Re: OWA causes Information Store to stop Exchange 2003

From: Dan Townsend [MSFT] (dtown_at_online.microsoft.com)
Date: 02/10/04 

Date: Mon, 9 Feb 2004 20:09:23 -0600

Disable AV inside the GUI they offer then check this.
  1.. Start Registry Editor (Regedt32.exe).
  2.. Locate the Enabled value under the following key in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan

  3.. On the Edit menu, click DWORD, type 0, and then click OK.
  4.. Quit Registry Editor.
  5.. Start the MSExchangeIS service.
Hopefully if it crashes it will create the dump - if not you might have to
try what Rich suggested as well. 

-- 
Hope that helps,
Dan Townsend
This posting is provided "AS IS" with no warranties, and confers no rights.
Please do not send email to this address, post a reply to this newsgroup.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Dub" <dub@exchange.com> wrote in message
news:%2312SXf37DHA.452@TK2MSFTNGP11.phx.gbl...
> I use trend micro scanmail 6 for MS exchange 2003.
>
> I presume you refer to AV on exchange?  I too suspected this, and removed
> the system AV software, just leaving the trend micro for excahgne running.
>
> I have tried disabling all scanning on the services from the trend micro
> product. I certanly thought the same angle at first. But the issue I don't
> think fits with this, is the fact that only my XP Box (see the initial
post)
> will generate the error.
>
> Do you think there is any chance that the Norton AV corp client that I use
> locally on the XP box could cause the issue? and if so, still does not
> explain why another profile on the same system does not create the error.
>
> Do you think it is necessary to remove Trend Miroc AV one of the servers?
>
> Incidentally the same version of Trend Micor AV for exchange is running on
> my development server (server 1) withour error.
>
> "Dan Townsend [MSFT]" <dtown@online.microsoft.com> wrote in message
> news:eKwsn827DHA.1948@TK2MSFTNGP12.phx.gbl...
> > Looks like a silent exit - I'd assume AV is to blame.  Which version?
Can
> > you remove it and test again?  If it doesn't dump we will have a hard
time
> > troubleshooting.
> >
> > -- 
> > Hope that helps,
> > Dan Townsend
> >
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> > Please do not send email to this address, post a reply to this
newsgroup.
> >
> > Use of included script samples are subject to the terms specified at
> > http://www.microsoft.com/info/cpyright.htm
> >
> > "Dub" <dub@exchange.com> wrote in message
> > news:OXkfZ127DHA.2752@TK2MSFTNGP09.phx.gbl...
> > > Firstly..
> > >
> > > Yes there is a Event id on the win 2000 computer listed as 7031 saying
> the
> > > service terminated unexpectedly.
> > >
> > > On the 2003 server, it is a 7031 or 7034 error, depending on the
restart
> > > service settings.
> > >
> > > Now I'm no expert with dr watson.  But strangely enough, drwtsn23 does
> not
> > > record anything when the service stops.
> > >
> > > To be clear, this is what I have done:
> > > 1. Configured drwtsn32 both on server 2 and server 3 to log following
> > these
> > > instructions: http://www.hotcomm.com/FAQ/FAQ_drwatson.asp  and these
> > > http://support.microsoft.com/default.aspx?scid=kb;EN-US;308538.
> > >
> > > 2. ensured the path was valid
> > > 3. Ensured that the registry following these articles:
> > > http://www.jsiinc.com/SUBG/TIP3400/rh3478.htm
> > > http://www.jsiinc.com/SUBA/tip0200/rh0241.htm
> > >
> > > Now drwtsn32 would appear to be all ready...
> > >
> > > I then went to the Information Store Service, and ensured it was set
to
> > > "manual" and "take no action" for recovery.
> > >
> > > I then tripped the error again, event viewer is showing the event
error
> > > 7031, and drwtsn32 does not appear to see the error or log it...
> > >
> > > Any suggestions here? Can it take some time for drwtsn32 to pickup the
> > > error?
> > >
> > > "Dan Townsend [MSFT]" <dtown@online.microsoft.com> wrote in message
> > > news:%23GlpEN27DHA.2676@TK2MSFTNGP10.phx.gbl...
> > > > What is the event?  7031?  This would be in the system log when the
> > > service
> > > > stops.
> > > >
> > > > If so I would need to look at the dmp file.  Run drwtsn32 and look
at
> > the
> > > > second path.
> > > >
> > > > C:\Documents and Settings\All Users\Application Data\Microsoft\Dr
> > > > Watson\user.dmp
> > > >
> > > > Move this file off and set the service to not restart
automatically -
> > then
> > > > cause the crash again.  I would need you to zip that file (from the
> > crash
> > > > you just caused) and name it something like dtown-group.zip
> > > >
> > > > Upload it to this site and tell me what you called it.  I'll post
the
> > > answer
> > > > here after I look at it.
> > > > ftp://ftppss.microsoft.com/Incoming/Mail/
> > > >
> > > > -- 
> > > > Hope that helps,
> > > > Dan Townsend
> > > >
> > > > This posting is provided "AS IS" with no warranties, and confers no
> > > rights.
> > > > Please do not send email to this address, post a reply to this
> > newsgroup.
> > > >
> > > > Use of included script samples are subject to the terms specified at
> > > > http://www.microsoft.com/info/cpyright.htm
> > > >
> > > > "Dub" <dub@exchange.com> wrote in message
> > > > news:%23CMKVjx7DHA.696@tk2msftngp13.phx.gbl...
> > > > > I have a new and rather strange problem.
> > > > >
> > > > > Just this last week, I have come to an exchange server to find the
> > > > > Information Store stopped, with a corresponding useless message in
> the
> > > > event
> > > > > viewer stating that the service has stopped.
> > > > >
> > > > > I am an administrator for several exchange servers on several
> networks
> > > and
> > > > > did the following research.
> > > > >
> > > > > Call it:
> > > > > XP Box = my win xp computer updated, virus free running
development
> > > > software
> > > > > of MS products.
> > > > > server1= My development / test server running win 2003 with
Exchange
> > > 2003.
> > > > > Server2 = Win 2k running exchange 2003
> > > > > Server3= win 2003 running exchange 2003
> > > > >
> > > > > So any time I connect from my Win XP system to either server 2 or
3
> > via
> > > > OWA,
> > > > > and send a message, it will stop the Information Store on that
> server
> > > with
> > > > > the associated event id's
> > > > >
> > > > > If I connect via any other of my workstations that I have tested
on
> > many
> > > > > different networks, no problem sending via OWA on server 1,2 or 3.
> > This
> > > > > includes systems running same updated version of XP with same
(last
> > week
> > > > > patched) version of ie 6. I can also log into another profile on
my
> XP
> > > > > computer, connect to server 2 or 3 via owa, send a message with no
> > > > problem.
> > > > >
> > > > > So this got me looking at my profile in XP. Significantly that the
> > > profile
> > > > > uses Outlook 2003 to connect to server 1 running exchange as
listed
> > > above.
> > > > I
> > > > > notice that any time I log into exchange 2003 via owa and send a
> > > message,
> > > > > the window opens an hour glass and gives a message "Resolving
> > > recipients"
> > > > > for a few seconds, and then craps out with a message reflecting
the
> > fact
> > > > > that the Information Store has stopped.
> > > > >
> > > > > So I created a profile on my XP box, logged into server 1 with
> outlook
> > > > 2003,
> > > > > creating an offline connection (locally cached etc). Then with
this
> > new
> > > > > profile I tested the problem above.... and sure enough I am able
to
> > stop
> > > > the
> > > > > information store on any server (except server 1 that naturally
has
> > the
> > > > > connection with outlook).
> > > > >
> > > > > So next test was a laptop (win tablet xp) with same outlook 2003
and
> > > > patched
> > > > > the same as the XP box. Using a similar profile, same network, and
> an
> > > > > offline connection with the same server 1 exchange. I.me. trying
to
> > > > closely
> > > > > replicate the problem profile on XP box. Log in to server 2 and 3
> and
> > > send
> > > > > mail without any problem....... STRANGE HAY!
> > > > >
> > > > > So my questions go something like this...
> > > > >
> > > > > 1. Have I discovered a bug?  or have I consistently missconfigured
> the
> > > > > exchange servers that otherwise run without fault (well with
normal
> > > > > problems).
> > > > > 2, Has anyone seen this b4?
> > > > > 3. Has anyone got any bright idea's on solving this. Most of the
> > > > Information
> > > > > Store stopping issues related to pre sp3 2000 versions of
exchange.
> or
> > > > > should I be looking at outlook and the way it integrates with OWA
> and
> > > > > address lookup?
> > > > > 4.Could it be related to the recent service pack for IE? I have
not
> > > > noticed
> > > > > the problem b4 and suspect I would have (only suspect I would
have,
> > not
> > > > > certain)?
> > > > >
> > > > > Lastly.... does anyone have an exchange server running OWA that I
> can
> > > log
> > > > > into with a test account and see if I can bring down your
> information
> > > > store?
> > > > > The idea being a server that I have not had my hands on? if yes,
> just
> > > drop
> > > > > me a line at:   "dub(spammenot) at
(spammenot)solutions-server.com"
> > > > >
> > > > > Just remember to set the information store service to auto recover
> > after
> > > 1
> > > > > min.  (interestingly the service stops clean and can be started by
> the
> > > > > server again).
> > > > >
> > > > > Any help is greatly appreciated
> > > > >
> > > > > David Finley
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Relevant Pages

  • Re: Convincing the boss to move to Exchange
    ... You would be substituting Trend Micro for Symantec. ... Trend to server and, finally, install it to the workstations. ... Will Trend for Exchange work with Symantec Corporate AV? ...
    (microsoft.public.windows.server.sbs)
  • Re: RPC Over HTTP Security
    ... or add the keys that do not exist to my Exchange ... Warning If you use Registry Editor incorrectly, ... >> Server accounts from the Internet when they are working outside your ... This is accomplished because RPC over HTTP ...
    (microsoft.public.exchange2000.general)
  • Re: relay within domain with fake user accounts
    ... Trend Micro SMB as our anti virus / spam software running on the DC ... Looking at trends virus logs I see that the exchange server ... Do you allow your SMTP server to relay for internal IP ...
    (microsoft.public.exchange.admin)
  • Re: OWA causes Information Store to stop Exchange 2003
    ... I am really interested to see if I can stop a store on someone elses server. ... > Please do not send email to this address, post a reply to this newsgroup. ... >> I presume you refer to AV on exchange? ... >> I have tried disabling all scanning on the services from the trend micro ...
    (microsoft.public.exchange.admin)
  • Re: RPC over HTTP - have you gotten it to work?
    ... Go into the Exchange System Manager. ... Highlight your Exchange server object ... Start Registry Editor. ...
    (microsoft.public.outlook)