MSExchangeIS service does not start after uninstalling Forefront Security for Exchange
-
Tuesday, June 29, 2010 1:03 AM
I'm not sure which forum to post this in. Not sure if this is an issue with Exchange 2007 or Forefront Security.
We have an SBS 2008 server. When we setup the server, we installed the Forefront Security for Exchange Server trial. At the end of the trial period, we decided we didn't want to use it, so we uninstalled Forefront Security. Ever since we uninstalled Forefront Security we've had this ongoing issue.
Occasionally, the MSExchangeIS service will not start after rebooting the system. These are the events that show up in the event logs:
Log Name: System
Source: Service Control Manager
Date: 6/26/2010 3:43:57 PM
Event ID: 7024
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: <hostname.domain.local>
Description:
The Microsoft Exchange Information Store service terminated with service-specific error 0 (0x0).
Log Name: Application
Source: MSExchangeIS
Date: 6/26/2010 3:43:46 PM
Event ID: 9565
Task Category: Virus Scanning
Level: Error
Keywords: Classic
User: N/A
Computer: <hostname.domain.local>
Description:
Invalid virus scanner configuration. Unable to start virus scanner.
Check the following parameter: Library.
Log Name: Application
Source: MSExchangeIS
Date: 6/26/2010 3:43:46 PM
Event ID: 9564
Task Category: General
Level: Error
Keywords: Classic
User: N/A
Computer: <hostname.domain.local>
Description:
Error 0x3ee starting the Microsoft Exchange Information Store.
Failed to init VSERVER.
I’ve done my own research on the issue, and I’ve found this article which will resolve the issue temporarily: http://support.microsoft.com/kb/323664
Setting the registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan\Enabled to “0” does allow me to start the MSExhangeIS service.
However, the main issue is this registry value keeps getting reset to “1” and I’m not sure what is causing it. I’ve had to re-set this value back to “0” four times. The last time I set the value to 0, it was fine for about 4 days then I noticed it reset back to 1.
I’ve looked at this article: http://support.microsoft.com/kb/929076
But, I no longer have Forefront Security installed on the system. The utility mentioned in this article was removed when we uninstalled Forefront Security. The “C:\Program Files (x86)\Microsoft Forefront Security\Exchange Server” no longer exists.
Is it possible that some Forefront Security components were left on the system and it’s resetting this registry value?
We don’t have any Exchange VSAPI security software installed on this server. We use a third-party Anti-Spam / Anti-Virus service to scrub incoming and outgoing mail.
All Replies
-
Thursday, July 01, 2010 4:00 PM
Since Forefront for Exchange has been uninstalled, Check to see if there is a dependency within the services. To do this, Please view the following regkey:
HKeyLocalMachine / System / CurrentControlSet / Services / MSExchangeIS...Look for "DependOnService" and remove anything related to FSCForefront...
Once this has been removed from the dependency, A reboot maybe required.
Also check to make sure that the MSExchangeIS service is set to AUTOMATIC and running under Local System account
John -
Tuesday, July 06, 2010 1:21 PMModerator
Good Morning David,
I just wanted to check back with you on the status of this post.
Did you find John's action plan helpful?
Can you please post to let us know if your issue is resolved or not?
Thanking you in advance.
Diana
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Regards,
Diana Smith
Microsoft Online Security Support -
Tuesday, July 06, 2010 7:35 PM
I checked and there are no dependencies related to Forefront. MSExchangeIS service is also set to AUTOMATIC running under Local System.
The problem is this registry value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan\Enabled
When this value is set to "0" everything is fine, but when it's set to "1" the MSExchangeIS service fails to start with the errors mentioned above.
This value will somehow change from 0 to 1 randomly. I have changed it to 0 before and everything was fine for a while. I even restarted the machine after and all the services started with no issue. But this registry value, at some point, changes back to 1, and we don't notice until the machine restarts and we find the MSExchangeIS service fails to stop.
What could be changing this registry value?
This random change of the registry value has happened 3-4 times; however, in the last week, it hasn't recurred. I'm periodically checking this value.
-
Tuesday, July 06, 2010 7:54 PMModerator
Hi David,
No worries and thanks for the update.
I would like for you to send me your contact info.
Please send it to diasmith@hotmail.com
Once I have your contact info, I will call you and set up a time for you to work with the SBS Team and myself.
Thanking you in advance.
Diana
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Regards,
Diana Smith
Microsoft Online Security Support -
Thursday, July 08, 2010 9:59 AM
Hello David,
Thank you for the update. My name is Deepti Walia, I am from Small Business Server Support team.
I have seen this issue couple of times earlier, so would like to share the solution with you.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan\Enabled - The value changes from 0 to 1 automatically if there is an Antivirus Scanning Exchange databases continuously. We do not recommend Scanning Exchange databases via any AV on the server. Please take a backup of Virusscan key and delete it from the server. Also exclude the Exchange Database path to be scanned from Antivirus Console.
Also exclude incoming and outgoing emails to be scanned by Antivirus as it cause mailflow issues.
You can also patch Exchange 2007 with Update Rollup 9 and Service Pack 2.
Please let me know if you have any questions : My email address is : v-2dwali@mssupport.microsoft.com
You can send me your contact info, I can call you back and work on this issue with Diana.
Regards,
Deepti Walia
v-2dwali@mssupport.microsoft.com
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Deepti- Edited by Caio-chill Thursday, July 08, 2010 9:59 AM name
-
Friday, July 09, 2010 7:00 AM
Hi,
I had this problem too after uninstalling FSE. The problem was that FSE is mentioned in a XML-File of Exchange. I can't remeber the name of the file :-(
I will look for the KB-article.
Greetings
Christian
Christian Groebner MVP Forefront- Marked As Answer by Diana Smith - MSFTMicrosoft Employee, Moderator Tuesday, July 13, 2010 1:32 PM
- Unmarked As Answer by Diana Smith - MSFTMicrosoft Employee, Moderator Tuesday, July 13, 2010 1:32 PM
-
Tuesday, July 13, 2010 1:33 PMModerator
Hello David,
Since I have not heard back from you, I will assume that you have gotten your answer.
Diana [MSFT]
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Regards,
Diana Smith
Microsoft Online Security Support- Marked As Answer by Diana Smith - MSFTMicrosoft Employee, Moderator Tuesday, July 13, 2010 1:33 PM
-
Saturday, December 24, 2011 6:48 AMi cant found same registry settings for Exchange 2010 with Win2k8R2Sp1 OS ?
-
Friday, July 20, 2012 9:04 AM
Hi,
I had this problem too after uninstalling FSE. The problem was that FSE is mentioned in a XML-File of Exchange. I can't remeber the name of the file :-(
I will look for the KB-article.
Greetings
Christian
Christian Groebner MVP ForefrontHi Christian,
Have you found the KB article? I'm stuck with the same issue on one of my customers SB2008.
Regards
Josef
Support Engineer(MCP) Microsoft Certified Professional
(MCTS) Exchange Server 2010, Configuring
(CCNA) Cisco Certified Network Associate
- Edited by Jonor2 Friday, July 20, 2012 9:04 AM
-
Friday, July 20, 2012 9:25 AM
Hi,
no I haven't :-(
The easiest way would be installing FSE/FPE again. After that remove FSE/FPE with fscutility and the parameter disable http://support.microsoft.com/kb/929076/en-us) . This forces the AV to be disconnectet from Exchange. Next thing is to uninstall FSE/FPE again.
Greetings
Christian
Christian Groebner MVP Forefront
-
Friday, July 20, 2012 2:02 PM
Hi,
Thank you for your answer Christian!
I guess i'll just have to find the correct download and follow the process of installing, fscutility then uninstalling again.
Regards
Josef
Regards
Josef N
Support Engineer(MCP) Microsoft Certified Professional
(MCTS) Exchange Server 2010, Configuring
(CCNA) Cisco Certified Network Associate
- Edited by Jonor2 Friday, July 20, 2012 2:02 PM
-
Friday, July 20, 2012 2:11 PM
Hi,
you can download it here:
http://www.microsoft.com/en-us/download/details.aspx?id=14241
Greetings
Christian Groebner MVP Forefront
.png)
