Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I V2V a Hyper-V guest in production running Exchange 2007 to ESXi 4.1 last night. Today I discovered that while the exchange works, I am not able to add new organizations and mailboxes to it. Been reading a little about the subject, and if I understand it correctly the SID has been changed, and therefor the trust between the AD and the Exchange server has been broken. It's to me a mystery users are able to use it at all then.

I have no prior experience of setting exchange up, so I'm willing to cross fire in order to get it working without doing a fresh install (using 'setup.exe /M:RecoverServer'?). From what I understand, I have about the following options:

  1. Get old SID from old Hyper V based server and either change SID on the vmware exchange 2007, or change SID for the exchange in the AD. People seem to generally thing this is a world of trouble, but is it doable? I wouldn't be scared to test it out, I can always revert to snapshots of the virtual machine. Other Pros and Cons?

  2. Re-install windows and exchange using the RecoverServer switch. Benefits would be R2 of windows 2008, and getting to know exchange in the process. But I know just a simple replacement of a ssl certificate was a hassle, and apparently we have loads of custom local rules because of the integration with (the now discontinued) DotNetPanel and the hosted exchange nature. To my knowledge, the DotNetPanel server binaries are no longer available, so it would also require us to fully test and then migrate 15 servers to WebSitePanel in production.

  3. Reattach the mailbox databases to the old exchange 2007, and not being able to move from Hyper V on HP MSA hardware. Leave it be, move on and forget? :)

  4. Throw in the towel and either get Microsoft support, or simply invest (a lot) in hiring a consultant.

Edit: The error message when creating a new mailbox is something like "Address list service failed". Will check the exact message when I arrive at work tomorrow. My apologies for not including it.

Edit 2: It's clearly not because of a change of SID, I will move this to a new post instead as the problem is completely unrelated to (a change of) SID. new thread here

share|improve this question
    
Robert Moir: I saw your comment prior to it being deleted. Here's the answer: I did get some external help in establish that the change of SID is the root cause, so I will have to get back to you on how that was determined. As far as the SID being changed, it is to my knowledge always changed when significant hardware changes takes place, which it indeed does from moving it from hyper v to esxi. Is that incorrect? –  3molo May 4 '11 at 18:47
4  
What are the eventids of the errors in the event log? Such a process, p2v, v2v has never break any sids. Looks like your problem is somewhere else. –  Vick Vega May 4 '11 at 18:47
3  
sorry, moved comment to an answer as I wanted to add a few recovery ideas that should get you going no matter what. As Vick Vega says, simply moving an install of Windows P2V, V2V or P2P does not change the SID and anyone who tells you differently shouldn't be allowed near your windows servers. So either that didn't happen or someone did something very odd and non-standard during the migration of the VM. –  RobM May 4 '11 at 18:56
2  
I'm a bit late to this party (sounds screwed up BTW, condolences!). I'm not entirely convinced your SID has changed, which I guess is a good thing. I assume you've rebooted the VM a couple of times for good measures? You'd be surprised what stopped services can do to Exchange and the weird and (usually totally off) wonderful error messages you get. What is the output of Test-ServiceHealth from the Exchange Management Shell? –  Ben Pilbrow May 4 '11 at 19:39

3 Answers 3

up vote 5 down vote accepted

So what are the errors you're actually experiencing, and how have you established that your migration changed the machine SID? I ask this because if it has, this is the first time I have seen this happen (simply moving a VM from one host to another doesn't, or at least shouldn't do this), so my first thoughts would be to look elsewhere for what the real problem actually is.

As for your recovery options:

Changing the SID makes me uncomfortable on an Exchange Server. Even if you can establish that this is the fault and change it back without causing a crash then I'd be unhappy to continue using that server. The other proposed solutions don't fill me with joy either (possibly because I don't understand what 15 dotnetnuke servers has to do with exchange)

At this point, I'd maybe see if I could add another mailbox role server to the exchange organisation then attempt a move mailbox. If that works then all should be gravy. If not then (this may scale badly depending on number of users, but its "dumb" enough to work pretty much no matter what) consider exporting mailboxes to a PST and then importing to a new mailbox server.

Edit

Just as a point of interest, what happens when you run the exchange best practices analyser on that server (and if present, another exchange server in the org)? That might shed some light on what has happened, and if its a common scenario then Microsoft are pretty good at linking to useful knowledge-base articles directly from the exchange BPA reports.

Secondly, just a silly point, you have checked all the usual name resolution of DCs is ok, that the time/date/timezone are correct, etc (seriously, time getting out of sync can be a big problem with virtual machine guests, and the time being wrong will make active directory pull a sad face when exchange tries to talk to it).

share|improve this answer
    
DotNetPanel, web control panel for web hosters that allows customers to create organizations, mail accounts, distribution groups, web spaces etc etc. The mailbox databases are intact, and can easily be migrated or (iSCSI) initiated on the old Hyper-V guest. –  3molo May 4 '11 at 18:54
3  
If you're sure the only problem is that you cannot add new mailboxes (again what error do you get) then regardless of why this happened I would still be looking to bring up a new mailbox role server and move the mailboxes over to it. I've done mailbox moves no end of times as part of exchange "swing" migrations from one version to another or onto new hardware. It's a good robust process that should work well unless the exchange org itself is pretty well boned, in which case you have to decide how much effort to invest in fixing the current setup before going for a svr -> .pst -> svr migration. –  RobM May 4 '11 at 18:59
    
He who told me it's (likely) SID problems, said that "yes the SID never changes, and because of the (virtualized) hardware changes exchange will nog work. I can not guarantee that this is the problem, I didn't see anything about SIDs in the event logs". –  3molo May 4 '11 at 19:28
2  
He who told you that is either leaving out a massive back story about some important and non standard part of the process used to do this move, and I mean movie length back story, or (how do I put this delicately) they're grasping at straws and bluffing (lets face it, from what you say they've already gone from "SID changed, thats your problem" to "OK, SIDs don't change, so its the hardware...") I appreciate that its going to be difficult to get an explanation of which of those two it is from them, but it would be useful for you to know. –  RobM May 4 '11 at 19:37
2  
What you'd expect to see in a p2v migration is a OS activation notice, due to HAL changes. Not a SID change. –  Holocryptic May 4 '11 at 21:34

As others have said, a P2V or V2V migration is not supposed to change the SID of the migrated computer, for the exact reason you're experiencing: it would not be anymore a working domain machine after completing the process, and this is not only a trouble for Exchange, but for anything running in a domain environment. So, unless someone or something ran Sysprep or NewSID or whatever on the machine, its SID should not have changed at all. Out of curiosity, how was the migration accomplished exactly?

That said, determining if this actually is the source of your problem is fairly easy: just have a look in the computer's event log for Event 5513 from the Netlogon service, as described here: http://support.microsoft.com/kb/150963; or for any other domain-logon-related errors: there should be plenty of them, if the trust relationship between the computer and its domain has actually been broken. If you can't see any, then a changed SID is very likely not your problem.

share|improve this answer
    
The migration was made using vmware converter, installed vmware guest tools and then NICs were reconfigured. I don't think it's related, but the Base Device Driver of vmware tools couldnt be found, I am currently trying to get that working on (yet another) migrated exchange (obviously with no network connectivity to not mess up) –  3molo May 4 '11 at 19:30
    
@3molo: I'm absolutely 100% sure that VMware converter doesn't change SIDs, as I've personally migrated countless domain-joined machines using it (and some domain controllers, too). Also, Windows never changes a SID on its own, be it for hardware changes or any other reason. –  Massimo May 4 '11 at 20:10
    
@3molo: so, what about the system logs? –  Massimo May 4 '11 at 20:10
    
Massimo: See the new thread, link in the bottom of my question –  3molo May 5 '11 at 7:17

Sounds like the computer account is screwed up. I wonder what would happen if you stopped Exchange, took the server out of the domain, added it back in and rebooted? Can you put the virtual disk in differencing mode while you test this?

share|improve this answer
    
I've seen many recommendations never to take an exchange out of an domain to rejoin it, are you sure about this? What exactly do you mean by differencing mode? Snapshotting? –  3molo May 4 '11 at 18:53
2  
I wonder what would happen if you stopped Exchange, took the server out of the domain, added it back in and rebooted? I'm going to vote for "very bad things, followed shortly by a test of the backups". –  RobM May 4 '11 at 19:04
1  
I am not sure about this. I suggest a $300 MS call –  uSlackr May 4 '11 at 19:04
    
Well, the server is not working anyway, so it may be worth trying; also, when you remove a computer from a domain, the computer account is not deleted, nor is any Exchange-related object in the Configuration container (as this is not even supposed to happen). So maybe it could actually work... –  Massimo May 4 '11 at 19:12
    
I still suggest using the $300 with MS support. They are very good. –  uSlackr May 4 '11 at 19:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.