So an Exchange installation was having some strange issues.
The main symptom was that users would get a busy signal when trying to dial
into the UM service on Exchange. Checking the server all the services were
started but doing a netstat showed tcp 5061 was not listening. This is odd
since all of the UM services were started, this is odd but not unheard of in
2013 where Managed Availability can kill a portion of a service.
Doing a check of the server health by running
“Get-ServerHealth %server% | ?{$_.AlertValue –eq “Unhealthy”}” showed that the
UM.CallRouter was unhealthy and offline. There were a few other’s showing
unhealthy also which was odd since the client didn’t report any other problems.
The event logs for Managed Availability monitoring are
located in the Event Viewer under Windows Logs > Applications and Services
Logs > Microsoft > Exchange > ManagedAvailability > Monitoring
In the logs there were a ton of event ID 4 errors. Looking
further they all seemed to be complaining about the same thing: “Directory object not found. Active
directory response: 0000208D: NameErr: DSID-03100213, problem 2001 (NO_OBJECT)”
Here’s what the event log looked like.
What’s strange is that it thinks it can’t find the objects
it’s looking for in AD. So I jump onto the DC in question and check its
replication and health. Its fine, the server is fully up to date and
functional. So what is it Exchange can’t find?
Taking a look in AD Users and Computers there is a container
called Microsoft Exchange System Objects, which is where the objects that
Monitoring Availability uses reside, however in this domain they were missing.
The container had the following:
There should be a folder called Monitoring Mailboxes, but
it’s missing! This is what Managed Availability can’t find in AD. So the next
step is how to recreate it?
It turns out that this is one of the things that the
Exchange 2013 setup does during the PrepareAD step. The server is Exchange 2013
CU3 so I went to the folder that has the extracted install files for cu3 and
ran “setup.exe /preparead”
Now when we look into the Microsoft Exchange System Objects
in ADUC we see:
Inside of this are the objects that Monitoring Availability
was trying to find!
So now that the AD objects are where they are supposed to be
I restarted the “Microsoft Exchange Health Manager” service and now the logs
are clean!
Now a netstat run on the exchange server shows that tcp 5061 is open and when users call
the UC system they get the attendant and not a busy signal, life is good!
The moral of this support story is that sometimes you really
need to think about the things windows is telling you. Windows was upset because
it couldn’t find objects in AD, but unless you really sit down and think about
things you might miss what it’s really telling you. As in this case it was missing
the Health Mailbox objects which caused Managed Availability monitors to break
down and killed the UM Call Router.
Labels: EventID 4, Exchange 2013
