GetNextResultCollection(Type controlType, DirectoryControl& responseControl)
   at Microsoft.Exchange.Data.Directory.ADPagedReader`1.GetNextResultCollection()
   at Microsoft.Exchange.Data.Directory.ADGenericPagedReader`1.GetNextPage()
   at Microsoft.Exchange.Data.Directory.ADGenericPagedReader`1.<GetEnumerator>d__0.MoveNext()
   at Microsoft.Exchange.Data.Directory.Recipient.ADRecipientObjectSession.FindMiniRecipientBySid[TResult](SecurityIdentifier sId, IEnumerable`1 properties)
   at Microsoft.Exchange.Configuration.Authorization.ExchangeAuthorizationPlugin.FindUserEntry(SecurityIdentifier userSid, WindowsIdentity windowsIdentity, SerializedIdentity serializedIdentity, PartitionId partitionId)
   at Microsoft.Exchange.Configuration.Authorization.ExchangeAuthorizationPlugin.TryFindUserByWsManSenderDetails(WsManSenderDetails wsManSenderDetails, ADRawEntry& userEntry, AuthZAuthenticationType& authenticationType)
   at Microsoft.Exchange.Configuration.Authorization.ExchangeAuthorizationPlugin.GetAuthZPluginUserToken(WsManSenderDetails wsManSenderDetails, Boolean canUseCache, AuthZPluginUserToken& userToken)
   at Microsoft.Exchange.Configuration.Authorization.ExchangeAuthorizationPlugin.<>c__DisplayClass1.<AuthorizeUser>b__0()
   at Microsoft.Exchange.Configuration.Authorization.AuthZLogHelper.HandleExceptionAndRetry[T](String methodName, Func`1 func, Boolean throwException, T defaultReturnValue)"
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchange RBAC" />
    <EventID Qualifiers="49152">22</EventID>
    <Level>2</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-07-16T16:29:05.000000000Z" />
    <EventRecordID>23672248</EventRecordID>
    <Channel>Application</Channel>
    <Computer>hostexch1.HostExch.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>w3wp.exe</Data>
    <Data>19108</Data>
    <Data>AuthorizeUser</Data>
    <Data>Microsoft.Exchange.Data.Directory.ADTransientException: Could not find any available Global Catalog in forest HostExch.local.
   at Microsoft.Exchange.Data.Directory.ConnectionPoolManager.GetConnection(ConnectionType connectionType, String partitionFqdn, ADObjectId domain, String serverName, Int32 port, NetworkCredential credential)
   at Microsoft.Exchange.Data.Directory.ConnectionPoolManager.GetConnection(ConnectionType connectionType, String partitionFqdn)
   at Microsoft.Exchange.Data.Directory.ADDataSession.GetConnection(String preferredServer, Boolean isWriteOperation, String optionalBaseDN, ADObjectId&amp; rootId, ADScope scope)
   at Microsoft.Exchange.Data.Directory.ADDataSession.GetReadConnection(String preferredServer, String optionalBaseDN, ADObjectId&amp; rootId, ADRawEntry scopeDeteriminingObject, DualSearchMode dualSearchMode)
   at Microsoft.Exchange.Data.Directory.ADGenericReader.GetNextResultCollection(Type controlType, DirectoryControl&amp; responseControl)
   at Microsoft.Exchange.Data.Directory.ADPagedReader`1.GetNextResultCollection()
   at Microsoft.Exchange.Data.Directory.ADGenericPagedReader`1.GetNextPage()
   at Microsoft.Exchange.Data.Directory.ADGenericPagedReader`1.&lt;GetEnumerator&gt;d__0.MoveNext()
   at Microsoft.Exchange.Data.Directory.Recipient.ADRecipientObjectSession.FindMiniRecipientBySid[TResult](SecurityIdentifier sId, IEnumerable`1 properties)
   at Microsoft.Exchange.Configuration.Authorization.ExchangeAuthorizationPlugin.FindUserEntry(SecurityIdentifier userSid, WindowsIdentity windowsIdentity, SerializedIdentity serializedIdentity, PartitionId partitionId)
   at Microsoft.Exchange.Configuration.Authorization.ExchangeAuthorizationPlugin.TryFindUserByWsManSenderDetails(WsManSenderDetails wsManSenderDetails, ADRawEntry&amp; userEntry, AuthZAuthenticationType&amp; authenticationType)
   at Microsoft.Exchange.Configuration.Authorization.ExchangeAuthorizationPlugin.GetAuthZPluginUserToken(WsManSenderDetails wsManSenderDetails, Boolean canUseCache, AuthZPluginUserToken&amp; userToken)
   at Microsoft.Exchange.Configuration.Authorization.ExchangeAuthorizationPlugin.&lt;&gt;c__DisplayClass1.&lt;AuthorizeUser&gt;b__0()
   at Microsoft.Exchange.Configuration.Authorization.AuthZLogHelper.HandleExceptionAndRetry[T](String methodName, Func`1 func, Boolean throwException, T defaultReturnValue)</Data>
  </EventData>
</Event>






Log Name:      Application
Source:        MSExchange ADAccess
Date:          7/16/2019 11:30:23 AM
Event ID:      2454
Task Category: Exchange Topology
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      hostexch1.HostExch.local
Description:
Process MSExchangeSubmission.exe (PID=3284). Failed to reissue notifications. Error:Microsoft.Exchange.Data.Directory.ADTransientException: Could not find any available Domain Controller.
   at Microsoft.Exchange.Data.Directory.ConnectionPoolManager.GetConnection(ConnectionType connectionType, String partitionFqdn, ADObjectId domain, String serverName, Int32 port, NetworkCredential credential)
   at Microsoft.Exchange.Data.Directory.ConnectionPoolManager.GetConnection(ConnectionType connectionType, String partitionFqdn)
   at Microsoft.Exchange.Data.Directory.ADNotificationListener.TryIssueNotificationRequests(List`1 notificationRequest)
   at Microsoft.Exchange.Data.Directory.ADNotificationListener.ReissueNotificationRequests(Boolean throwOnFailure, Boolean reissueIfListening)
   at Microsoft.Exchange.Data.Directory.ConnectionPoolManager.<>c__DisplayClass8.<RebuildNonPartitionScopedConnectionPoolManager>b__6()
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchange ADAccess" />
    <EventID Qualifiers="49156">2454</EventID>
    <Level>2</Level>
    <Task>9</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-07-16T16:30:23.000000000Z" />
    <EventRecordID>23672312</EventRecordID>
    <Channel>Application</Channel>
    <Computer>hostexch1.HostExch.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>MSExchangeSubmission.exe</Data>
    <Data>3284</Data>
    <Data>Microsoft.Exchange.Data.Directory.ADTransientException: Could not find any available Domain Controller.
   at Microsoft.Exchange.Data.Directory.ConnectionPoolManager.GetConnection(ConnectionType connectionType, String partitionFqdn, ADObjectId domain, String serverName, Int32 port, NetworkCredential credential)
   at Microsoft.Exchange.Data.Directory.ConnectionPoolManager.GetConnection(ConnectionType connectionType, String partitionFqdn)
   at Microsoft.Exchange.Data.Directory.ADNotificationListener.TryIssueNotificationRequests(List`1 notificationRequest)
   at Microsoft.Exchange.Data.Directory.ADNotificationListener.ReissueNotificationRequests(Boolean throwOnFailure, Boolean reissueIfListening)
   at Microsoft.Exchange.Data.Directory.ConnectionPoolManager.&lt;&gt;c__DisplayClass8.&lt;RebuildNonPartitionScopedConnectionPoolManager&gt;b__6()</Data>
  </EventData>
</Event>





Log Name:      Application
Source:        MSExchange Mid-Tier Storage
Date:          7/16/2019 11:30:24 AM
Event ID:      10006
Task Category: (10)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      hostexch1.HostExch.local
Description:
Active Manager Client experienced an AD timeout trying to lookup object 'hostexch1' in 00:01:00.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchange Mid-Tier Storage" />
    <EventID Qualifiers="49152">10006</EventID>
    <Level>2</Level>
    <Task>10</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-07-16T16:30:24.000000000Z" />
    <EventRecordID>23672320</EventRecordID>
    <Channel>Application</Channel>
    <Computer>hostexch1.HostExch.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>hostexch1</Data>
    <Data>00:01:00</Data>
  </EventData>
</Event>




--------------


The events are listed in the order above and it seems that after event 22, that is when things start getting really bad again.

We are running on  Exchange Server 2013 Service Pack 1 (SP1 aka CU4)
Michael B. SmithManaging Consultant

Commented:
You are so seriously out of diskspace it isn't even funny. I'm surprised Exchange runs at ALL. You ought to have at least 15% space available on all Exchange volumes.

The performance counter '\\HOSTEXCH1\LogicalDisk(HarddiskVolume1)\Free Megabytes' sustained a value of '239.00', for the '15' minute(s) interval starting at '7/16/2019 3:41:00 PM'. Additional information: None. Trigger Name:DatabaseDriveSpaceTrigger. Instance:harddiskvolume1

Open in new window

It also looks like your DC needs it's netlogon records to be reregistered. The easiest way to do that is to restart the netlogon service on the DC. That will give you a mini-outage (a minute or two) so I recommend doing it outside of primary hurs.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Infinity SolutionsData, Voice, Internet Services

Author

Commented:
I am not seeing that we are low on disk space anywhere in the environment. We tried to restart the netlogon service but that also did not work. We are still having this issue every day multiple times a day, affecting all clients. The most recent time, I was able to collect the events a bit better. Also, at the workstation level it appears that everyone shows disconnected from exchange and no matter what it will not take the mailbox password. This happens until it somehow fixes itself.

We received what seems like thousands of these events in a span of almost 15-20 minutes. They all are back to back with no noticeable event in between. They come in the following order:







Log Name:      Application
Source:        MSExchangeADTopology
Date:          7/18/2019 10:34:28 AM
Event ID:      2077
Task Category: Topology
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      hostexch1.HostExch.local
Description:
Process Microsoft.Exchange.Directory.TopologyService.exe (PID=9852) Forest HostExch.local. Exchange Active Directory Provider could not find any suitable domain controller servers in either the local site 'Default-First-Site-Name' or the following sites:
.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeADTopology" />
    <EventID Qualifiers="16388">2077</EventID>
    <Level>4</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-07-18T15:34:28.000000000Z" />
    <EventRecordID>24503895</EventRecordID>
    <Channel>Application</Channel>
    <Computer>hostexch1.HostExch.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Microsoft.Exchange.Directory.TopologyService.exe</Data>
    <Data>9852</Data>
    <Data>HostExch.local</Data>
    <Data>Default-First-Site-Name</Data>
    <Data>
    </Data>
  </EventData>
</Event>










Log Name:      Application
Source:        MSExchangeADTopology
Date:          7/18/2019 10:34:28 AM
Event ID:      2069
Task Category: Topology
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      hostexch1.HostExch.local
Description:
Process Microsoft.Exchange.Directory.TopologyService.exe (PID=9852) Forest HostExch.local. Exchange Active Directory Provider couldn't find any suitable Global Catalog servers in either the local site 'Default-First-Site-Name' or the following sites:

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeADTopology" />
    <EventID Qualifiers="16388">2069</EventID>
    <Level>4</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-07-18T15:34:28.000000000Z" />
    <EventRecordID>24503896</EventRecordID>
    <Channel>Application</Channel>
    <Computer>hostexch1.HostExch.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Microsoft.Exchange.Directory.TopologyService.exe</Data>
    <Data>9852</Data>
    <Data>HostExch.local</Data>
    <Data>Default-First-Site-Name</Data>
    <Data>
    </Data>
  </EventData>
</Event>

















Log Name:      Application
Source:        MSExchangeADTopology
Date:          7/18/2019 10:34:28 AM
Event ID:      2142
Task Category: Topology
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      hostexch1.HostExch.local
Description:
Process Microsoft.Exchange.Directory.TopologyService.exe (PID=9852) Forest HostExch.local. Topology discovery failed, error details
No Suitable Directory Servers Found in Forest HostExch.local Site Default-First-Site-Name..
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeADTopology" />
    <EventID Qualifiers="49156">2142</EventID>
    <Level>2</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-07-18T15:34:28.000000000Z" />
    <EventRecordID>24503897</EventRecordID>
    <Channel>Application</Channel>
    <Computer>hostexch1.HostExch.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Microsoft.Exchange.Directory.TopologyService.exe</Data>
    <Data>9852</Data>
    <Data>HostExch.local</Data>
    <Data>No Suitable Directory Servers Found in Forest HostExch.local Site Default-First-Site-Name.</Data>
  </EventData>
</Event>

















Log Name:      Application
Source:        MSExchange ADAccess
Date:          7/18/2019 10:34:28 AM
Event ID:      2107
Task Category: Topology
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      hostexch1.HostExch.local
Description:
Process Microsoft.Exchange.Directory.TopologyService.exe (PID=9852). Exchange Active Directory Provider failed to obtain an IP address for DS server hostexchdc.HostExch.local, error 11001 (No such host is known).  This host will not be used as a DS server by Exchange Active Directory Provider.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchange ADAccess" />
    <EventID Qualifiers="32772">2107</EventID>
    <Level>3</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-07-18T15:34:28.000000000Z" />
    <EventRecordID>24503898</EventRecordID>
    <Channel>Application</Channel>
    <Computer>hostexch1.HostExch.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Microsoft.Exchange.Directory.TopologyService.exe</Data>
    <Data>9852</Data>
    <Data>hostexchdc.HostExch.local</Data>
    <Data>11001</Data>
    <Data>No such host is known</Data>
  </EventData>
</Event>

This is extremely frustrating since we have never seen this issue in the past and are having trouble figuring out exactly what is causing the intermittent disconnects.
Michael B. SmithManaging Consultant

Commented:
If you are still getting the out of disk space messages, then that's probably the root cause.

What's the topology? One DC and one Exchange server? What do you have specified as DNS servers on both boxes? Are "A" records for both boxes static in DNS?
Infinity SolutionsData, Voice, Internet Services

Author

Commented:
We aren't seeing the disk space messages anymore. However, today it happened again after not happening for about a day I would say. This time I noticed this error message right before it all happened, and this is error message that lead the crazy amount of topology and access messages.




Log Name:      Application
Source:        MSExchangeDiagnostics
Date:          7/25/2019 11:50:54 AM
Event ID:      1015
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      hostexch1.HostExch.local
Description:
Unable to contact the active directory. Inner Exception System.Security.Authentication.AuthenticationException: The user name or password is incorrect.
 ---> System.Runtime.InteropServices.COMException: The user name or password is incorrect.
   at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
   at System.DirectoryServices.DirectoryEntry.Bind()
   at System.DirectoryServices.DirectoryEntry.get_AdsObject()
   at System.DirectoryServices.PropertyValueCollection.PopulateList()
   at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName)
   at System.DirectoryServices.PropertyCollection.get_Item(String propertyName)
   at System.DirectoryServices.ActiveDirectory.PropertyManager.GetPropertyValue(DirectoryContext context, DirectoryEntry directoryEntry, String propertyName)
   --- End of inner exception stack trace ---
   at System.DirectoryServices.ActiveDirectory.PropertyManager.GetPropertyValue(DirectoryContext context, DirectoryEntry directoryEntry, String propertyName)
   at System.DirectoryServices.ActiveDirectory.Forest.GetForest(DirectoryContext context)
   at Microsoft.Exchange.Diagnostics.Service.MachineInformationSource.PollMachineInformation()
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeDiagnostics" />
    <EventID Qualifiers="49156">1015</EventID>
    <Level>2</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-07-25T16:50:54.000000000Z" />
    <EventRecordID>25016035</EventRecordID>
    <Channel>Application</Channel>
    <Computer>hostexch1.HostExch.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>System.Security.Authentication.AuthenticationException: The user name or password is incorrect.
 ---&gt; System.Runtime.InteropServices.COMException: The user name or password is incorrect.
   at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
   at System.DirectoryServices.DirectoryEntry.Bind()
   at System.DirectoryServices.DirectoryEntry.get_AdsObject()
   at System.DirectoryServices.PropertyValueCollection.PopulateList()
   at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName)
   at System.DirectoryServices.PropertyCollection.get_Item(String propertyName)
   at System.DirectoryServices.ActiveDirectory.PropertyManager.GetPropertyValue(DirectoryContext context, DirectoryEntry directoryEntry, String propertyName)
   --- End of inner exception stack trace ---
   at System.DirectoryServices.ActiveDirectory.PropertyManager.GetPropertyValue(DirectoryContext context, DirectoryEntry directoryEntry, String propertyName)
   at System.DirectoryServices.ActiveDirectory.Forest.GetForest(DirectoryContext context)
   at Microsoft.Exchange.Diagnostics.Service.MachineInformationSource.PollMachineInformation()</Data>
  </EventData>
</Event>
Michael B. SmithManaging Consultant

Commented:
Are there multiple domains in your forest?
Data, Voice, Internet Services
Commented:
We traced this down to an issue with the topology service. Edited the config file for MSE directory topology service to be 'MinPercentageOfHealthyDC = "10"' instead of 50 and we also added more RAM.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial