I could need some help here. All of a sudden, from one day to the next the Exchange Attendant service can not be started, as well as the Exchange Management System. The event protocol shows that both services can't be started because the system can't find them: "The Microsoft Exchange System Attendant service failed to start due to the following error: The system cannot find the path specified." ID 7000The Event log for the "Exchange Management System" was just like this. Of course therefore all the other Exchange Services won't start, except for the Exchange Routing Engine. I searched the web for ideas and solutions and have checked, as I think, nearly everything. Even though I expected it to be a rather small problem, it turned out to be unsolvable until now. I've checked every slightly similar problem in the Microsoft Knowledge base but nothing really helped in my case. On the other hand I'm not sure what has to be set up in the Registry, because I unfortunately don't have backup to have a look to. The Exchange Server is running on a Windows Server 2003 SP2 Standard Edition which i installed on a HP ProLiant server with an SCSI HD Array. I hope anybody has some more suggestions for me.

The System Attendant does not start when the Active Directory Domain Controller cannot be contacted. Check the DCs in your network to be sure they are up and can be pinged from the Exchange Server. If this is the case there will be some events in the Application Event log to indicate Topology Discovery failed.

Please try to download ExBPA and then have a health scan.You may post the report here for troubleshooting purpose.Regards,Xiu

It may be a problem with the Service Account. Refer to the Workaround section in the article below. http://support.microsoft.com/kb/184205 Andrew Sword, MVP

Xiu: Thank you,i did a health scan. What is really funny that this problem occured within a few hours. Maybe this will shed some light... Certificate has expired : The SSL certificate for 'https://citygreen.local' expired 03/03/2008 22:53:42. Users may be unable to connect with the server. Tell me more about this issue and how to resolve it. Certificate principal mismatch : The principal for SSL certificate 'https://citygreen.local' does not appear to match the host address. Host address: citygreen.local. Principal: CN=srv03.citygreenholding.com. Tell me more about this issue and how to resolve it. Intelligent Message Filter recommendation : The Intelligent Message Filter was not detected and at least one computer in the organization is running Exchange Server 2003. The Intelligent Message Filter can help reduce unsolicited commercial electronic messages. Tell me more about this setting. Organization: CITYGREEN Global incoming message size not set Organization: CITYGREEN The maximum incoming message size is not set. This can cause reliability problems. Tell me more about this issue and how to resolve it. Global outgoing message size not set Organization: CITYGREEN The maximum outgoing message size is not set. This can cause reliability problems. Tell me more about this issue and how to resolve it. Admin Group: first administrative group Server: SRV03 'SystemPages' set too high Server: SRV03 The 'SystemPages' value is set too high on server srv03.citygreen.local and may cause instability. Current value: 798720. Tell me more about this issue and how to resolve it. 3GB is not set Server: SRV03 Exchange mailbox server srv03.citygreen.local has 1 GB or more of memory, accommodates 54 mailboxes, and does not have /3GB set in the Boot.ini file. Greater scalability would be achieved if this were set. Memory detected: 2045 MB. Tell me more about this issue and how to resolve it. 'HeapDeCommitFreeBlockThreshold' not set Server: SRV03 Server srv03.citygreen.local has 1 GB or more of memory, accommodates 54 mailboxes, and the 'HeapDeCommitFreeBlockThreshold' parameter has not been set to 262144. Virtual memory may become quickly fragmented and system instability may occur. Tell me more about this issue and how to resolve it. Paging file larger than Physical Memory Server: SRV03 The space for the paging file (4096) is larger than the physical memory (2046). This may affect the system performance. It is recommended to have paging file size equal to the physical memory. Tell me more about this issue and how to resolve it. Network interface driver file is more than two years old Server: SRV03 Network interface driver file 'c:\windows\system32\drivers\q57xp32.sys' for 'q57w2k' on server srv03.citygreen.local is more than two years old. Check with your vendor to find out if a newer version is available. Installed driver details: 9.81.0.0 built by: WinDDK - 20060828161108.000000+120 Network interface driver file is more than two years old Server: SRV03 Network interface driver file 'c:\windows\system32\drivers\bxnd52x.sys' for 'l2nd' on server srv03.citygreen.local is more than two years old. Check with your vendor to find out if a newer version is available. Installed driver details: 2.8.13.0 built by: WinDDK - 20060807132356.000000+120 Network interface driver file is more than two years old Server: SRV03 Network interface driver file 'c:\windows\system32\drivers\cpqteam.sys' for 'CPQTeamMP' on server srv03.citygreen.local is more than two years old. Check with your vendor to find out if a newer version is available. Installed driver details: 8.55.00.0 - 20061109122706.000000+060 Storage driver is more than two years old Server: SRV03 Storage driver file 'c:\windows\system32\drivers\hpcisss2.sys' for 'Smart Array E200I Controller' on server srv03.citygreen.local is more than two years old. Check with your vendor to find out if a newer version is available. Installed driver details: 6.2.0.32 Build 8 (x86) built by: buildsrv - 20061101135832.000000+060 Exchange resident on domain controller Server: SRV03 Exchange server srv03.citygreen.local is also a domain controller, but not a global catalog server. This is not a supported configuration and may cause Exchange services to fail. Tell me more about this issue and how to resolve it. SMTP configuration warning Server: SRV03 The 'msExchSmtpMaxMessageSize' value for SMTP instance 'Default SMTP Virtual Server' on server SRV03 has been altered from its default of 0. This will cause mail flow problems if this server routes mail between Exchange servers. Current value: 104857600. Tell me more about this issue and how to resolve it. 'SystemPages' setting Server: SRV03 Server srv03.citygreen.local is running Windows Server 2003 and the 'SystemPages' value is not equal to 0. Current 'SystemPages' value: 798720. Tell me more about this issue and how to resolve it. IMAP4 fast message retrieval Server: SRV03 The 'fast message retrieval' option is not enabled on IMAP4. Enabling this option can result in increased performance. To enable the option, open the properties of the IMAP4 virtual server from ESM, go to the General tab and select the 'Enable fast message retrieval' check box. Microsoft Exchange Management service not running Server: SRV03 The Microsoft Exchange Management service on server srv03.citygreen.local is not running. Certain management functionality such as message tracking will not work. Tell me more about this issue and how to resolve it. Microsoft Exchange System Attendant service not running Server: SRV03 The Microsoft Exchange System Attendant service on server SRV03 is not running. Tell me more about this issue and how to resolve it. Open relay test failed Server: SRV03 SMTP instance 'Default SMTP Virtual Server' on server SRV03 failed the open relay test. Restrictions are in place, but the workstation or user running this tool is capable of using the open relay. Verb return: Respond = 250 2.1.5 ExBPA-OpenRelayTest@Fabrikam.com ,. Tell me more about this issue and how to resolve it. SMTP performance warning Server: SRV03 The SMTP queue folder for instance 'Default SMTP Virtual Server' on server SRV03 is located on the same drive as the system partition. This may cause performance problems. Current queue path: C:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue. Tell me more about this issue and how to resolve it. Store service not running Server: SRV03 The Microsoft Exchange Information Store service on server SRV03 is not running. Users will be unable to access resources if this is a mailbox or public folder server. If this is a message routing server the process should be started. Tell me more about this issue and how to resolve it. WINS primary is blank Server: SRV03 The primary WINS server address for network interface '[00000009] HP Network Teaming Virtual Miniport Driver' on server srv03.citygreen.local is blank. Exchange relies on short server name resolution. Tell me more about this issue and how to resolve it. Update for daylight saving time changes in 2007 not installed Server: SRV03 Server SRV03 is running Exchange Server 2003 Service Pack 2 without the update for daylight saving time changes in 2007. Without this update, calendar items in CDO-based programs and in Outlook Web Access will operate as if standard time is in effect during the extra weeks of daylight saving time. The update is available for download from http://support.microsoft.com/kb/926666. Tell me more about this issue and how to resolve it. Application log size Server: SRV03 As a best practice, the size of the 'Application' log on server srv03.citygreen.local should be increased. The current size is 16MB. For servers running Microsoft Exchange, a size of 40MB or more is recommended. Tell me more about this setting. Network interface teaming is enabled Server: SRV03 Network interface teaming is enabled on server srv03.citygreen.local. Ensure that the latest drivers are installed. Current driver: HP Network Teaming Virtual Miniport Driver - 8.55.0.0 - 11-9-2006. SMTP server accepts basic authentication Server: SRV03 SMTP instance 'Default SMTP Virtual Server' on server SRV03 is configured to allow basic authentication. For additional security, this can be disabled on back-end mailbox servers. Tell me more about this setting. Consider implementing storage quotas Server: SRV03 Storage quotas are not implemented for mailbox store 'Mailbox Store (SRV03)' on server SRV03. Implementing quotas can improve database management and operations. Tell me more about this setting. Crash upload logging disabled Server: SRV03 Exchange fatal error information on server srv03.citygreen.local is not automatically sent to Microsoft for analysis. It is recommended that you enable this feature through the Exchange System Manager. Tell me more about this setting. Outlook connection range Server: SRV03 All versions of Outlook are allowed to access server srv03.citygreen.local. It is recommended that older versions be blocked. Tell me more about this setting.

Bill: Thank you, but the contact to the Active Domain Domain Controller do not seem to be a problem and the controler is anyway running on the same engineAndrew: Thank you, I checked that allready, seems to be ok.When gonig overthe Properties for the services which didn't start, I became aware that the "Path to executable" is empty and in the registry entry is no "ImagePath" String. I don't know if this is needed, but could this bee the problem and if though how could that happen?

Thanks againfor your answers.It seems the problem was even easier as I thought. I forgot to mention I've been called to have a look at this server and saw it the first time. Anyway when I inserted the "ImapePath" information into the registry part for the exchange services they could easily be started. Only the cheers didn't last long. After a few seconds the services where down again and the "ImagePath" information erased.At that point a thought of a Virus crossed my mind and the additional files "ganme.exe" and "autostart.ini" on my inserted USB stick gave me proof. So some how a Tojan found it's way on the server. I hopefully got rid of it.For conveniance I made a short reg script to renew the ImagePath information[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS]"ImagePath"="C:\\Program Files\\Exchsrvr\\bin\\store.exe"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeMGMT]"ImagePath"="C:\\Program Files\\Exchsrvr\\bin\\exmgmt.exe"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeMTA]"ImagePath"="C:\\Program Files\\Exchsrvr\\bin\\emsmta.exe"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeSA]"ImagePath"="C:\\Program Files\\Exchsrvr\\bin\\mad.exe"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeSRS]"ImagePath"="C:\\Program Files\\Exchsrvr\\bin\\srsmain.exe"So I'm just alittle further. As I mentioned above, I don't have any backup and therfor no idea how the registry settings should look like.Still after a while the ImagePath information for these Services is erased from the registry and I couldn't allready start other services like the IIS.But maybe I'm on the totally wrong way.

Hi,From the report, we can do a lot of things to correct the error.We may need to do one by one to let the ExBPA report to be healthy.1. Disable Anti-virus application.2. Please checkthe account which use tothe Microsoft Exchange related services. If it is local account or other. Please ensure that the it has been set to start automatically.2. Try to update Network Interface driver and storage driver.3.Exchange resident on domain controllerPlease try to make Exchange Serverto be global catalog server. You can refer to the steps inthis article4.Paging file larger than Physical MemoryThe recommended page file size is equivalent to 1.05 times the RAM up to a maximum of 4,095MB. This means that the largest paging file size per volume that you can set is 4,095MB.Please refer toarticle to change the value.5.'SystemPages' set too highPlease change value on systemPages to0. You can refer to article here.6.'HeapDeCommitFreeBlockThreshold' not setPlease follow articlehereto set value onHeapDeCommitFreeBlockThreshold7.Certificate has expired/Certificate principal mismatchPlease try to create a new certificate which Principal name shouldmatch the host address. More information you can refer to article here.After that ,please try to re-run ExBPA and post here.Also please try to find error event from event viewer and post here.Note: You can run eventvwr to open event viewer.Regards,Xiu