5.2 Managing Exchange services

---

Exchange is not a single, monolithic, executable image running on your server. Instead, Exchange is a collection of cooperating services. Table 5.1 lists these Exchange services and the other prerequisite services that also must be running. Exchange 2003 has flattened the dependency hierarchy of Exchange services so that the protocol services are no longer dependent on the Information Store service. This allows administrators to bring the Exchange store online and offline in parallel with the protocols.

Table 5.1: Exchange Services

Service	Function	Service Name/Executable	Required Service
Microsoft Exchange Connectivity Controller	Provides support services for Microsoft Exchange connectors	MSExchangeCoCo Iscntrl.exe	Event Log Microsoft Exchange System Attendant
Microsoft Exchange Connector for Lotus Notes	Allows sharing of mail traffic with Lotus Notes systems	LME-NOTES dispatch.exe	Event Log Microsoft Exchange Connectivity Controller Microsoft Exchange Information Store
Microsoft Exchange Connector for Novell GroupWise	Allows sharing of mail traffic with Novell Group Wise systems	LME-GWISE dispatch.exe	Event Log Microsoft Exchange Connectivity Controller Microsoft Exchange Information Store Microsoft Exchange Router for Novell GroupWise
Microsoft Exchange Event	Monitors folders and fires events for Exchange 5.5-compatible server applications	MSExchangeES events.exe	Microsoft Exchange Information Store
Microsoft Exchange IMAP4	Provides IMAP4 services	IMAP4Svc inetinfo.exe	IIS Admin Service
Microsoft Exchange Information Store	Manages the Information Storage; if this service is stopped, mailbox stores and public folder stores are unavailable	MSExchangeIS store.exe	EXIFS Microsoft Exchange System Attendant
Microsoft Exchange Management	Provides Exchange management information using WMI	MSExchangeMGMT exmgmt.exe	Remote Procedure Call (RPC) Windows Management Instrumentation
Microsoft Exchange MTA Stacks	Provides X.400 services	MSExchangeMTA emsmta.exe	Microsoft Exchange System Attendant
Microsoft Exchange POP3	Provides POP3 services	POP3Svc inetinfo.exe	IIS Admin Service
Microsoft Exchange Router for Novell GroupWise	Provides support for scheduling collaboration with Novell GroupWise systems	MSExchangeGWRtr gwrouter.exe	Event Log
Microsoft Exchange Routing Engine	Provides topology and routing information	RESvc inetinfo.exe	IIS Admin Service
Microsoft Exchange Site Replication Service	Emulates Exchange 5.5 directory service	MSExchangeSRS srsmain.exe
Microsoft Exchange System Attendant	Provides monitoring, maintenance, and Active Directory lookup services	MSExchangeSA mad.exe	Event Log NT LM Security Support Provider Remote Procedure Call (RPC) Server Workstation
IIS, Internet Information Server; IMAP, Internet Mail Access Protocol; MTA, Message Transfer Agent; POP, Post Office Protocol

In addition to the Exchange services, several non-Exchange services are important for Exchange. Some of these are listed in Table 5.2

Table 5.2: Associated Services

Service	Function	Service Name/Executable	Required Service
Event Log	Enables event log messages to be viewed in Event Viewer	Eventlog services.exe
IIS Admin Service	Allows web and FTP service administration using the IIS snap-in	IISADMIN inetinfo.exe	Remote Procedure Call (RPC) Security Accounts Manager
Microsoft Active Directory Connector	Replicates objects from the Exchange 5.5 directory into the Active Directory for use by Exchange 2003	MSADC adc.exe	Event Log NT LM Security Support Provider Remote Procedure Call (RPC) Server Workstation
Network News Transport Protocol (NNTP)	Transports network news across the network	NntpSvc inetinfo.exe	EventLog IISAdmin Service
NT LM Security Support Provider	Provides security to RPC programs that use transports other than named pipes	NtLmSsp lsass.exe
Remote Procedure Call (RPC)	Serves as the end- point mapper and COM Service Control Manager	RpcSs svchost.exe
Server	Supports file, print, and named-pipe sharing over the network	lanmanserver svchost.exe
Simple Mail Transport Protocol (SMTP)	Transports electronic mail across the network	SMTPSVC inetinfo.exe	Event Log IIS Admin Service
Windows Management Instrumentation	Provides a common interface and object model to access management information about applications and services	winmgmt svchost.exe	Event Log Remote Procedure Call (RPC)
Workstation	Creates and maintains client network connections to remote servers	lanmanworkstation svchost.exe
IIS, Internet Information Services

5.2.1 Starting Exchange services

Certain Exchange services depend on other Exchange services. If these services are started out of order, the needed services will automatically be started. For example, if an attempt is made to start the Information Store before the System Attendant, the Windows service manager will automatically start the System Attendant. These prerequisite services are shown in Figure 5.5.

Figure 5.5: Exchange service dependencies

By default, most Exchange services are configured to automatically start when the server is rebooted. However, there may be times when the services will need to be started manually. The following procedure can be used to start the Exchange services:

1. Begin from the Windows Start menu by selecting All Programs →Administrative Tools →Services (Figure 5.6).

   
   Figure 5.6: Services dialog box

2. Right-click on the service you want to start, and select Start to start the service.

3. Right-click on any other services you want to start, and select Start to start the service.

4. Use the Windows Event Viewer to ensure that all of the services started. You can start the Event Viewer by selecting All Programs →Administrative Tools →Event Viewer from the Windows Start menu. Exchange events are listed in the Application Log. Table 5.3 contains a list of the event IDs that correspond to successful service startups.

Table 5.3: Service Start Event Numbers

Service	Event Source	Event ID
Microsoft Active Directory Connector	MSADC	8001
Microsoft Exchange Management	MSExchangeMGMT	3
Microsoft Exchange Connectivity Controller	MSExchangeCoCo	8229
Microsoft Exchange Connector for Lotus Notes	MSExchangeNOTES	8229
Microsoft Exchange Connector for Novell GroupWise	MSExchangeGWISE	8229
Microsoft Exchange Event	MSExchangeES	0
Microsoft Exchange IMAP4	IMAP4Svc	1033
Microsoft Exchange Information Store	MSExchangeIS Mailbox MSExchangeIS Public MSExchangeIS	9523 9523 001
Microsoft Exchange MTA Stacks	MSExchangeMTA	9298
Microsoft Exchange POP3	POP3Svc	1003
Microsoft Exchange Router for Novell GroupWise	MSExchangeGWRtr	6015
Microsoft Exchange Routing Engine	MSExchange Transport	1005
Microsoft Exchange System Attendant	MSExchangeSA	9014

If a service fails to start, wait a few minutes and try again. A common cause of failures is that the service is dependent on another service that has not finished starting. Waiting a few minutes allows these services to finish. Check to ensure that all the necessary services have been started. Try to start the service several times before assuming failure.

Sometimes the Exchange server is simply in a state where a reboot is required, so reboot and try again before assuming the service has failed. If all attempts to start the service fail, it may still be possible to run the service as an application. Running the service as an application also usually has the advantage of producing more detailed error reporting. This is an acceptable short-term solution while continuing to investigate the problem. The event log will record at least one event for any service start failures. The event will provide a starting point for troubleshooting.

A common cause for many service start failures is that the Exchange service-account permissions cannot be validated. If the Microsoft Exchange Information Store service will not start, it may be in a state of recovery. A normal recovery takes from 5 to 50 minutes, depending on the number of log files. Check the event viewer to verify that recovery is taking place.

If the Microsoft Exchange System Attendant will not start, check the event viewer to make sure that the network and related services are working properly. The network services must be running before the System Attendant will start.

5.2.2 Stopping Exchange services

Exchange services should be stopped cleanly if an Exchange server needs to be restarted. This will ensure that the Exchange databases are stopped properly and that the databases are left in a consistent state.

Because many Exchange services are dependent on the Microsoft Exchange System Attendant, it is possible to quickly stop many Exchange services simply by stopping the System Attendant. However, if you are having system problems, stopping the services one at a time may help to identify the source of the problem and may improve the likelihood that the server will restart successfully.

Patience is important. The Information Store service must commit all outstanding transactions to the database. If a service, such as the Information Store, takes an unusually long time to stop, it is often difficult to tell if there is a problem or if the service simply needs more time to complete. You can use the Windows Performance Monitor to determine whether the service is still attempting to stop or if it has encountered an unexpected error. If the process time for the service is nonzero, it is possible that the service is still attempting to stop, and more patience is required. It is not uncommon for this to take as long as 30 minutes. If you prematurely abort a service stop or if the service hangs, the service will be left in an unknown state.

You can use the following procedure to stop Exchange services:

1. Begin from the Windows Start menu by selecting All Programs →Administrative Tools →Services.

2. Right-click on the service you want to stop, and select Stop to stop the service.

3. Right-click on any other services you want to stop, and select Stop to stop the service.

4. Use the Windows Event Viewer to ensure that all of the services stopped. You can start the Event Viewer by selecting All Programs →Administrative Tools →Event Viewer from the Windows Start menu. Exchange events are listed in the Application Log. Table 5.4 contains a list of the event IDs that correspond to successful service stop events.

   Table 5.4: Service Stop Event Numbers

   Service	Event Source	Event ID
   Microsoft Active Directory Connector	MSADC	8002
   Microsoft Exchange Management	MSExchange MGMT	5
   Microsoft Exchange Connectivity Controller	MSExchangeCoCo	8230
   Microsoft Exchange Connector for Lotus Notes	MSExchangeNOTES	8230
   Microsoft Exchange Event	MSExchangeES	1
   Microsoft Exchange IMAP4	IMAP4Svc	1035
   Microsoft Exchange Information Store	MSExchangeIS Mailbox MSExchangeIS Public	9539 9539
   Microsoft Exchange MTA Stacks	MSExchangeMTA	9299
   Microsoft Exchange POP3	POP3Svc	1035
   Microsoft Exchange Router for Novell GroupWise	MSExchangeGWRtr	6016
   Microsoft Exchange Routing Engine	MSExchange Transport	1004
   Microsoft Exchange System Attendant	MSExchangeSA	9016
   IMAP, Internet Mail Access Protocol; MTA, message transfer agent; POP, Post Office Protocol

---