none
MSExchangeIS service does not start after uninstalling Forefront Security for Exchange

    Question

  • I'm not sure which forum to post this in. Not sure if this is an issue with Exchange 2007 or Forefront Security.

     

    We have an SBS 2008 server. When we setup the server, we installed the Forefront Security for Exchange Server trial. At the end of the trial period, we decided we didn't want to use it, so we uninstalled Forefront Security. Ever since we uninstalled Forefront Security we've had this ongoing issue.

    Occasionally, the MSExchangeIS service will not start after rebooting the system. These are the events that show up in the event logs:

     

    Log Name:      System

    Source:        Service Control Manager

    Date:          6/26/2010 3:43:57 PM

    Event ID:      7024

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      <hostname.domain.local>

    Description:

    The Microsoft Exchange Information Store service terminated with service-specific error 0 (0x0).

     

    Log Name:      Application

    Source:        MSExchangeIS

    Date:          6/26/2010 3:43:46 PM

    Event ID:      9565

    Task Category: Virus Scanning

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      <hostname.domain.local>

    Description:

    Invalid virus scanner configuration. Unable to start virus scanner.

    Check the following parameter: Library.

     

    Log Name:      Application

    Source:        MSExchangeIS

    Date:          6/26/2010 3:43:46 PM

    Event ID:      9564

    Task Category: General

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      <hostname.domain.local>

    Description:

    Error 0x3ee starting the Microsoft Exchange Information Store.

    Failed to init VSERVER.

     

    I’ve done my own research on the issue, and I’ve found this article which will resolve the issue temporarily: http://support.microsoft.com/kb/323664

     

    Setting the registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan\Enabled  to “0” does allow me to start the MSExhangeIS service.

     

    However, the main issue is this registry value keeps getting reset to “1” and I’m not sure what is causing it.  I’ve had to re-set this value back to “0” four times. The last time I set the value to 0, it was fine for about 4 days then I noticed it reset back to 1.

     

    I’ve looked at this article: http://support.microsoft.com/kb/929076

    But, I no longer have Forefront Security installed on the system. The utility mentioned in this article was removed when we uninstalled Forefront Security. The “C:\Program Files (x86)\Microsoft Forefront Security\Exchange Server” no longer exists.

     

    Is it possible that some Forefront Security components were left on the system and it’s resetting this registry value?

     

    We don’t have any Exchange VSAPI security software installed on this server. We use a third-party Anti-Spam / Anti-Virus service to scrub incoming and outgoing mail.

    Tuesday, June 29, 2010 1:03 AM

Answers

  • Hello David,

    Since I have not heard back from you, I will assume that you have gotten your answer.

    Diana [MSFT]


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Regards,
    Diana Smith
    Microsoft Online Security Support
    Tuesday, July 13, 2010 1:33 PM

All replies

  • Since Forefront for Exchange has been uninstalled, Check to see if there is a dependency within the services.  To do this, Please view the following regkey:

     

    HKeyLocalMachine / System / CurrentControlSet / Services / MSExchangeIS...Look for "DependOnService" and remove anything related to FSCForefront...

    Once this has been removed from the dependency, A reboot maybe required.

    Also check to make sure that the MSExchangeIS service is set to AUTOMATIC and running under Local System account


    John
    Thursday, July 01, 2010 4:00 PM
  • Good Morning David,

    I just wanted to check back with you on the status of this post.

    Did you find John's action plan helpful?

    Can you please post to let us know if your issue is resolved or not?

    Thanking you in advance.

    Diana


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Regards,
    Diana Smith
    Microsoft Online Security Support
    Tuesday, July 06, 2010 1:21 PM
  • I checked and there are no dependencies related to Forefront. MSExchangeIS service is also set to AUTOMATIC running under Local System.

    The problem is this registry value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan\Enabled

    When this value is set to "0" everything is fine, but when it's set to "1" the MSExchangeIS service fails to start with the errors mentioned above.

    This value will somehow change from 0 to 1 randomly. I have changed it to 0 before and everything was fine for a while. I even restarted the machine after and all the services started with no issue. But this registry value, at some point, changes back to 1, and we don't notice until the machine restarts and we find the MSExchangeIS service fails to stop.

    What could be changing this registry value?

    This random change of the registry value has happened 3-4 times; however, in the last week, it hasn't recurred. I'm periodically checking this value.

    Tuesday, July 06, 2010 7:35 PM
  • Hi David,

    No worries and thanks for the update.

    I would like for you to send me your contact info.

    Please send it to diasmith@hotmail.com

    Once I have your contact info, I will call you and set up a time for you to work with the SBS Team and myself.

    Thanking you in advance.

    Diana


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Regards,
    Diana Smith
    Microsoft Online Security Support
    Tuesday, July 06, 2010 7:54 PM
  • Hello David,

    Thank you for the update.  My name is Deepti Walia, I am from Small Business Server Support team.

    I have seen this issue couple of times earlier, so would like to share the solution with you.

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan\Enabled - The value changes from 0 to 1 automatically if there is an Antivirus Scanning Exchange databases continuously.  We do not recommend Scanning Exchange databases via any AV on the server.  Please take a backup of Virusscan key and delete it from the server.  Also exclude the Exchange Database path to be scanned from Antivirus Console. 

    Also exclude incoming and outgoing emails to be scanned by Antivirus as it cause mailflow issues.

    You can also patch Exchange 2007 with Update Rollup 9 and Service Pack 2.

    Please let me know if you have any questions : My email address is : v-2dwali@mssupport.microsoft.com

    You can send me your contact info, I can call you back and work on this issue with Diana.

    Regards,

    Deepti Walia

    v-2dwali@mssupport.microsoft.com

    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

     


    Deepti
    • Edited by Caio-chill Thursday, July 08, 2010 9:59 AM name
    Thursday, July 08, 2010 9:59 AM
  • Hi,

    I had this problem too after uninstalling FSE. The problem was that FSE is mentioned in a XML-File of Exchange. I can't remeber the name of the file :-(

    I will look for the KB-article.

    Greetings

    Christian

     


    Christian Groebner MVP Forefront
    Friday, July 09, 2010 7:00 AM
  • Hello David,

    Since I have not heard back from you, I will assume that you have gotten your answer.

    Diana [MSFT]


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Regards,
    Diana Smith
    Microsoft Online Security Support
    Tuesday, July 13, 2010 1:33 PM
  • i cant found same registry settings for Exchange 2010 with Win2k8R2Sp1 OS ?
    Saturday, December 24, 2011 6:48 AM
  • Hi,

    I had this problem too after uninstalling FSE. The problem was that FSE is mentioned in a XML-File of Exchange. I can't remeber the name of the file :-(

    I will look for the KB-article.

    Greetings

    Christian


    Christian Groebner MVP Forefront

    Hi Christian,

    Have you found the KB article? I'm stuck with the same issue on one of my customers SB2008.


    Regards

    Josef
    Support Engineer

    (MCP) Microsoft Certified Professional

    (MCTS) Exchange Server 2010, Configuring

    (CCNA) Cisco Certified Network Associate


    • Edited by Jonor2 Friday, July 20, 2012 9:04 AM
    Friday, July 20, 2012 9:04 AM
  • Hi,

    no I haven't :-(

    The easiest way would be installing FSE/FPE again. After that remove FSE/FPE with fscutility and the parameter disable http://support.microsoft.com/kb/929076/en-us) . This forces the AV to be disconnectet from Exchange. Next thing is to uninstall FSE/FPE again.

    Greetings

    Christian


    Christian Groebner MVP Forefront

    Friday, July 20, 2012 9:25 AM
  • Hi,

    Thank you for your answer Christian!

    I guess i'll just have to find the correct download and follow the process of installing, fscutility then uninstalling again.

    Regards

    Josef


    Regards

    Josef N
    Support Engineer

    (MCP) Microsoft Certified Professional

    (MCTS) Exchange Server 2010, Configuring

    (CCNA) Cisco Certified Network Associate


    • Edited by Jonor2 Friday, July 20, 2012 2:02 PM
    Friday, July 20, 2012 2:02 PM
  • Hi,

    you can download it here:

    http://www.microsoft.com/en-us/download/details.aspx?id=14241

    Greetings

    Christian


    Christian Groebner MVP Forefront

    Friday, July 20, 2012 2:11 PM