Re: Monitoring and Alerts

Hi John,

Thanks for your update.

From the icw log, I find many errors as following:

Error 0x1 returned from call to RegisterMSBOExchangeBP().
Error 0x80072030 returned from call to ADsGetObject().
Error 0x80070057 returned from call to Reading the UPNP selection().
ISA2k Autodial rule does not exist, ignoring the error
Cannot find the firewall rule, ignoring the error
*** Getting Sbs web listener certificate hash returned ERROR 8007007a
*** Saving ISA2k4 changes returned ERROR c0040393
*** Enabling SSL with ISA returned ERROR c0040393
*** CCertCommit::EnableSSL returned ERROR c0040393
*** CCertCommit::CommitEx returned ERROR c0040393
Error 0xc0040393 returned from call to Saving ISA2k4 changes().
Error 0xc0040393 returned from call to CStingrayCommit::CommitEx().

To resolve this issue, make sure that the Network Service account is added
to the following policy settings on the domain controller:

Make sure that the Network Service account is added to the following policy
settings on the domain controller:

- Adjust memory quotas for a process
- Generate security audits
- Log on as a service
- Replace a process level token.

You can do so as following (It is an example for Generate security audits):

1. In Server Management, expand Advanced Management\Group Policy
Management, drill down to Domain Controllers and right-click Default Domain
Controllers Policy, then click Edit.
2. Expand Computer Configuration\Windows Settings\Security Settings\Local
Policies, click User Rights Assignment.
3. In the right pane, double-click Generate security audits, make sure
NETWORK SERVICE and LOCAL SERVICE are listed. If not, add them. Close Group
Policy Object Editor.
4. Restart the server and test again.

Regarding Error 0x1 returned from call to RegisterMSBOExchangeBP() and
Error 0x80072030 returned from call to ADsGetObject(), I'd like to provide
you with the following suggestions:

Suggestion 1.

1. Start the Routing and Remote Access console.
2. Right click on the server and select Disable Routing and Remote Access.
3. Rerun the Internet Connection Wizard.

Suggestion 2.

If Suggestion 1 cannot solve the problem, please check KB 840686. If you're
able to find related error message in Event Log, please follow KB 840686 to
solve the issue.

You cannot start the Routing and Remote Access service on a Windows 2000
Server-based computer or on a Windows Server 2003-based computer
http://support.microsoft.com/default.aspx?scid=KB;EN-US;840686

Suggestion 3.

The Error 0x1 returned from call to RegisterMSBOExchangeBP() error may
caused by:

1. The secatts.dll file may be missing.
2. The secatts.dll file may be damaged.
3. The secatts.dll file may be unregistered.

Please follow these steps to solve the issue:

1. Restore the secatts.dll file from the SBS2003 CD to the following path:

c:\program files\Microsoft Windows Small Business Server\Networking

2. Click Start and Click Run.
3. Type cmd and click OK.
4. Naviagte to the following path: c:\program files\Microsoft Windows
Small Business Server\Networking.
5. Type the following command: regsvr32 secatts.dll.
6. Try re-run CEICW.

If the issue still occurs, to save your time, you may need to contact CSS
for better support.

A suggestion would be to contact Microsoft Product Support Services via
telephone so that a dedicated Support Professional can assist with your
request. Please be advised that contacting phone support will be a charged
call. However, if you are simply requesting a hotfix be sent to you and no
other support then charges are usually refunded or waived.

To obtain the phone numbers for specific technology request please take a
look at the web site listed below.

http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS

If you are outside the US please see http://support.microsoft.com for
regional support phone numbers.

Thanks for your understanding!

Best regards,

Crina Li (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.

=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| From: "John" <spam001(at)plasticcircus(dot)com>
|| Subject: Re: Monitoring and Alerts
| Date: Wed, 31 May 2006 09:31:08 -0700
| | Newsgroups: microsoft.public.windows.server.sbs
| |
| > I have discussed with other engineers and the command may have some
| > problem. You need to type the following:
| >
| > "winmgmt /clearadap" and "winmgmt /resyncperf"
|
| I searched and found winmgmt and was able to run the above commands.
|
| > Regarding CEICW, do you mean you can not run CEICW successfully now? If
| > so,
| > would you please help me collect the following information?
| >
|
| Correct ever since I executed the command "secedit /configure /cfg
| %windir%\repair\secsetup.inf /db secsetup.sdb /verbose" as you
instructed, I
| have not been able to successfully run the CEICW. In addition, my
firewall
| service and routing and remote access service both fail on restart. I
have
| to re run the ISA template wizard to get back on line.
|
| Currently we remote web workplace site is down because of the CEICW
errors.
|
| I have sent you my log and a screen shot of the error.
|
| Thank you,
|
| John
|
|
| ""Crina Li"" <v-crinal@xxxxxxxxxxxxxxxxxxxx> wrote in message
| news:VW$gDGJhGHA.5184@xxxxxxxxxxxxxxxxxxxxxxxx
| > Hi John,
| >
| > Thanks for your update.
| >
| > I have discussed with other engineers and the command may have some
| > problem. You need to type the following:
| >
| > "winmgmt /clearadap" and "winmgmt /resyncperf"
| >
| > I am sorry for any inconvenience it may cause. Thanks for your
| > understanding!
| >
| > Regarding CEICW, do you mean you can not run CEICW successfully now? If
| > so,
| > would you please help me collect the following information?
| >
| > 1. What is the error message you received after running CEICW?
| > 2. Please send the file "C:\Program Files\Microsoft Windows Small
Business
| > Server\Support\icwlog.txt" to me at v-crinal@xxxxxxxxxxxxx for analysis.
| >
| > I appreciate your time and look forward to hearing from you.
| >
| > Best regards,
| >
| > Crina Li (MSFT)
| >
| > Microsoft CSS Online Newsgroup Support
| >
| > Get Secure! - www.microsoft.com/security
| >
| > =====================================================
| > This newsgroup only focuses on SBS technical issues. If you have issues
| > regarding other Microsoft products, you'd better post in the
corresponding
| > newsgroups so that they can be resolved in an efficient and timely
manner.
| > You can locate the newsgroup here:
| > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
| >
| > When opening a new thread via the web interface, we recommend you check
| > the
| > "Notify me of replies" box to receive e-mail notifications when there
are
| > any updates in your thread. When responding to posts via your
newsreader,
| > please "Reply to Group" so that others may learn and benefit from your
| > issue.
| >
| > Microsoft engineers can only focus on one issue per thread. Although we
| > provide other information for your reference, we recommend you post
| > different incidents in different threads to keep the thread clean. In
| > doing
| > so, it will ensure your issues are resolved in a timely manner.
| >
| > For urgent issues, you may want to contact Microsoft CSS directly.
Please
| > check http://support.microsoft.com for regional support phone numbers.
| >
| > Any input or comments in this thread are highly appreciated.
| >
| > =====================================================
| >
| > This posting is provided "AS IS" with no warranties, and confers no
| > rights.
| > --------------------
| > | From: "John" <spam001(at)plasticcircus(dot)com>
| > | References: <eIu7z#cfGHA.4464@xxxxxxxxxxxxxxxxxxxx>
| > <LT4cvxkfGHA.4336@xxxxxxxxxxxxxxxxxxxxx>
| > <OeYSPsBgGHA.1520@xxxxxxxxxxxxxxxxxxxx>
| > <zghAEpJgGHA.1740@xxxxxxxxxxxxxxxxxxxxx>
| > <Oxn62xQgGHA.1856@xxxxxxxxxxxxxxxxxxxx>
| > <Go8Bf9vgGHA.5608@xxxxxxxxxxxxxxxxxxxxx>
| > <u4lD0A4gGHA.1856@xxxxxxxxxxxxxxxxxxxx>
| > <cw8uNh6gGHA.3960@xxxxxxxxxxxxxxxxxxxxx>
| > | Subject: Re: Monitoring and Alerts
| > | Date: Tue, 30 May 2006 08:34:49 -0700
| > | Lines: 787
| > | X-Priority: 3
| > | X-MSMail-Priority: Normal
| > | X-Newsreader: Microsoft Outlook Express 6.00.2900.2869
| > | X-RFC2646: Format=Flowed; Original
| > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
| > | Message-ID: <eI9nS6$gGHA.4712@xxxxxxxxxxxxxxxxxxxx>
| > | Newsgroups: microsoft.public.windows.server.sbs
| > | NNTP-Posting-Host: user-v8lmf6j.cable.mindspring.com 209.91.60.211
| > | Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP05.phx.gbl
| > | Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:271736
| > | X-Tomcat-NG: microsoft.public.windows.server.sbs
| > |
| > | Now when I try to run the CEICW and instruct it not to change my email
| > | settings network configuration, firewall configuration, and secure
| > website
| > | configuration all fail.
| > |
| > |
| > |
| > | ""Crina Li"" <v-crinal@xxxxxxxxxxxxxxxxxxxx> wrote in message
| > | news:cw8uNh6gGHA.3960@xxxxxxxxxxxxxxxxxxxxxxxx
| > | > Hi John
| > | >
| > | > Thanks for your update.
| > | >
| > | > You can try the following steps to see how thing goes:
| > | >
| > | > Stop and Disabled the WMI service. Follow the below steps to
| > re-register
| > | > all WMI modules:
| > | >
| > | > 1. Click Start, click Run, type cmd , and then click OK.
| > | > 2. Type the following command to change the folder to the WMI
folder:
| > | >
| > | > cd %windir%\system32\wbem
| > | >
| > | > 3. Type the following command to re-register the WMI DLLs:
| > | >
| > | > "for /f %s in ('dir /b /s *.dll') do regsvr32 /s %s" (without the
| > | > quotation
| > | > marks)
| > | >
| > | > 4. Type exit , and then press ENTER to close the Command Prompt
| > window.
| > | >
| > | > After this command is completed, start the WMI service and run this
| > | > command
| > | > [Note: you may need to run the command in the prompt c:\>]:
| > | >
| > | > "wmiprvse /regserver"
| > | >
| > | > Also run the following commands: wmimgmt /clearadap and wmimgmt
| > | > /resyncperf.
| > | >
| > | > After doing so, check if the issue still occurs. If so, please rerun
| > | > CEICW.
| > | >
| > | > Thanks for your time and I look forward to hearing from you.
| > | >
| > | > Best regards,
| > | >
| > | > Crina Li (MSFT)
| > | >
| > | > Microsoft CSS Online Newsgroup Support
| > | >
| > | > Get Secure! - www.microsoft.com/security
| > | >
| > | > =====================================================
| > | > This newsgroup only focuses on SBS technical issues. If you have
| > issues
| > | > regarding other Microsoft products, you'd better post in the
| > corresponding
| > | > newsgroups so that they can be resolved in an efficient and timely
| > manner.
| > | > You can locate the newsgroup here:
| > | > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
| > | >
| > | > When opening a new thread via the web interface, we recommend you
| > check
| > | > the
| > | > "Notify me of replies" box to receive e-mail notifications when
there
| > are
| > | > any updates in your thread. When responding to posts via your
| > newsreader,
| > | > please "Reply to Group" so that others may learn and benefit from
your
| > | > issue.
| > | >
| > | > Microsoft engineers can only focus on one issue per thread.
Although
| > we
| > | > provide other information for your reference, we recommend you post
| > | > different incidents in different threads to keep the thread clean.
In
| > | > doing
| > | > so, it will ensure your issues are resolved in a timely manner.
| > | >
| > | > For urgent issues, you may want to contact Microsoft CSS directly.
| > Please
| > | > check http://support.microsoft.com for regional support phone
numbers.
| > | >
| > | > Any input or comments in this thread are highly appreciated.
| > | >
| > | > =====================================================
| > | >
| > | > This posting is provided "AS IS" with no warranties, and confers no
| > | > rights.
| > | > --------------------
| > | > | From: "John" <spam001(at)plasticcircus(dot)com>
| > | > | References: <eIu7z#cfGHA.4464@xxxxxxxxxxxxxxxxxxxx>
| > | > <LT4cvxkfGHA.4336@xxxxxxxxxxxxxxxxxxxxx>
| > | > <OeYSPsBgGHA.1520@xxxxxxxxxxxxxxxxxxxx>
| > | > <zghAEpJgGHA.1740@xxxxxxxxxxxxxxxxxxxxx>
| > | > <Oxn62xQgGHA.1856@xxxxxxxxxxxxxxxxxxxx>
| > | > <Go8Bf9vgGHA.5608@xxxxxxxxxxxxxxxxxxxxx>
| > | > | Subject: Re: Monitoring and Alerts
| > | > | Date: Mon, 29 May 2006 17:30:04 -0700
| > | > | Lines: 580
| > | > | X-Priority: 3
| > | > | X-MSMail-Priority: Normal
| > | > | X-Newsreader: Microsoft Outlook Express 6.00.2900.2869
| > | > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
| > | > | X-RFC2646: Format=Flowed; Original
| > | > | Message-ID: <u4lD0A4gGHA.1856@xxxxxxxxxxxxxxxxxxxx>
| > | > | Newsgroups: microsoft.public.windows.server.sbs
| > | > | NNTP-Posting-Host: user-v8lmf6j.cable.mindspring.com 209.91.60.211
| > | > | Path:
| > TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP03.phx.gbl
| > | > | Xref: TK2MSFTNGXA01.phx.gbl
| > microsoft.public.windows.server.sbs:271639
| > | > | X-Tomcat-NG: microsoft.public.windows.server.sbs
| > | > |
| > | > | > Please first refer to the KB article below to verify the Binding
| > Order
| > | > and
| > | > | > Relay settings for Exchange SMTP Virtual Server:
| > | > |
| > | > | All my settings are correct.
| > | > |
| > | > | > 1. Start -> Run -> DCOMCNFG, Expand Component Services node,
| > Expand
| > | > | > Computers node, Right click My Computer node, Properties, Select
| > | > Default
| > | > | > COM Security tab:
| > | > | >
| > | > | > Under "Default Launch Permissions" you should ensure that at
least
| > | > | > INTERACTIVE, SYSTEM, and Administrators have "Allow Launch".
| > | > | >
| > | > | > The "Default Access Permissions" should only list the following
| > | > accounts:
| > | > | >
| > | > | > 2000: empty
| > | > | > XP: SYSTEM
| > | > | > 2003: SELF, SYSTEM
| > | > |
| > | > | my settings are correct.
| > | > |
| > | > | >
| > | > | > As an alternative you can export (for backup) and then delete
the
| > | > | > following
| > | > | > registry key to restore the original default values.
| > | > | > HKLM\SOFTWARE\Microsoft\Ole\DefaultAccessPermission.
| > | > | >
| > | > | > 2. Go to DCOM Config node now, Right click Windows Management
| > [and]
| > | > | > Instrumentation, Properties:
| > | > | >
| > | > | > Here are some of the settings you should verify.
| > | > | > Authentication Level: Default
| > | > | > Launch Permissions: Use Default (2000) or Everyone (XP/2003)
| > | > | > Access Permissions: Use Default
| > | > |
| > | > | My settings are correct.
| > | > |
| > | > | >
| > | > | > 3. Go to Services, Double click on "Windows Management
| > | > Instrumentation":
| > | > | > Under "General" tab verify that Startup Type is set to
| > "Automatic".
| > | > Under
| > | > | > "Log On" tab verify that "Local System account" is selected.
| > | > | > 4. Start "gpedit.msc" and navigate down to "Local Computer
| > Policy ->
| > | > | > Computer Configuration -> Windows Settings -> Security Settings
->
| > | > Local
| > | > | > Policies -> User Rights Assignment". Verify that the SERVICE
| > account
| > | > is
| > | > | > specifically granted "Impersonate a client after Authentication"
| > | > rights.
| > | > |
| > | > | My settings are correct.
| > | > |
| > | > | > 5. A very important step that fixes this issue most number of
| > times
| > is
| > | > by
| > | > | > running this command:
| > | > | >
| > | > | > From Start->Run-> Type:> "secedit /configure /cfg
| > | > | > %windir%\repair\secsetup.inf /db secsetup.sdb /verbose" and
reboot
| > the
| > | > | > server.
| > | > |
| > | > | I ran this command successfully. After rebooting, the firewall
| > service
| > | > | could not start also causing the routing and remote access
service
| > to
| > | > fail.
| > | > | After connecting a monitor and keyboard to the computer and
logging
| > on
| > | > | locally I was still not able to get the service to start. I
re-ran
| > the
| > | > ISA
| > | > | network topology wizard, and was then able to start the firewall
| > | > service.
| > | > I
| > | > | must then run the internet connection wizard to enable my outlook
| > via
| > | > the
| > | > | web, outlook mobile access, Terminal services, etc. The wizard
| > fails
| > | > when
| > | > | it tries to create the Secured website, and If I restart the
server
| > the
| > | > | firewall service will fail again.
| > | > |
| > | > | >
| > | > | > 6. Re-Register all WMI DLLs. Stop and Disabled the WMI service.
| > From
| > | > the
| > | > | > command prompt run the following command to re-register all WMI
| > | > modules:
| > | > | >
| > | > | > "for /f %s in ('dir /b /s *.dll') do regsvr32 /s %s"
| > | > |
| > | > | I entered this command into both my dos command prompt and into
the
| > run
| > | > | entry box and both failed.
| > | > |
| > | > | >
| > | > | > After this command is complete, start the WMI service and run
this
| > | > | > command:
| > | > | >
| > | > | > "wmiprvse /regserver"
| > | > |
| > | > | I ran this but was not provided and response from the application.
| > | > |
| > | > | >
| > | > | > Also run the following commands: wmimgmt /clearadap and wmimgmt
| > | > | > /resyncperf.
| > | > | >
| > | > |
| > | > | I wasn't able to run either of these, I received a bad command or
| > file
| > | > name
| > | > | error. there doesn't appear to be "wmimgmt" executable, just the
| > mmc
| > | > | snap-in.
| > | > |
| > | > | through-out all of this, I didn't receive a performance alert.
| > | > |
| > | > | Please help me get my SBS remote workplace site back up and
running
| > | > before
| > | > | we pursue the performance alerts issue further.
| > | > |
| > | > | Thank you,
| > | > | John
| > | > |
| > | > |
| > | > | ""Crina Li"" <v-crinal@xxxxxxxxxxxxxxxxxxxx> wrote in message
| > | > | news:Go8Bf9vgGHA.5608@xxxxxxxxxxxxxxxxxxxxxxxx
| > | > | > Hi John,
| > | > | >
| > | > | > Thanks for your update.
| > | > | >
| > | > | > I am sorry for the delayed response due to weekend. Please
| > understand
| > | > that
| > | > | > the newsgroups are staffed weekdays by Microsoft Support
| > professionals
| > | > to
| > | > | > answer your systems and applications questions. Your
understanding
| > is
| > | > | > greatly appreciated!
| > | > | >
| > | > | > From the reply, the process of sending the e-mail fails, and
| > Health
| > | > | > Monitor
| > | > | > indicates that "Action failed. 0x8004100a"
| > | > | >
| > | > | > As I know, the issue may be caused by the following:
| > | > | >
| > | > | > I. This behavior can occur because the Simple Mail Transfer
| > Protocol
| > | > | > (SMTP)
| > | > | > virtual server relay settings that run on an Exchange 2003-based
| > | > server
| > | > | > are
| > | > | > not configured correctly. This behavior may also occur if the
| > server
| > | > is
| > | > | > multi-homed and the external interface is listed first in the
| > binding
| > | > | > order.
| > | > | >
| > | > | > Please first refer to the KB article below to verify the Binding
| > Order
| > | > and
| > | > | > Relay settings for Exchange SMTP Virtual Server:
| > | > | >
| > | > | > 280043 Health Monitor May Be Unable to Send E-Mail via Local
| > Exchange
| > | > SMTP
| > | > | > Server
| > | > | > http://support.microsoft.com/default.aspx?scid=kb;EN-US;280043
| > | > | >
| > | > | > Try again to see if the problem still occurs.
| > | > | >
| > | > | > II. It also is related WMI. You may follow these steps in order
to
| > | > resolve
| > | > | > WMI issues in general, check WMI at each step:
| > | > | >
| > | > | > 1. Start -> Run -> DCOMCNFG, Expand Component Services node,
| > Expand
| > | > | > Computers node, Right click My Computer node, Properties, Select
| > | > Default
| > | > | > COM Security tab:
| > | > | >
| > | > | > Under "Default Launch Permissions" you should ensure that at
least
| > | > | > INTERACTIVE, SYSTEM, and Administrators have "Allow Launch".
| > | > | >
| > | > | > The "Default Access Permissions" should only list the following
| > | > accounts:
| > | > | >
| > | > | > 2000: empty
| > | > | > XP: SYSTEM
| > | > | > 2003: SELF, SYSTEM
| > | > | >
| > | > | > As an alternative you can export (for backup) and then delete
the
| > | > | > following
| > | > | > registry key to restore the original default values.
| > | > | > HKLM\SOFTWARE\Microsoft\Ole\DefaultAccessPermission.
| > | > | >
| > | > | > 2. Go to DCOM Config node now, Right click Windows Management
| > [and]
| > | > | > Instrumentation, Properties:
| > | > | >
| > | > | > Here are some of the settings you should verify.
| > | > | > Authentication Level: Default
| > | > | > Launch Permissions: Use Default (2000) or Everyone (XP/2003)
| > | > | > Access Permissions: Use Default
| > | > | >
| > | > | > 3. Go to Services, Double click on "Windows Management
| > | > Instrumentation":
| > | > | > Under "General" tab verify that Startup Type is set to
| > "Automatic".
| > | > Under
| > | > | > "Log On" tab verify that "Local System account" is selected.
| > | > | > 4. Start "gpedit.msc" and navigate down to "Local Computer
| > Policy ->
| > | > | > Computer Configuration -> Windows Settings -> Security Settings
->
| > | > Local
| > | > | > Policies -> User Rights Assignment". Verify that the SERVICE
| > account
| > | > is
| > | > | > specifically granted "Impersonate a client after Authentication"
| > | > rights.
| > | > | > 5. A very important step that fixes this issue most number of
| > times
| > is
| > | > by
| > | > | > running this command:
| > | > | >
| > | > | > From Start->Run-> Type:> "secedit /configure /cfg
| > | > | > %windir%\repair\secsetup.inf /db secsetup.sdb /verbose" and
reboot
| > the
| > | > | > server.
| > | > | >
| > | > | > 6. Re-Register all WMI DLLs. Stop and Disabled the WMI service.
| > From
| > | > the
| > | > | > command prompt run the following command to re-register all WMI
| > | > modules:
| > | > | >
| > | > | > "for /f %s in ('dir /b /s *.dll') do regsvr32 /s %s"
| > | > | >
| > | > | > After this command is complete, start the WMI service and run
this
| > | > | > command:
| > | > | >
| > | > | > "wmiprvse /regserver"
| > | > | >
| > | > | > Also run the following commands: wmimgmt /clearadap and wmimgmt
| > | > | > /resyncperf.
| > | > | >
| > | > | > I appreciate your time and look forward to hearing from you.
| > | > | >
| > | > | > Best regards,
| > | > | >
| > | > | > Crina Li (MSFT)
| > | > | >
| > | > | > Microsoft CSS Online Newsgroup Support
| > | > | >
| > | > | > Get Secure! - www.microsoft.com/security
| > | > | >
| > | > | > =====================================================
| > | > | > This newsgroup only focuses on SBS technical issues. If you have
| > | > issues
| > | > | > regarding other Microsoft products, you'd better post in the
| > | > corresponding
| > | > | > newsgroups so that they can be resolved in an efficient and
timely
| > | > manner.
| > | > | > You can locate the newsgroup here:
| > | > | >
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
| > | > | >
| > | > | > When opening a new thread via the web interface, we recommend
you
| > | > check
| > | > | > the
| > | > | > "Notify me of replies" box to receive e-mail notifications when
| > there
| > | > are
| > | > | > any updates in your thread. When responding to posts via your
| > | > newsreader,
| > | > | > please "Reply to Group" so that others may learn and benefit
from
| > your
| > | > | > issue.
| > | > | >
| > | > | > Microsoft engineers can only focus on one issue per thread.
| > Although
| > | > we
| > | > | > provide other information for your reference, we recommend you
| > post
| > | > | > different incidents in different threads to keep the thread
clean.
| > In
| > | > | > doing
| > | > | > so, it will ensure your issues are resolved in a timely manner.
| > | > | >
| > | > | > For urgent issues, you may want to contact Microsoft CSS
directly.
| > | > Please
| > | > | > check http://support.microsoft.com for regional support phone
| > numbers.
| > | > | >
| > | > | > Any input or comments in this thread are highly appreciated.
| > | > | >
| > | > | > =====================================================
| > | > | >
| > | > | > This posting is provided "AS IS" with no warranties, and
confers
| > no
| > | > | > rights.
| > | > | > --------------------
| > | > | > | From: "John" <spam001(at)plasticcircus(dot)com>
| > | > | > | References: <eIu7z#cfGHA.4464@xxxxxxxxxxxxxxxxxxxx>
| > | > | > <LT4cvxkfGHA.4336@xxxxxxxxxxxxxxxxxxxxx>
| > | > | > <OeYSPsBgGHA.1520@xxxxxxxxxxxxxxxxxxxx>
| > | > | > <zghAEpJgGHA.1740@xxxxxxxxxxxxxxxxxxxxx>
| > | > | > | Subject: Re: Monitoring and Alerts
| > | > | > | Date: Fri, 26 May 2006 14:36:31 -0700
| > | > | > | Lines: 795
| > | > | > | MIME-Version: 1.0
| > | > | > | Content-Type: multipart/alternative;
| > | > | > | boundary="----=_NextPart_000_0007_01C680D1.C8DEE990"
| > | > | > | X-Priority: 3
| > | > | > | X-MSMail-Priority: Normal
| > | > | > | X-Newsreader: Microsoft Outlook Express 6.00.2900.2869
| > | > | > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
| > | > | > | Message-ID: <Oxn62xQgGHA.1856@xxxxxxxxxxxxxxxxxxxx>
| > | > | > | Newsgroups: microsoft.public.windows.server.sbs
| > | > | > | NNTP-Posting-Host: user-v8lmf6j.cable.mindspring.com
| > 209.91.60.211
| > | > | > | Path:
| > | > TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP03.phx.gbl
| > | > | > | Xref: TK2MSFTNGXA01.phx.gbl
| > | > microsoft.public.windows.server.sbs:271205
| > | > | > | X-Tomcat-NG: microsoft.public.windows.server.sbs
| > | > | > |
| > | > | > | > 1. Do you type the external email address when you run Set
Up
| > | > | > Monitoring
| > | > | > | > Reports and Alerts wizard?
| > | > | > | The server was configured to send performance alerts to both
my
| > | > Mobile
| > | > | > phone's email address and my internal email address.
| > | > | > | > 2. Please rerun Set Up Monitoring Reports and Alerts wizard
| > and
| > | > only
| > | > | > | > configure an internal email address for those alert emails
to
| > be
| > | > sent,
| > | > | > and
| > | > | > | > restart a service, will the email be sent fine?
| > | > | > | I re-ran the monitoring and alerts wizard
| > | > | > | I received the email confirming my settings
| > | > | > | I then stopped the world wide web publishing service
| > | > | > | I did not receive an email, nothing was left in the queue
| > | > | > | I opened my the health monitor and found alerts in both...
| > | > | > | health monitor> all monitored computers> my server> actions>
| > send
| > | > email
| > | > | > with monitoring alert> "Critical 5/26/2006 1:19:56 PM Send
e-mail
| > with
| > | > | > monitoring alert (my server) Action failed. View the
| > | > | > system32\wbem\logs\wbemess.log for more information. 0x8004100a
| > :",
| > | > "Ok
| > | > | > 5/26/2006 1:19:56 PM Send e-mail with monitoring alert (my
server)
| > | > Action
| > | > | > was fired."
| > | > | > | &
| > | > | > | health monitor> all monitored computers> my server> small
| > business
| > | > | > server
| > | > | > alerts> exchange server alerts> Microsoft exchange
| > | > management>"Critical
| > | > | > 5/26/2006 1:19:56 PM Microsoft Exchange Management (my server)
| > | > | > MSExchangeMGMT service is Stopped.This service manages Exchange
| > | > management
| > | > | > information that uses Windows Management Instrumentation (WMI).
If
| > | > this
| > | > | > service is stopped, Exchange management information using WMI is
| > | > | > unavailable.For more information about this event, see the event
| > logs
| > | > on
| > | > | > the server computer. You can restart this service by using the
| > View
| > | > | > Services task in the Server Management Monitoring and Reporting
| > | > | > taskpad.You
| > | > | > can disable this alert by using the Change Alert Notifications
| > task.
| > | > | > | "
| > | > | > | > 3. Have you seen these emails in the queue?
| > | > | > | No, I do not find any emails in the queue.
| > | > | > | > 4. Can you receive Performance or other reports for the
email?
| > | > | > | Yes I receive daily performance alerts, and weekly usage
report
| > just
| > | > | > fine.
| > | > | > | > 5. Please perform a clean boot to see how thing goes:
| > | > | > | After performing a clean boot I didn't receive a system up
time
| > | > alert.
| > | > | > the exchange management alert is gone from the health monitor
but
| > the
| > | > | > "send
| > | > | > email with monitoring alert" item is still in a critical state,
| > even
| > | > | > though
| > | > | > there are no alerts in the item.
| > | > | > | I have since restarted in normal mode.
| > | > | > | ""Crina Li"" <v-crinal@xxxxxxxxxxxxxxxxxxxx> wrote in message
| > | > | > news:zghAEpJgGHA.1740@xxxxxxxxxxxxxxxxxxxxxxxx
| > | > | > | > Hi John,
| > | > | > | >
| > | > | > | > Thanks for your update.
| > | > | > | >
| > | > | > | > I have reviewed the log and found no useful information. To
| > narrow
| > | > | > down
| > | > | > the
| > | > | > | > problem, would you please help me collect the following
| > | > information?
| > | > | > | >
| > | > | > | > 1. Do you type the external email address when you run Set
Up
| > | > | > Monitoring
| > | > | > | > Reports and Alerts wizard?
| > | > | > | > 2. Please rerun Set Up Monitoring Reports and Alerts wizard
| > and
| > | > only
| > | > | > | > configure an internal email address for those alert emails
to
| > be
| > | > sent,
| > | > | > and
| > | > | > | > restart a service, will the email be sent fine?
| > | > | > | > 3. Have you seen these emails in the queue?
| > | > | > | > 4. Can you receive Performance or other reports for the
email?
| > | > | > | > 5. Please perform a clean boot to see how thing goes:
| > | > | > | >
| > | > | > | > 1) Click Start, click Run, and then in the Open box, type
| > | > "MSCONFIG"
| > | > | > | > (without the quotation marks). Click OK.
| > | > | > | > 2) In the System Configuration Utility (MSConfig) window,
| > click
| > to
| > | > | > select
| > | > | > | > the Selective Startup button.
| > | > | > | > 3) Click to clear the check mark from the "Load startup
items"
| > | > below
| > | > | > | > Selective Startup.
| > | > | > | > 4) Click the Services tab, click to check the "Hide All
| > Microsoft
| > | > | > Services"
| > | > | > | > box, and remove all the check marks from the remained
| > | > Non-Microsoft
| > | > | > | > Services. Please note that the Exchange services could be
| > marked
| > | > as
| > | > | > | > non-Microsoft. Please do not disable those services.
| > | > | > | > 5) Click OK to close the MSConfig window. Click Yes when
you
| > are
| > | > asked
| > | > | > to
| > | > | > | > restart your computer in order to enable the changes.
| > | > | > | > 6) After restarting, please check whether this issue will
| > reoccur.
| > | > | > | >
| > | > | > | > More information:
| > | > | > | >
| > | > | > | > 280043 Health Monitor May Be Unable to Send E-Mail via Local
| > | > Exchange
| > | > | > SMTP
| > | > | > | > http://support.microsoft.com/?id=280043
| > | > | > | >
| > | > | > | > Please feel free to let me know if there is anything I can
do
| > for
| > | > you.
| > | > | > | >
| > | > | > | > I appreciate your time and look forward to hearing from you.
| > | > | > | >
| > | > | > | > Best regards,
| > | > | > | >
| > | > | > | > Crina Li (MSFT)
| > | > | > | >
| > | > | > | > Microsoft CSS Online Newsgroup Support
| > | > | > | >
| > | > | > | > Get Secure! - www.microsoft.com/security
| > | > | > | >
| > | > | > | > =====================================================
| > | > | > | > This newsgroup only focuses on SBS technical issues. If you
| > have
| > | > | > issues
| > | > | > | > regarding other Microsoft products, you'd better post in the
| > | > | > corresponding
| > | > | > | > newsgroups so that they can be resolved in an efficient and
| > timely
| > | > | > manner.
| > | > | > | > You can locate the newsgroup here:
| > | > | > | >
| > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
| > | > | > | >
| > | > | > | > When opening a new thread via the web interface, we
recommend
| > you
| > | > | > check
| > | > | > the
| > | > | > | > "Notify me of replies" box to receive e-mail notifications
| > when
| > | > there
| > | > | > are
| > | > | > | > any updates in your thread. When responding to posts via
your
| > | > | > newsreader,
| > | > | > | > please "Reply to Group" so that others may learn and benefit
| > from
| > | > your
| > | > | >> issue.
| > | > | > | >
| > | > | > | > Microsoft engineers can only focus on one issue per thread.
| > | > Although
| > | > | > we
| > | > | > | > provide other information for your reference, we recommend
you
| > | > post
| > | > | > | > different incidents in different threads to keep the thread
| > clean.
| > | > In
| > | > | > doing
| > | > | > | > so, it will ensure your issues are resolved in a timely
| > manner.
| > | > | > | >
| > | > | > | > For urgent issues, you may want to contact Microsoft CSS
| > directly.
| > | > | > Please
| > | > | > | > check http://support.microsoft.com for regional support
phone
| > | > numbers.
| > | > | > | >
| > | > | > | > Any input or comments in this thread are highly appreciated.
| > | > | > | >
| > | > | > | > =====================================================
| > | > | > | >
| > | > | > | > This posting is provided "AS IS" with no warranties, and
| > confers
| > | > no
| > | > | > rights.
| > | > | > | > --------------------
| > | > | > | > | From: "John" <spam001(at)plasticcircus(dot)com>
| > | > | > | > | References: <eIu7z#cfGHA.4464@xxxxxxxxxxxxxxxxxxxx>
| > | > | > | > <LT4cvxkfGHA.4336@xxxxxxxxxxxxxxxxxxxxx>
| > | > | > | > | Subject: Re: Monitoring and Alerts
| > | > | > | > | Date: Thu, 25 May 2006 09:48:30 -0700
| > | > | > | > | Lines: 125
| > | > | > | > | X-Priority: 3
| > | > | > | > | X-MSMail-Priority: Normal
| > | > | > | > | X-Newsreader: Microsoft Outlook Express 6.00.2900.2869
| > | > | > | > | X-RFC2646: Format=Flowed; Original
| > | > | > | > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
| > | > | > | > | Message-ID: <OeYSPsBgGHA.1520@xxxxxxxxxxxxxxxxxxxx>
| > | > | > | > | Newsgroups: microsoft.public.windows.server.sbs
| > | > | > | > | NNTP-Posting-Host: user-v8lmf6j.cable.mindspring.com
| > | > 209.91.60.211
| > | > | > | > | Path:
| > | > | > TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP03.phx.gbl
| > | > | > | > | Xref: TK2MSFTNGXA01.phx.gbl
| > | > | > microsoft.public.windows.server.sbs:270881
| > | > | > | > | X-Tomcat-NG: microsoft.public.windows.server.sbs
| > | > | > | > |
| > | > | > | > | You can check the settings in
| > | > | > | > | > Health Monitor: Click Start\Administrative Tools\Health
| > | > Monitor,
| > | > | > expand
| > | > | > | > | > Small Business Alerts\Core Server Alerts, can you see
| > System
| > | > Up
| > | > | > Time and
| > | > | > | > | > World Wide Web Publishing?
| > | > | > | > |
| > | > | > | > | Yes, System Up Time, World Wide Web Publishing, and a long
| > list
| > | > of
| > | > | > others
| > | > | > | > | including DHCP Server, Print Spooler, SMTP, etc.
| > | > | > | > |
| > | > | > | > | >1. Are there any related error messages in Event Log?
| > | > | > | > | There are messages in the event log stating that the IIS
| > service
| > | > has
| > | > | >> | restarted, and that the system has restarted, but nothing
about
| > an
| > | > | > error
| > | > | > | > | sending a message.
| > | > | > | > |
| > | > | > | > | > 2. SBSMSI-Monitoring.log from the C:\Program
| > Files\Microsoft
| > | > | > | > | > Integration\Windows Small Business Server 2003\Logs
| > folder.
| > | > | > | > | I will email that to you..
| > | > | > | > |
| > | > | > | > | > 3. Do you mean you can not receive any Alerts?
| > | > | > | > | Correct, I do not receive any alerts other than the
initial
| > | > | > confirmation
| > | > | > | > | message after configuring the alerts.
| > | > | > | > |
| > | > | > | > |
| > | > | > | > | ""Crina Li"" <v-crinal@xxxxxxxxxxxxxxxxxxxx> wrote in
| > message
| > | > | > | > | news:LT4cvxkfGHA.4336@xxxxxxxxxxxxxxxxxxxxxxxx
| > | > | > | > | > Hi John,
| > | > | > | > | >
| > | > | > | > | > Thank you for posting in SBS newsgroup.
| > | > | > | > | >
| > | > | > | > | > From your description, I understand the issue to be: you
| > have
| > | > | > configured
| > | > | > | > | > Monitoring and Alerts through Set Up Monitoring Reports
| > and
| > | > Alerts
| > | > | >> wizard.
| > | > | > | > | > However you can not receive alerts when the server
restart
| > and
| > | > IIS
| > | > | >> stop.
| > | > | > | > | > If
| > | > | > | > | > I have misunderstood your concern, please do not
hesitate
| > to
| > | > let
| > | > | > me
| > | > | > | > know.
| > | > | > | > | >
| > | > | > | > | > As I know, you should be able to receive the alert when
| > system
| > | > | > restarts
| > | > | > | > | > after you configure Monitoring and Reporting. You can
| > check
| > | > the
| > | > | > | > settings
| > | > | > | > | > in
| > | > | > | > | > Health Monitor: Click Start\Administrative Tools\Health
| > | > Monitor,
| > | > | > expand
| > | > | > | > | > Small Business Alerts\Core Server Alerts, can you see
| > System
| > | > Up
| > | > | > Time and
| > | > | > | > | > World Wide Web Publishing?
| > | > | > | > | >
| > | > | > | > | > If it does exist, would you please help me collect the
| > | > following
| > | > | > | > | > information?
| > | > | > | > | >
| > | > | > | > | > 1. Are there any related error messages in Event Log?
| > | > | > | > | > 2. SBSMSI-Monitoring.log from the C:\Program
| > Files\Microsoft
| > | > | > | > | > Integration\Windows Small Business Server 2003\Logs
| > folder.
| > | > | > | > | > 3. Do you mean you can not receive any Alerts?
| > | > | > | > | >
| > | > | > | > | > I appreciate your time and look forward to hearing from
| > you.
| > | > | > | > | >
| > | > | > | > | > Best regards,
| > | > | > | > | >
| > | > | > | > | > Crina Li (MSFT)
| > | > | > | > | >
| > | > | > | > | > Microsoft CSS Online Newsgroup Support
| > | > | > | > | >
| > | > | > | > | > Get Secure! - www.microsoft.com/security
| > | > | > | > | >
| > | > | > | > | > =====================================================
| > | > | > | > | > This newsgroup only focuses on SBS technical issues. If
| > you
| > | > have
| > | > | > issues
| > | > | > | > | > regarding other Microsoft products, you'd better post
in
| > the
| > | > | > | > corresponding
| > | > | > | > | > newsgroups so that they can be resolved in an efficient
| > and
| > | > timely
| > | > | >> manner.
| > | > | > | > | > You can locate the newsgroup here:
| > | > | > | > | >
| > | > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
| > | > | > | > | >
| > | > | > | > | > When opening a new thread via the web interface, we
| > recommend
| > | > you
| > | > | > check
| > | > | > | > | > the
| > | > | > | > | > "Notify me of replies" box to receive e-mail
notifications
| > | > when
| > | > | > there
| > | > | > | > are
| > | > | > | > | > any updates in your thread. When responding to posts via
| > your
| > | > | > | > newsreader,
| > | > | > | > | > please "Reply to Group" so that others may learn and
| > benefit
| > | > from
| > | > | > your
| > | > | > | > | > issue.
| > | > | > | > | >
| > | > | > | > | > Microsoft engineers can only focus on one issue per
| > thread.
| > | > | > Although we
| > | > | > | > | > provide other information for your reference, we
recommend
| > you
| > | > | > post
| > | > | > | > | > different incidents in different threads to keep the
| > thread
| > | > clean.
| > | > | > In
| > | > | > | > | > doing
| > | > | > | > | > so, it will ensure your issues are resolved in a timely
| > | > manner.
| > | > | > | > | >
| > | > | > | > | > For urgent issues, you may want to contact Microsoft CSS
| > | > directly.
| > | > | >> Please
| > | > | > | > | > check http://support.microsoft.com for regional support
| > phone
| > | > | > numbers.
| > | > | > | > | >
| > | > | > | > | > Any input or comments in this thread are highly
| > appreciated.
| > | > | > | > | >
| > | > | > | > | > =====================================================
| > | > | > | > | >
| > | > | > | > | > This posting is provided "AS IS" with no warranties, and
| > | > confers
| > | > | > no
| > | > | > | > | > rights.
| > | > | > | > | > --------------------
| > | > | > | > | > | From: "John" <spam001(at)plasticcircus(dot)com>
| > | > | > | > | > | Subject: Monitoring and Alerts
| > | > | > | > | > | Date: Mon, 22 May 2006 11:44:04 -0700
| > | > | > | > | > | Lines: 13
| > | > | > | > | > | X-Priority: 3
| > | > | > | > | > | X-MSMail-Priority: Normal
| > | > | > | > | > | X-Newsreader: Microsoft Outlook Express 6.00.2900.2869
| > | > | > | > | > | X-MimeOLE: Produced By Microsoft MimeOLE
V6.00.2900.2869
| > | > | > | > | > | X-RFC2646: Format=Flowed; Original
| > | > | > | > | > | Message-ID: <eIu7z#cfGHA.4464@xxxxxxxxxxxxxxxxxxxx>
| > | > | > | > | > | Newsgroups: microsoft.public.windows.server.sbs
| > | > | > | > | > | NNTP-Posting-Host: user-v8lmf6j.cable.mindspring.com
| > | > | > 209.91.60.211
| > | > | > | > | > | Path:
| > | > | > TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP04.phx.gbl
| > | > | > | > | > | Xref: TK2MSFTNGXA01.phx.gbl
| > | > | > microsoft.public.windows.server.sbs:269908
| > | > | > | > | > | X-Tomcat-NG: microsoft.public.windows.server.sbs
| > | > | > | > | > |
| > | > | > | > | > | After configuring the monitoring and alerts wizard to
| > send
| > | > | > critical
| > | > | > | > | > alerts
| > | > | > | > | > | to my email address and mobile phone, I received a
test
| > on
| > | > both
| > | > | > my
| > | > | > | > phone
| > | > | > | > | > and
| > | > | > | > | > | in my email inbox.
| > | > | > | > | > |
| > | > | > | > | > | But whenever there is a critical event such as the
| > server
| > | > | > restarting,
| > | > | > | > | > the
| > | > | > | > | > | IIS service stopping, or anything else, no alert is
sent
| > | > out.
| > | > | > | > | > |
| > | > | > | > | > | I'm running SBS 2003 sp2 premium, with ISA 2004
| > installed
| > on
| > | > the
| > | > | > SBS
| > | > | > | > | > | Where should I look for solutions?
| > | > | > | > | > |
| > | > | > | > | > | Thank you all in advance.
| > | > | > | > | > |
| > | > | > | > | > |
| > | > | > | > | > |
| > | > | > | > | >
| > | > | > | > |
| > | > | > | > |
| > | > | > | > |
| > | > | > | >
| > | > | > |
| > | > | >
| > | > |
| > | > |
| > | > |
| > | >
| > |
| > |
| > |
| >
|
|
|

.