Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So customer calls up saying exchange isn't working, and when he remoted in he could see all the services disabled.

All the exchange services, IIS, update, plus a bunch of others were all set to disabled state.

Apon changing to automatic they started again fine and now email works, but how they got into this state is the worry.

I believe, from something similar years ago, that in msconfig there is diagnostic startup, which might result in said services being disabled. Again though, after another 'normal' reboot, why wouldn't they revert back to normal? And, how would it have gone into diag startup in the first place?

Anyway, a few other people on google seem to have had the same problem over the years but no one has really found a solution. At this stage we aren't ruling out a virus however it is a server with almost 0 access to the web so doubtful.

And exchange 2007 8.1 (some 0s missing) on server 2008 SBS (windows server standard FE 2007 SP2)

share|improve this question
1  
You never really mentioned if the server was rebooted or not. Could you confirm that? If it wasn't, that would flush out the diagnostic startup. –  Nixphoe Aug 15 '11 at 0:49
1  
Also what version of Exchange are you using? Where there any updates installed. I did find this: social.technet.microsoft.com/Forums/en-US/exchangesvrdeploy/… –  Nixphoe Aug 15 '11 at 1:06
    
He mentioned that the customer called saying that exchange wasn't working anymore because the services were disabled. If the server wouldn't have been rebooted, then the Exchange services would have kept running, even if the services were disabled. So I think we can assume that the server was rebooted. A clarification and Exchange version would be helpful though. –  Lucky Luke Aug 15 '11 at 1:47
    
While not a solution, I would recommend installing EventSentry Light (free)(eventsentry.com), which allows you to get notified when a service changes, which would include service state as well as service startup type. The free edition allows you to monitor up to three services, so that should suffice in this case. As soon as the service changes, you will get an email. Disclaimer: I work for netikus.net. –  Lucky Luke Aug 15 '11 at 1:50
    
"Again though, after another 'normal' reboot" yes it was rebooted... –  Joshua D'Alton Aug 15 '11 at 2:38
show 5 more comments

1 Answer 1

up vote 1 down vote accepted

As Nixphoe alluded to in his comment, your situation sounds very similar to problems people have after installing an Exchange security rollup or cumulative update. My guess is that the update installer stops the Exchange services and sets their startup mode to "disabled" while it copies new versions of the Exchange files.

Why disable the services? It probably doesn't want someone to inadvertently starting one of these services while the installer was running and the files were in an inconsistant state.

The real issue is that the installer didn't change the startup mode back to the original values. This might be a bug, or the installer may have been interrupted somehow and didn't get to perform its cleanup.

MS TechNet Forum post discussing this (credit to Nixphoe)... http://social.technet.microsoft.com/Forums/en-US/exchangesvrdeploy/thread/6ecf8e9a-9e27-4f2e-9e28-a59639029df1/

That post also has a set of sc.exe commands that will fix the service startup modes. Keep in mind that for most Exchange environments, the correct startup mode would probably be "automatic", but in failover/MSCS clusters, the correct mode may actually be "manual" so the cluster manager can control startup. It's always a good idea to check before you install an update.

share|improve this answer
    
good enough answer, it is probably most likely right. –  Joshua D'Alton Aug 26 '11 at 4:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.