|
|
|
date: Thu, 2 Feb 2006 10:49:38 -0000,
group: microsoft.public.exchange2000.active.directory.integration
back
Re: Window 2000 Native Mode
Thanks for the info, I'll try that!
Its funny how it boots OK without a network connection and works OK after I
plug the network cable back in once its up? However, been getting these in
the event logs:
DSACCESS returned an error '0x80004005' on DS notification. Microsoft
Exchange System Attendant will re-set DS notification later.
Details
Product: Exchange
Event ID: 9154
Source: MSExchangeSA
Version: 6.5.0000.0
Message: DSACCESS returned an error 'error code' on DS notification.
Microsoft Exchange System Attendant will re-set DS notification later.
Explanation
This event is displayed in the Application Log when the Exchange server is
unable to access a Domain Controller (DC). For example, this event may occur
when a DC is restarted, if that is the ONLY DC in the site that the Exchange
server belongs to.
The most likely cause for this Event is that the Kerberos ticket timed out.
This typically happens in a topology that has a single DC. When the Kerberos
tickets that are associated with the Lightweight Directory Access Protocol
(LDAP) connections time out, all LDAP connection attempts show errors
because the security contexts have failed. These connections must be
re-established. Because there is only one domain controller in this
topology, there are no other servers to obtain a ticket from while this
re-establishment takes place. Therefore, the error occurs.
Incorrect DNS configuration.
User Action
The client LDAP connections should get re-established automatically and the
errors should go away once this re-establishment has taken place. It is
recommended that additional DCs be installed in the site in order to avoid
such errors.
Ensure that both the Primary and Alternate DNS Servers listed in the
Exchange Server IP Properties are up and running and have been configured
properly.
Check the DC to ensure that it is running properly. For example, ensure that
is not restarting unnecessarily.
Version: 6.5.6940.0
Component: Microsoft Exchange System Attendant
Message: DSACCESS returned an error '<error code>' on DS notification.
Microsoft Exchange System Attendant will re-set DS notification later.
Explanation
This event is displayed in the application log when the Exchange server is
unable to access a domain controller. For example, this event can occur when
a domain controller is restarted, if that is the ONLY domain controller in
the site to which the Exchange server belongs.
The most probable cause for this event is that the Kerberos ticket timed
out. This typically happens in a topology that has a single domain
controller. When the Kerberos tickets that are associated with the
Lightweight Directory Access Protocol (LDAP) connections time out, all LDAP
connection attempts show errors because the security contexts have failed.
These connections must be re-established. Because there is only one domain
controller in this topology, there are no other servers to obtain a ticket
from while this re-establishment takes place. Therefore, the error occurs.
Incorrect Domain Name System (DNS) configuration.
User Action
The client LDAP connections should get re-established automatically and the
errors should go away once this re-establishment has taken place. It is
recommended that additional domain controllers be installed in the site in
order to avoid such errors.
Ensure that both the Primary and Alternate DNS servers listed in the
Exchange Server IP Properties are up and running and have been configured
properly.
Check the domain controller to ensure that it is running properly. For
example, ensure
Process MAD.EXE (PID=4980). All Domain Controller Servers in use are not
responding:
MOBBOSS.lancaster.monstermob.com
mob001.lancaster.monstermob.com
mobapp.lancaster.monstermob.com
Details
Product: Exchange
Event ID: 2102
Source: MSExchangeDSAccess
Version: 6.5.0000.0
Message: Process %1 (PID=%2). All Domain Controller Servers in use are not
responding:
%3
Explanation
This event indicates that the DSAccess component on the Exchange Server was
unable to find any domain controllers suitable for LDAP queries. This can
result in the halting of mail flow, so it should be investigated
immediately.
The most likely cause is that the Kerberos ticket timed out. When the
Kerberos tickets that are associated with the Lightweight Directory Access
Protocol (LDAP) connections time out, all LDAP connections get errors
because the security contexts have failed and these connections must be
re-established. If there are no other servers to obtain a ticket from while
this re-establishment takes place, then the error occurs.
The Manage Auditing and Security Log right (SeSecurityPrivilege) was removed
for the Exchange Enterprise Servers domain local group on some or all of the
domain controllers.
All intra-site and extra-site DCs are down or network problems have rendered
them unreachable.
User Action
Try to have at least two DCs (configured as GCs) in a SITE. This is for
failover purposes.
Run the Exchange setup with the /DOMAINPREP switch. This will reassign the
SeSecurityPrivilege right to the Exchange Enterprise Servers Group.
Check the event log for DSAccess event ID 2080 (may need to increase the
DSAccess logging level to record this event). The detail in that event will
help determine if DCs have been contacted that are unsuitable for some
reason. They can then be corrected.
Look for DSAccess event ID 2070 in the event logs. These events will detail
why each DC has become unsuitable. Correct as necessary.
Process STORE.EXE (PID=4336). Topology Discovery failed, error 0x80040952.
Details
Product: Exchange
Event ID: 2114
Source: MSExchangeDSAccess
Version: 6.5.6940.0
Component: Microsoft Exchange Directory Access Cache
Message: Process <process name> (PID=<process id>). Topology Discovery
failed, error 0x<error code>.
Explanation
This event indicates that new topology could not be generated. If this is
NOT the first topology discovery since system startup, the previously
discovered topology will be used. However, topology discovery failure is
usually a sign of a serious problem and needs to be investigated
immediately. The following are the possible causes:
All local domain controllers are down or deemed not suitable.
Network problems are preventing the Exchange server from contacting the
domain controllers.
There are permissions problems.
User Action
Look up the Lightweight Directory Access Protocol (LDAP) error description
in the "Microsoft LDAP Error Codes" Knowledge Base article. To reach this
article, search for "Microsoft LDAP Error Codes" on the Microsoft web site.
Check local domain controllers to ensure that they are up and running and
also check network connectivity to these domain controllers.
Look for accompanying events in the application log. You may need to turn up
logging for the Topology category of DSAccess to see these additional
events.
"Paul Williams [MVP]" wrote in message
news:elUL4%23$JGHA.3200@tk2msftngp13.phx.gbl...
> Slow logons usually indicate DNS problems. Verify that this DC can find a
> DC with either NLTEST or NSLOOKUP [1] and that there are not userenv,
> scecli
> and/ or netlogon errors in the event logs.
>
> Also, seeing as you deleted and re-created the computer account, ensure
> that
> the Exchange server is a member of the local Exchange Domain Servers
> group.
>
>
> ---
> [1] The following commands will help:
>
> nltest /dsgetdc:domain-name.com
> nslookup -type=srv _ldap._tcp.dc._msdcs.domain-name.com
>
> Note. NLTEST is a support tool -
> http://www.msresource.net/content/view/53/46/
>
> --
> Paul Williams
> Microsoft MVP - Windows Server - Directory Services
> http://www.msresource.net | http://forums.msresource.net
>
>
date: Thu, 2 Feb 2006 15:09:06 -0000
author: Stuart Errington
Re: Window 2000 Native Mode
Paul,
Now getting this in the logs, any suggestions?:
Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 07/02/2006
Time: 01:16:52
User: N/A
Computer: MOBMAIL
Description:
The Security System detected an authentication error for the server
ldap/mobapp.lancaster.monstermob.com. The failure code from authentication
protocol Kerberos was "The attempted logon is invalid. This is either due to
a bad username or authentication information.
(0xc000006d)".
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 6d 00 00 c0 m..
Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 07/02/2006
Time: 01:16:52
User: N/A
Computer: MOBMAIL
Description:
The Security System detected an authentication error for the server
ldap/mob001.lancaster.monstermob.com. The failure code from authentication
protocol Kerberos was "The attempted logon is invalid. This is either due to
a bad username or authentication information.
(0xc000006d)".
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 6d 00 00 c0 m..
Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 07/02/2006
Time: 01:17:02
User: N/A
Computer: MOBMAIL
Description:
The Security System detected an authentication error for the server
ldap/MOBBOSS.lancaster.monstermob.com. The failure code from authentication
protocol Kerberos was "The attempted logon is invalid. This is either due to
a bad username or authentication information.
(0xc000006d)".
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 6d 00 00 c0 m..
Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 07/02/2006
Time: 01:17:02
User: N/A
Computer: MOBMAIL
Description:
The Security System detected an authentication error for the server
ldap/mobapp.lancaster.monstermob.com/lancaster.monstermob.com@lancaster.monstermob.com.
The failure code from authentication protocol Kerberos was "The attempted
logon is invalid. This is either due to a bad username or authentication
information.
(0xc000006d)".
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 6d 00 00 c0 m..
Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 07/02/2006
Time: 01:50:06
User: N/A
Computer: MOBMAIL
Description:
The Security System detected an authentication error for the server
LDAP/MOBBOSS.lancaster.monstermob.com/lancaster.monstermob.com@lancaster.monstermob.com.
The failure code from authentication protocol Kerberos was "The attempted
logon is invalid. This is either due to a bad username or authentication
information.
(0xc000006d)".
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 6d 00 00 c0 m..
Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 07/02/2006
Time: 01:50:06
User: N/A
Computer: MOBMAIL
Description:
The Security System detected an authentication error for the server
LDAP/mobapp.lancaster.monstermob.com/lancaster.monstermob.com@lancaster.monstermob.com.
The failure code from authentication protocol Kerberos was "The attempted
logon is invalid. This is either due to a bad username or authentication
information.
(0xc000006d)".
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 6d 00 00 c0 m..
Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 07/02/2006
Time: 01:50:08
User: N/A
Computer: MOBMAIL
Description:
The Security System detected an authentication error for the server
LDAP/mob001.lancaster.monstermob.com/lancaster.monstermob.com@lancaster.monstermob.com.
The failure code from authentication protocol Kerberos was "The attempted
logon is invalid. This is either due to a bad username or authentication
information.
(0xc000006d)".
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 6d 00 00 c0 m..
"Paul Williams [MVP]" wrote in message
news:uF$LyPWKGHA.4044@TK2MSFTNGP10.phx.gbl...
>> does the nltest result indicate 10.0.0.50 is authoratative for the dns
>> zone?
>
> No. It is just the DC that was located. This DC should be in your site.
> If your site comprises of one subnet, this result is passed back using
> round
> robin "load balancing". If you have several subnets in the site, the
> results are still passed back in a round robin format but are re-jigged by
> the resolver so that the local network is on the top.
>
> --
> Paul Williams
> Microsoft MVP - Windows Server - Directory Services
> http://www.msresource.net | http://forums.msresource.net
>
>
date: Tue, 7 Feb 2006 09:45:10 -0000
author: Stuart Errington
|
|
