6

So customer calls up saying exchange isn't working, and when he remoted in he could see all the services disabled.

All the exchange services, IIS, update, plus a bunch of others were all set to disabled state.

Apon changing to automatic they started again fine and now email works, but how they got into this state is the worry.

I believe, from something similar years ago, that in msconfig there is diagnostic startup, which might result in said services being disabled. Again though, after another 'normal' reboot, why wouldn't they revert back to normal? And, how would it have gone into diag startup in the first place?

Anyway, a few other people on google seem to have had the same problem over the years but no one has really found a solution. At this stage we aren't ruling out a virus however it is a server with almost 0 access to the web so doubtful.

And exchange 2007 8.1 (some 0s missing) on server 2008 SBS (windows server standard FE 2007 SP2)

Nixphoe
  • 4,524
  • 7
  • 32
  • 51
Joshua D'Alton
  • 428
  • 2
  • 13
  • 1
    You never really mentioned *if* the server was rebooted or not. Could you confirm that? If it *wasn't*, that would flush out the diagnostic startup. – Nixphoe Aug 15 '11 at 00:49
  • 1
    Also what version of Exchange are you using? Where there any updates installed. I did find this: http://social.technet.microsoft.com/Forums/en-US/exchangesvrdeploy/thread/6ecf8e9a-9e27-4f2e-9e28-a59639029df1/ – Nixphoe Aug 15 '11 at 01:06
  • He mentioned that the customer called saying that exchange wasn't working anymore because the services were disabled. If the server wouldn't have been rebooted, then the Exchange services would have kept running, even if the services were disabled. So I think we can assume that the server was rebooted. A clarification and Exchange version would be helpful though. – Lucky Luke Aug 15 '11 at 01:47
  • While not a solution, I would recommend installing EventSentry Light (free)(http://www.eventsentry.com), which allows you to get notified when a service changes, which would include service state as well as service startup type. The free edition allows you to monitor up to three services, so that should suffice in this case. As soon as the service changes, you will get an email. Disclaimer: I work for netikus.net. – Lucky Luke Aug 15 '11 at 01:50
  • "Again though, after another 'normal' reboot" yes it was rebooted... – Joshua D'Alton Aug 15 '11 at 02:38
  • And yes apparently updates were installed prior to reboot (customer says). And exchange 2007 8.1 (some 0s missing) on server 2008 SBS (windows server standard FE 2007 SP2) – Joshua D'Alton Aug 15 '11 at 02:42
  • @JoshuaD'Alton - What Updates were installed? Specifically what Exchange updates were installed? Any Exchange Service Packs or Exhcnage Service Pack Rollups? I'm seeing quite a few people with this issue, and they all seem to have fixed it by just changing the services back to Automatic and restarting them. – Nixphoe Aug 15 '11 at 03:55
  • It wasn't just exchange though. IIS services were disabled, windows update as well. I don't know what updates how do I find out? – Joshua D'Alton Aug 15 '11 at 04:54
  • @Joshua There are hidden folders in c:\windows\. The naming convention of them is $NtUninstallKB######$. You should be able to organize them by date and see which ones were installed recently. Google the KB numbers to see if they are related to Exchange and see if they have any known bugs with them. – Nixphoe Aug 15 '11 at 18:47
  • Don't see anything in windows. and doesn't appear in add/remove programs. – Joshua D'Alton Aug 17 '11 at 04:02

1 Answers1

1

As Nixphoe alluded to in his comment, your situation sounds very similar to problems people have after installing an Exchange security rollup or cumulative update. My guess is that the update installer stops the Exchange services and sets their startup mode to "disabled" while it copies new versions of the Exchange files.

Why disable the services? It probably doesn't want someone to inadvertently starting one of these services while the installer was running and the files were in an inconsistant state.

The real issue is that the installer didn't change the startup mode back to the original values. This might be a bug, or the installer may have been interrupted somehow and didn't get to perform its cleanup.

MS TechNet Forum post discussing this (credit to Nixphoe)... http://social.technet.microsoft.com/Forums/en-US/exchangesvrdeploy/thread/6ecf8e9a-9e27-4f2e-9e28-a59639029df1/

That post also has a set of sc.exe commands that will fix the service startup modes. Keep in mind that for most Exchange environments, the correct startup mode would probably be "automatic", but in failover/MSCS clusters, the correct mode may actually be "manual" so the cluster manager can control startup. It's always a good idea to check before you install an update.

Chris Sears
  • 363
  • 1
  • 2
  • 7