Last week (November 7-11) several servers requested a reboot brought on by Microsoft Updates being applied automatically. The last reboot took place on Friday at the end of the day. This was a good time since Exchange failed to come back up!

Scenario:
Two Microsoft Exchange 2003 Servers. One on Windows Server 2003, the other on Windows Server 2000. Both servers configured to be Active Directory domain controllers. One server relays email through the other.

Wednesday, November 09, 2005, Server 2003 lists the following updates as installed:
Windows Malicious Software Removal Tool - November 2005 (KB890830)
Security Update for Windows Server 2003 (KB896424)
Office 2003:
Update for Outlook 2003 Junk Email Filter (KB907492)

Thursday, November 10, 2005, Server 2000 lists these updates:
Windows Malicious Software Removal Tool - November 2005 (KB890830)
Security Update for Windows Server 2003 (KB896424)

The Fix:
Microsoft Article ID : 896703

• Run PolicyTest.exe to analyze access rights.
  
• Run setup /domainprep from the Microsoft Exchange Server CD on the Exchange server that is not having trouble, but apparantely is now missing some security information.
• Restart Exchange services on both servers.

This is what I found when running policytest: (the names have been changed to protect the innocent)

===============================================
Local domain is "MYDOMAIN.com" (MYDOMAIN)
Account is "MYDOMAIN\Exchange Enterprise Servers"
========================
  DC      = "SERVER1"
  In site = "Default-First-Site-Name"
  !!! Right NOT found !!!
========================
  DC      = "SERVER2"
  In site = "Default-First-Site-Name"
  Right found:  "SeSecurityPrivilege"

Below is a list of EventLog messages we were receiving on the second server. No errors were apparent on the first server which happens to be the main Exchange server. Apparently, the security information was removed, but didn't cause any trouble until Exchange was restarted during the reboot.

Source: MSExchangeIS
Event ID: 5000
Unable to initialize the Microsoft Exchange Information Store service. - Error 0x80004005.

Source: MSExchangeIS
Event ID: 1121
Error 0x80004005 connecting to the Microsoft Active Directory.

Source: MSExchangeFBPublish
Event ID: 8197
Error initializing session for virtual machine SERVER2. The error number is 0x8004011d. Make sure Microsoft Exchange Store is running.

Source: MSExchangeSA
Event ID: 9098
The MAD Monitoring thread was unable to read its configuration from the DS, error '0x80004005'.

Source: MSExchangeDSAccess
Event ID: 2103
Process MAD.EXE (PID=2092). All Global Catalog Servers in use are not responding:

 

 

( Events: 5000 1121 9098 Win2k Win2k3 Microsoft Exchange 2000 Server Standard Edition kbexchesm kbprb KB896703 )