Exchange 2010

[lee n. field]

We hates it.  That is all.

[charby]

Server or client?

[Fitz]

Server or client?

Yes

[Azrael256]

*sigh*

What now?

[lee n. field]

*sigh*

What now?

STarted in June sometime.  Try to get into Exchange Manglement Console, get a Kerberos/WinRM error.  Try to get into Outlook Web Access, get a 404 error.  (Everybody therel uses OWA, from the outside.)  Prior to that time, I'd get this sometimes.  All would be well after a reboot.  

The two errors are related.  Something to do with a missing port 80 binding on the default website in IIS.  Except it's not missing, it's right there.

The first time it cropped up I figured an update screwed something up.  I rolled off the prior month, and everything worked.  Can't leave it like that forever, and I started inching my way through updates, to see which ones broke the system.  At least 3 did, which tells me something else is going on.

G00gling on the error, there's a multitude of possible causes and possible fixes.

I'm at the point of saying screw it, calling microsoft, letting them fix it and passing the per incident charge on to the school.

Yeah, they had to have an Exchange server.  Not that they use any features other than mail.

[Azrael256]

Open EMS. Do you get the WinRM error?

Sanitize it and let me see it.

[lee n. field]

The following error occurred while attempting to connect to the specified Exchange server 'exchange.somedomain.local":

The attempt to connect to http://exchange.somedomain.local/Powershell using "Kerberos" authentication failed:  Connecting to remote server failed with the following error message : The client cannot connect to the destination specified in the request.  Verify that the service on the destination is running and is accepting requests.  Consult the logs and documentation for the WS-Mangement service runnon on the destination, most commonly IIS or WinRM.  If the destination is the WinRM service, run toe following command onthe destination to analyze and configure the WinRM service: "winrm quickconfig". For more information, see the about_Remote_Troubleshhoting helptopic.

"winrm quickconfig" says all is cool with WinRM.

an "emtshooter" diagnostic suggested in multiple places complains about port 80 on the default website being missing.  Click to add it, and it says it can't because it's already there.

WinRM oeprational log gives the occasional "WSMAN operation CreatShell failed, error code 2150848770".

Trend Micro AV sometimes (per google) causes problems due to URL filtering.  Trend is now uninstalled on this unit.

(After the Exchange server was deployed, it was saddled with another unrelated function that might confuse things.  It hosts the library mangement software, which is accessed by a website on port 81.)

[Azrael256]

You rebooted after uninstalling all of the AV software, right?

Did you just install SP3?

[lee n. field]

You rebooted after uninstalling all of the AV software, right?

Oh yes.

Did you just install SP3?

exchange SP3 and Sp3 rollup1 were installed recently.  This server was doing this before.

[Azrael256]

Ok, on a machine I can type on now.

Check HKLM\Software\Microsoft\.NetFramework for a... dword, I think, named OnlyLatestCLR.  Or UseLatestCLR, or something like that.  If it's 1, set it to 0.  You'll have to kick IIS after that... actually, probably ought to reboot after that.  If that fails...

Check netsh http show iplisten to see if the box has 127.0.0.1 in there.  That causes weird stuff with winrm.

There could be a broken application pool... but meh.  I guess check the application pools for Managed Pipeline and ASP.net 4.0 and see if they're set to "integrated."   I think they should be "classic."

Can you browse the default website at all, or is IIS just totally pwnd?

[lee n. field]

I'll try that stuff.  Later.. About bed time.

Anyway, this looks possibly helpful: http://www.petenetlive.com/KB/Article/0000477.htm.

Default website wasn't running.  Couldn't start.  did the netstat thing.  java.exe was one thing holding port 80.  Killed it, and could manually start the default web page, can get into management console and owa.

Hmmm.   The library magagement app makes huge use of java, and it sucks up a lot of RAM doing it.  Hmmmm.  Time to give the Follett people a call, maybe.

[Azrael256]

Yup, that'll do it.

It's almost always a link-checker because somebody installed the desktop version of AVG.  Sometimes it's URLSCAN.  Anything that blocks http...

Never heard of a java thing doing it, but there's a first time for everything, y'know.  Block or jam up 80, and goodnight nurse.

[charby]

2010 is so much better than the older versions.

[lee n. field]

Yup, that'll do it.

It's almost always a link-checker because somebody installed the desktop version of AVG.  Sometimes it's URLSCAN.  Anything that blocks http...

Never heard of a java thing doing it, but there's a first time for everything, y'know.  Block or jam up 80, and goodnight nurse.

It looks like Apache was installed to support the library catalog app.  That actually shows up in the services list as "Destiny server".  I never had to maintain it after installation -- install and forget.  What changed in June?   Dunno.  Looks like a call to those people is in order.

A "learning experience".

If I change the service to "automatic delayed start" how much delay is there?

[Azrael256]

It looks like Apache was installed to support the library catalog app.  That actually shows up in the services list as "Destiny server".  I never had to maintain it after installation -- install and forget.  What changed in June?   Dunno.  Looks like a call to those people is in order.

A "learning experience".

If I change the service to "automatic delayed start" how much delay is there?

Maybe enough. I dunno.  The sure bet is to set it as a dependent on IIS.  And then change the background to text explaining what you did and why.

[lee n. field]

Changed "Destiny server" service from automatic to automatic with dealy, added IIS Admin as a dependency.  (Prior it only had the database it depends on as a dependency.)  Reinstalled Trend AV, installed all updates. 

All seems to be working.   Humming along nicely.  It "feels right."  Finally.

I speculate that some update made IIS start a bit slower or later than it had been, letting Destiny (with Apache under the hood) get up and running before IIS and screwing things up.

And of course through all this my dear users would think "oh the exchange server's down" and go reboot it. 

[Azrael256]

Changed "Destiny server" service from automatic to automatic with dealy, added IIS Admin as a dependency.  (Prior it only had the database it depends on as a dependency.)  Reinstalled Trend AV, installed all updates. 

All seems to be working.   Humming along nicely.  It "feels right."  Finally.

I speculate that some update made IIS start a bit slower or later than it had been, letting Destiny (with Apache under the hood) get up and running before IIS and screwing things up.

And of course through all this my dear users would think "oh the exchange server's down" and go reboot it. 

Tell them I said to stop that.  Unless you're changing out bits, there's basically no good reason to reboot a 2010 box.