some advanced exchange 2010 help needed please

sukh · March 12, 2011

Hey

See this Setting a Windows Server 2008 Domain Controller as a Global Catalog

Sukh

RabbieBurns · March 12, 2011

new DC is definately a GC, and so is another DC.

Am I safe to just demote the old one do you think?

sukh · March 12, 2011

I would ensure that Exchange is happy before demoting the old DC.

Can you check the Event Logs on the Exchange server and check for errors?

sukh · March 12, 2011

Did you restart both the new DC and Exchange (one at a time)?

RabbieBurns · March 12, 2011

IVe restarted Exchange, but not any of the other DCs..

Exchange is given me loads of errors in the logs:

Log Name:      Application
Source:        MSExchangeRepl
Date:          3/12/2011 11:43:00 AM
Event ID:      2155
Task Category: Service
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      2008R2.pmg.co.uk
Description:
The Third Party Replication Manager could not access Active Directory. Error: The Microsoft Exchange Active Directory Topology service on server localhost did not return any suitable domain controllers.. Initialization will be retried automatically.
Event Xml:

 
   
   2155
   2
   1
   0x80000000000000
   
   153949
   Application
   2008R2.pmg.co.uk
   
 
 
   The Microsoft Exchange Active Directory Topology service on server localhost did not return any suitable domain controllers.

for example

Ill try restarting the DCs..

sukh · March 12, 2011

Can you restart the new DC and let me know....

RabbieBurns · March 12, 2011

so after having the roles transferred to it, it wanst restarted. IVe restarted it now, and now restarting the exchange server again.

sukh · March 12, 2011

cool, let me know what happens...

RabbieBurns · March 12, 2011

Outlook Web App didn't initialize. If the problem continues, please contact your helpdesk.
The Microsoft Exchange Active Directory Topology service on server localhost did not return any suitable domain controllers.
Show details


Request
Url: https://mail.peninsulamediagroup.co.uk:443/owa/auth/error.aspx?url=https://mail.peninsulamediagroup.co.uk/owa/&reason=0
User host address: 220.233.58.237
OWA version: 14.1.287.0

Exception
Exception type: Microsoft.Exchange.Clients.Owa.Core.OwaInvalidConfigurationException
Exception message: The Microsoft Exchange Active Directory Topology service on server localhost did not return any suitable domain controllers.

Call stack
Microsoft.Exchange.Clients.Owa.Core.OwaConfigurationManager.CreateAndLoadConfigurationManager()
Microsoft.Exchange.Clients.Owa.Core.OwaSettingsLoader.Load()
Microsoft.Exchange.Clients.Owa.Core.OwaApplicationBase.ExecuteApplicationStart(Object sender, EventArgs e)

Inner Exception
Exception type: Microsoft.Exchange.Data.Directory.NoSuitableServerFoundException
Exception message: The Microsoft Exchange Active Directory Topology service on server localhost did not return any suitable domain controllers.

Call stack
Microsoft.Exchange.Data.Directory.DSAccessTopologyProvider.GetConfigDCInfo(Boolean throwOnFailure)
Microsoft.Exchange.Data.Directory.TopologyProvider.PopulateConfigNamingContexts()
Microsoft.Exchange.Data.Directory.ADSession.GetConfigurationNamingContext()
Microsoft.Exchange.Data.Directory.SystemConfiguration.ADSystemConfigurationSession.GetRootOrgContainerId(String fqdn, NetworkCredential credential)
Microsoft.Exchange.Clients.Owa.Core.Utilities.CreateADSystemConfigurationSessionScopedToFirstOrg(Boolean readOnly, ConsistencyMode consistencyMode)
Microsoft.Exchange.Clients.Owa.Core.OwaConfigurationManager.InitializeConfigurationManager()
Microsoft.Exchange.Clients.Owa.Core.OwaConfigurationManager.CreateAndLoadConfigurationManager()

and logging back in to the exchange server is taking ages, sitting at applying user settings..

As soon as i bring up the old 2008 DC it all springs to life again..

I guess Ill run all the FSMO transfer stuff again just to make sure.

sukh · March 12, 2011

Check the following on the new DC, before you do this, telnet to the new DC on port 389 to see if you get a connection.

a. Open the Default Domain Controllers Security Settings snap-in on the domain controller specified in the event description.

b. In the console tree, under Security Settings, expand Local Policies, and then click User Rights Assignments.

c. In the results pane, double-click Manage auditing and security log. Verify that both the Exchange Servers group and the Exchange Enterprise Servers group are listed.

Second, make sure that Exchange server is member of proper groups...

•Make sure that the Exchange server is still a member of the Exchange Domain Servers group and make sure that Exchange Domain Servers group is a member of Exchange Enterprise Servers group.

RabbieBurns · March 12, 2011

nothing seems to work without the old one being up..

its a pain that telnet is not installed by default on anything windows these days either!

robert@oasis ~ $ telnet 192.168.2.41 389
Trying 192.168.2.41...
Connected to 192.168.2.41.
Escape character is '^]'.

is there something I can run that will show where the roles are based and what the old server might be holding?

Also, could you point me into a direction of a guide that would provide me with the steps i need to completely remove the roles, and demote, and retire an old 2008 server? Obviously what I have followed hasnt done the trick.

PS. thanks for all your continued help sukh, especially on a saturday.

sukh · March 12, 2011

Hey np. Had a late night last night, so not totally focussed.

1. Run the ExBPA from the toolbox within the EMC. I would do this to identify the cause of Exchange. This is a must, will help you out a lot.

2. Identify FSMO Roles Determining FSMO Role Holders

3. If you need to move the FSMO roles then follow Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller

I would not seize roles unless you have no option!!!

4. How to remove a domain controller - Removing a Domain Controller from a Domain

Would be interesting to know the results of the BPA.

Regards

Sukh

RabbieBurns · March 13, 2011

1. Please see attached for the Exchange BPA report.

ExBPA.scan.201103130937084429.data.zip

2. Using various of those methods, they all point to the new DC holidng the roles. Althouigh, running the ntdsutil and connectiong to the old DC, it shows this, is this normal?

Server "2008server" knows about 5 roles
Schema - CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,
CN=Configuration,DC=pmg,DC=co,DC=uk
Naming Master - CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=pmg,DC=co,DC=uk
PDC - CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=pmg,DC=co,DC=uk
RID - CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=pmg,DC=co,DC=uk
Infrastructure - CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=pmg,DC=co,DC=uk

(DC1 is the new one)

3. Yep, thats exactly how i did the transfer

4. Yep, thats the way I planned to demote it, cool.

ExBPA.scan.201103130937084429.data.zip

RabbieBurns · March 13, 2011

Check the following on the new DC, before you do this, telnet to the new DC on port 389 to see if you get a connection.

a. Open the Default Domain Controllers Security Settings snap-in on the domain controller specified in the event description.

b. In the console tree, under Security Settings, expand Local Policies, and then click User Rights Assignments.

c. In the results pane, double-click Manage auditing and security log. Verify that both the Exchange Servers group and the Exchange Enterprise Servers group are listed.

Second, make sure that Exchange server is member of proper groups...

•Make sure that the Exchange server is still a member of the Exchange Domain Servers group and make sure that Exchange Domain Servers group is a member of Exchange Enterprise Servers group.

I dont seem to have an Exchange Enterprise Servers group, Im only running exchange standard, not sure if that explains it.

Also, I dont have a group called Exchange Domain Servers, it is called Exchange Install Domain Servers, is that the same thing?

tarquel · March 14, 2011

I believe he's refering to the AD group "Exchange Servers" that should be in the OU "Microsoft Exchange Security Groups" (located at the root of your AD), i.e. these:

Delegated Setup Security Group - Universal Members of this management role group have permissions to install and uninstall Exchange on provisioned servers. This role group shouldn't be deleted.
Discovery Management Security Group - Universal Members of this management role group can perform searches of mailboxes in the Exchange organization for data that meets specific criteria.
Exchange All Hosted Organizations Security Group - Global This group contains all the Exchange Hosted Organization Mailboxes groups. It is used for applying Password Setting Objects to all hosted mailboxes. This group should not be deleted.
Exchange Servers Security Group - Universal This group contains all the Exchange servers. This group should not be deleted.
Exchange Trusted Subsystem Security Group - Universal This group contains Exchange servers that run Exchange cmdlets on behalf of users via Management service. Its members will have permission to read and modify all Exchange configuration, as well as user accounts and groups. This group should not be deleted.
Exchange Windows Permissions Security Group - Universal This group contains Exchange servers that run Exchange cmdlets on behalf of users via Management service. Its members will have permission to read and modify all Windows accounts and groups. This group should not be deleted.
ExchangeLegacyInterop Security Group - Universal This group is for interoperability with Exchange 2003 servers within the same forest. This group should not be deleted.
Help Desk Security Group - Universal Members of this management role group can view and manage the configuration for individual recipients and view recipients in an Exchange organization. Members of this role group can only manage the configuration each user can manage on his or her own mailbox. Additional permissions can be added by assigning additional management roles to this role group.
Hygiene Management Security Group - Universal Members of this management role group can manage Exchange anti-spam features and grant permissions for antivirus products to integrate with Exchange.
Organization Management Security Group - Universal Members of this management role group have permissions to manage Exchange objects and their properties in the Exchange organization. Members can also delegate role groups and management roles in the organization. This role group shouldn't be deleted.
Public Folder Management Security Group - Universal Members of this management role group can manage public folders. Members can create and delete public folders and manage public folder settings such as replicas, quotas, age limits, and permissions as well as mail-enable and mail-disable public folders.
Recipient Management Security Group - Universal Members of this management role group have rights to create, manage, and remove Exchange recipient objects in the Exchange organization.
Records Management Security Group - Universal Members of this management role group can configure compliance features such as retention policy tags, message classifications, transport rules, and more.
Server Management Security Group - Universal Members of this management role group have permissions to manage all Exchange servers within the Exchange organization, but members don't have permissions to perform operations that have global impact in the Exchange organization.
UM Management Security Group - Universal Members of this management role group can manage Unified Messaging organization, server, and recipient configuration.
View-Only Organization Management Security Group - Universal Members of this management role group can view recipient and configuration objects and their properties in the Exchange organization.

chrisbrown · March 15, 2011

Out of interest, do one of these:

Get-ADServerSettings | fl

and see what it returns...

This should at least trigger your mind as to whether something is funky with your DC config in Exchange.

RabbieBurns · March 15, 2011

I think ive resolved this. The exchange was set to use the old DC as its main DNS. Changing this, and I can now shut down the old DC and exchange still works fine.

Ill give it a week and then demote / delete the old one completely

Thanks alll

chrisbrown · March 15, 2011

I think ive resolved this. The exchange was set to use the old DC as its main DNS. Changing this, and I can now shut down the old DC and exchange still works fine.

Ill give it a week and then demote / delete the old one completely

Thanks alll

Cool! Let us know how you go

some advanced exchange 2010 help needed please

Recommended Posts

sukh

RabbieBurns

sukh

sukh

RabbieBurns

sukh

RabbieBurns

sukh

RabbieBurns

sukh

RabbieBurns

sukh

RabbieBurns

RabbieBurns

tarquel

chrisbrown

RabbieBurns

chrisbrown

Create an account or sign in to comment

Create an account

Sign in

Recent Threads

iOS 27 BYOD and Smoothwall web filtering - Connectivity Assist causing issues?

3rd Party Warranty on Existing Panels

Edge Auto Sign in Broken / Cloud Filter

Home

Forums

What's New