Hi Guys I'm primarily a MS SQL DBA, but I'm filling in as a Exchange Admin for my company We're running MS Exchange 2007 SP1 (version 08.01.0240.006) on Windows Server 2003 Standard x64 SP2. We're also running a second Exchange serverfor DR that utilises Exchanges 2007 Standby Continuous Replication. Today both Exchange servers dropped off the network and had to be physically powered off before they were accesible again. They were not responding to RDP, ping, or console login. After restarting I noted the following messages in the Windows Event Log, Code Snippet =============================================Error #1 - Logged to Application Event Log=============================================Event Type:InformationEvent Source:MSExchange ADAccessEvent Category:Topology Event ID:2080Date:11/06/2008Time:2:22:14 PMUser:N/AComputer:EXC01Description:Process STORE.EXE (PID=2316). Exchange Active Directory Provider has discovered the following servers with the following characteristics: (Server name | Roles | Enabled | Reachability | Synchronized | GC capable | PDC | SACL right | Critical Data | Netlogon | OS Version) In-site:<domain controller>CDG 1 7 7 1 0 1 1 7 1Out-of-site: For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. =============================================Error #2 - Logged to Application Event Log=============================================Event Type:ErrorEvent Source:MSExchange ADAccessEvent Category:Topology Event ID:2102Date:11/06/2008Time:2:26:58 PMUser:N/AComputer:EXC01Description:Process MAD.EXE (PID=2656). All Domain Controller Servers in use are not responding: <domain controller> For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. =============================================Error #3 - Logged to Application Event Log=============================================Event Type:ErrorEvent Source:MSExchange System Attendant MailboxEvent Category:General Event ID:4001Date:11/06/2008Time:2:27:32 PMUser:N/AComputer:EXC01Description:A transient failure has occurred. The problem may resolve itself in awhile. The service will retry in 56 seconds. Diagnostic information: Could not find any available Domain Controller.Microsoft.Exchange.Data.Directory.ADTransientException: Could not find any available Domain Controller. at Microsoft.Exchange.Data.Directory.ConnectionPoolManager.GetConnection(ConnectionType connectionType, ADObjectId domain, String serverName, Int32 port, NetworkCredential credential) at Microsoft.Exchange.Data.Directory.ConnectionPoolManager.GetConnection(ConnectionType connectionType) at Microsoft.Exchange.Data.Directory.ADSession.GetConnection(String preferredServer, Boolean isWriteOperation, Boolean isNotifyOperation, ADObjectId& rootId) at Microsoft.Exchange.Data.Directory.ADSession.GetReadConnection(String preferredServer, ADObjectId& rootId) at Microsoft.Exchange.Data.Directory.ADSession.Find(ADObjectId rootId, String optionalBaseDN, ADObjectId readId, QueryScope scope, QueryFilter filter, SortBy sortBy, Int32 maxResults, IEnumerable`1 properties, CreateObjectDelegate objectCreator, CreateObjectsDelegate arrayCreator) at Microsoft.Exchange.Data.Directory.ADSession.Find(ADObjectId rootId, QueryScope scope, QueryFilter filter, SortBy sortBy, Int32 maxResults, IEnumerable`1 properties, CreateObjectDelegate objectCtor, CreateObjectsDelegate arrayCtor) at Microsoft.Exchange.Data.Directory.ADSession.Find[TResult](ADObjectId rootId, QueryScope scope, QueryFilter filter, SortBy sortBy, Int32 maxResults, IEnumerable`1 properties) at Microsoft.Exchange.Data.Directory.SystemConfiguration.ADSystemConfigurationSession.Find[TResult](ADObjectId rootId, QueryScope scope, QueryFilter filter, SortBy sortBy, Int32 maxResults) at Microsoft.Exchange.Data.Directory.SystemConfiguration.ADSystemConfigurationSession.FindServerByFqdn(String serverFqdn) at Microsoft.Exchange.Data.Directory.SystemConfiguration.ADSystemConfigurationSession.FindLocalServer() at Microsoft.Exchange.Servicelets.SystemAttendantMailbox.Servicelet.Work() For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. =============================================Error #4 - Logged to Application Event Log=============================================Event Type:ErrorEvent Source:MSExchange ADAccessEvent Category:Topology Event ID:2103Date:11/06/2008Time:2:27:58 PMUser:N/AComputer:EXC01Description:Process MAD.EXE (PID=2656). All Global Catalog Servers in forest DC=<domain>,DC=<domain> are not responding: <domain controller> For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. =============================================Error #5 - Logged to Application Event Log=============================================Event Type:ErrorEvent Source:MSExchange ADAccessEvent Category:Topology Event ID:2104Date:11/06/2008Time:2:28:12 PMUser:N/AComputer:EXC01Description:Process MSEXCHANGEADTOPOLOGYSERVICE.EXE (PID=1224). None of the domain controllers in the domain are responding. This event can occur if the domain controllers in local or all domains become unreachable because of network problems. Use the Ping or PathPing command-line tools to test network connectivity to local domain controllers. Run the Dcdiag command line tool to test domain controller health. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. =============================================Error #6 - Logged to Application Event Log=============================================Event Type:ErrorEvent Source:MSExchangeSAEvent Category:General Event ID:9385Date:11/06/2008Time:2:28:24 PMUser:N/AComputer:EXC01Description:Microsoft Exchange System Attendant failed to read the membership of the universal security group '/dc=<domain>/dc=<domain>/ou=Microsoft Exchange Security Groups/cn=Exchange Servers'; the error code was '8007203a'. The problem might be that the Microsoft Exchange System Attendant does not have permission to read the membership of the group. If this computer is not a member of the group '/dc=<domain>/dc=<domain>/ou=Microsoft Exchange Security Groups/cn=Exchange Servers', you should manually stop all Microsoft Exchange services, run the task 'add-ExchangeServerGroupMember,' and then restart all Microsoft Exchange services. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. =============================================Error #7 - Logged to Application Event Log=============================================Event Type:ErrorEvent Source:MSExchange ADAccessEvent Category:Topology Event ID:2120Date:11/06/2008Time:2:28:24 PMUser:N/AComputer:EXC01Description:Process MSEXCHANGEADTOPOLOGYSERVICE.EXE (PID=1224). Error ERROR_TIMEOUT (0x800705b4) occurred when DNS was queried for the service location (SRV) resource record used to locate a domain controller for domain <domain>.<domain>The query was for the SRV record for _ldap._tcp.dc._msdcs.<domain>.<domain>. The DNS servers used by this computer for name resolution are not responding. This computer is configured to use DNS servers with the following IP addresses:10.10.1.1 . Verify that this computer is connected to the network, that these are the correct DNS server IP addresses, and that at least one of the DNS servers is running.For information about correcting this problem, type in the command line:hh tcpip.chm::/sag_DNS_tro_dcLocator_messageB.htm For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. =============================================Error #8 - logged to System Event Log=============================================Event Type:ErrorEvent Source:NETLOGONEvent Category:NoneEvent ID:5719Date:11/06/2008Time:2:29:26 PMUser:N/AComputer:EXC01Description:This computer was not able to set up a secure session with a domain controller in domain <domain> due to the following: There are currently no logon servers available to service the logon request. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator. ADDITIONAL INFO If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Data:0000: 5e 00 00 c0 ^.. =============================================Error #9 - logged to System Event Log=============================================Event Type:WarningEvent Source:DnsApiEvent Category:NoneEvent ID:11164Date:11/06/2008Time:3:25:47 PMUser:N/AComputer:EXC01Description:The system failed to register host (A) resource records (RRs) for network adapterwith settings: Adapter Name : {72F83E99-B0C1-4EB1-B0D5-A969C271D6E7} Host Name : exc01 Primary Domain Suffix : <domain>.<domain> DNS server list : 10.1.1.1 Sent update to server : <?> IP Address(es) : 10.1.1.30 The reason the system could not register these RRs was because either (a) the DNS server does not support the DNS dynamic update protocol, or (b) the authoritative zone for the specified DNS domain name does not accept dynamic updates. To register the DNS host (A) resource records using the specific DNS domain name and IP addresses for this adapter, contact your DNS server or network systems administrator. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Data:0000: b4 05 00 00 ... Apart from these, there were no other errors reported in the event logs. Before physically powering off the server I was able to successfully RDP to the Domain Controller, Web Server and ISA Server without any problems. No errors were reported in any of their event logs to indicate a problem. Hopefully someone can give me a pointer or two so I can try and track down why our Exchange servers suddenly died. Thanks Phil

Hi Phil, After checking event logs as well as symptom you described, it is similar to the issue relevant to KB936594. For more detailed information, please check below articles ============================================ You may experience network-related problems after you install Windows Server 2003 SP2 or the Scalable Networking Pack on a Windows Server 2003-based computer Windows 2003 Scalable Networking pack and its possible effects on Exchange Meanwhile, below is a similar thread(with the same Event ID 5179) inwhich I provided some additional troubleshooting steps such as using EXBPA and DCDIAG. http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=3406845&SiteID=17 Hope you can fix it soon. Jason