Microsoft KB Archive/926210

= Event ID 529 and Event ID 681 are logged, and users cannot connect to Exchange 2000 Server by using a MAPI client =

Article ID: 926210

Article Last Modified on 11/1/2006

-

APPLIES TO


 * Microsoft Exchange 2000 Server Standard Edition
 * Microsoft Exchange 2000 Enterprise Server

-



SYMPTOMS
You experience the following symptoms in a Microsoft Exchange 2000 Server organization:  When a user tries to connect to Exchange 2000 Server by using any MAPI client, such as Microsoft Outlook, the user is prompted to enter a user name and a password. Then, the user receives the following error message:

The logon credentials supplied were incorrect. Make sure your username and domain are correct, then type your password again.

Therefore, the user cannot connect to Exchange by using a MAPI client such as Outlook. The user can successfully connect to Exchange by using Microsoft Outlook Web Access together with the same credentials.  The following events are logged in the Security log: Event ID: 529

Event Source: Security

Event Category: Logon/Logoff

User: NT AUTHORITY/SYSTEM

Computer:

Description: Logon Failure:

Reason: Unknown user name or bad password

User Name:

Domain:

Logon Type: 3

Logon Process: NtLmSsp

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

Workstation Name: Event ID: 681

Event Source: Security

Event Category: Account Logon

User: NT AUTHORITY/SYSTEM

Computer:

Description: The logon to account:  by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 from workstation:   failed. The error code was: 3221225572. 



CAUSE
This issue may occur if the Microsoft Exchange Information Store service or other Exchange-related services cannot bind to a TCP port successfully. You may experience this issue if the following conditions are true:
 * One or more Exchange-related services are configured to use static TCP port assignments.
 * Other services on the computer bind to these ports before the Exchange-related services can bind to these ports.

In this situation, the Exchange-related services do not try to use alternative ports.



RESOLUTION
To resolve this issue, determine whether the Microsoft Exchange Information Store service or other Exchange-related services are mapped to available TCP ports. To do this, follow these steps.

Step 1: Generate a list of the RPC port mappings
Use the RPC Dump tool (Rpcdump.exe) to generate a list of the services that are bound to TCP ports. This tool is included with the Microsoft Windows 2000 Resource Kit tools.

For more information about how to obtain this tool, contact Microsoft Product Support Services. For more information about how to contact Microsoft Product Support Services, visit the following Web site:

http://support.microsoft.com/contactussupport/?ws=support



To generate a list of the services that are mapped to TCP ports on the computer, follow these steps:  On the computer that is running Exchange 2000 Server, create a new folder that is named RPCdump. Copy the RPCdump.exe file to the RPCdump folder.</li> Start a command prompt, and then change directory to the RPCdump directory.</li> At the command prompt, type the following command, and then press ENTER:

rpcdump /S  > rpcdump.txt

Note In this command, replace  with the name of the computer that is running Exchange 2000 Server.</li> Use any text editor, such as Notepad, to open the Rpcdump.txt file that you generated in step 1d.</li> Locate the following section in this file:

ncacn_ip_tcp(Connection-oriented TCP/IP)

</li></ol>

This section of the Rpcdump.txt file displays all the services that are mapped to TCP ports together with each service's port mapping. These port mappings are displayed in the following format:

<pre class="fixed_text"> <IP ADDRESS> [ ] [GUID] <Service Name>

This file should contain the following service entries:
 * Exchange Server STORE EMSMDB Interface
 * Microsoft Information Store
 * MS Exchange MTA 'QAdmin' Interface
 * MS Exchange MTA 'Mta' Interface
 * Exchange Server STORE ADMIN Interface
 * MS Exchange Directory NSPI Proxy
 * MS Exchange Directory RFR Interface
 * MS Exchange System Attendant Cluster Interface
 * MS Exchange System Attendant Private Interface
 * MS Exchange System Attendant Public Interface

The following sample output shows the correct service entries:

<pre class="fixed_text">ncacn_ip_tcp(Connection-oriented TCP/IP) 10.0.100.32[1987] [38a94e72-a9bc-11d2-8faf-00c04fa378ff] MS Exchange MTA 'QAdmin' Interface :NOT_PINGED 10.0.100.33[1987] [38a94e72-a9bc-11d2-8faf-00c04fa378ff] MS Exchange MTA 'QAdmin' Interface :NOT_PINGED 10.0.100.34[1987] [38a94e72-a9bc-11d2-8faf-00c04fa378ff] MS Exchange MTA 'QAdmin' Interface :NOT_PINGED 10.0.100.32[1987] [9e8ee830-4459-11ce-979b-00aa005ffebe] MS Exchange MTA 'Mta' Interface :NOT_PINGED 10.0.100.33[1987] [9e8ee830-4459-11ce-979b-00aa005ffebe] MS Exchange MTA 'Mta' Interface :NOT_PINGED 10.0.100.34[1987] [9e8ee830-4459-11ce-979b-00aa005ffebe] MS Exchange MTA 'Mta' Interface :NOT_PINGED 10.0.100.32[1033] [a4f1db00-ca47-1067-b31f-00dd010662da] Exchange Server STORE EMSMDB Interface :NOT_PINGED 10.0.100.33[1033] [a4f1db00-ca47-1067-b31f-00dd010662da] Exchange Server STORE EMSMDB Interface :NOT_PINGED 10.0.100.34[1033] [a4f1db00-ca47-1067-b31f-00dd010662da] Exchange Server STORE EMSMDB Interface :NOT_PINGED 10.0.100.32[1033] [0e4a0156-dd5d-11d2-8c2f-00c04fb6bcde] Microsoft Information Store :NOT_PINGED 10.0.100.33[1033] [0e4a0156-dd5d-11d2-8c2f-00c04fb6bcde] Microsoft Information Store :NOT_PINGED 10.0.100.34[1033] [0e4a0156-dd5d-11d2-8c2f-00c04fb6bcde] Microsoft Information Store :NOT_PINGED 10.0.100.32[1033] [1453c42c-0fa6-11d2-a910-00c04f990f3b] Microsoft Information Store :NOT_PINGED 10.0.100.33[1033] [1453c42c-0fa6-11d2-a910-00c04f990f3b] Microsoft Information Store :NOT_PINGED 10.0.100.34[1033] [1453c42c-0fa6-11d2-a910-00c04f990f3b] Microsoft Information Store :NOT_PINGED 10.0.100.32[1033] [10f24e8e-0fa6-11d2-a910-00c04f990f3b] Microsoft Information Store :NOT_PINGED 10.0.100.33[1033] [10f24e8e-0fa6-11d2-a910-00c04f990f3b] Microsoft Information Store :NOT_PINGED 10.0.100.34[1033] [10f24e8e-0fa6-11d2-a910-00c04f990f3b] Microsoft Information Store :NOT_PINGED 10.0.100.32[1033] [99e64010-b032-11d0-97a4-00c04fd6551d] Exchange Server STORE ADMIN Interface :NOT_PINGED 10.0.100.33[1033] [99e64010-b032-11d0-97a4-00c04fd6551d] Exchange Server STORE ADMIN Interface :NOT_PINGED 10.0.100.34[1033] [99e64010-b032-11d0-97a4-00c04fd6551d] Exchange Server STORE ADMIN Interface :NOT_PINGED 10.0.100.32[1033] [99e64010-b032-11d0-97a4-00c04fd6551d] Exchange Server STORE ADMIN Interface :NOT_PINGED 10.0.100.33[1033] [99e64010-b032-11d0-97a4-00c04fd6551d] Exchange Server STORE ADMIN Interface :NOT_PINGED 10.0.100.34[1033] [99e64010-b032-11d0-97a4-00c04fd6551d] Exchange Server STORE ADMIN Interface :NOT_PINGED 10.0.100.32[1033] [89742ace-a9ed-11cf-9c0c-08002be7ae86] Exchange Server STORE ADMIN Interface :NOT_PINGED 10.0.100.33[1033] [89742ace-a9ed-11cf-9c0c-08002be7ae86] Exchange Server STORE ADMIN Interface :NOT_PINGED 10.0.100.34[1033] [89742ace-a9ed-11cf-9c0c-08002be7ae86] Exchange Server STORE ADMIN Interface :NOT_PINGED 10.0.100.32[1033] [a4f1db00-ca47-1067-b31e-00dd010662da] Exchange Server STORE ADMIN Interface :NOT_PINGED 10.0.100.33[1033] [a4f1db00-ca47-1067-b31e-00dd010662da] Exchange Server STORE ADMIN Interface :NOT_PINGED 10.0.100.34[1033] [a4f1db00-ca47-1067-b31e-00dd010662da] Exchange Server STORE ADMIN Interface :NOT_PINGED 10.0.100.32[1032] [f5cc5a18-4264-101a-8c59-08002b2f8426] MS Exchange Directory NSPI Proxy :NOT_PINGED 10.0.100.33[1032] [f5cc5a18-4264-101a-8c59-08002b2f8426] MS ExchangeDirectory NSPI Proxy :NOT_PINGED 10.0.100.34[1032] [f5cc5a18-4264-101a-8c59-08002b2f8426] MS Exchange Directory NSPI Proxy :NOT_PINGED 10.0.100.32[1031] [1544f5e0-613c-11d1-93df-00c04fd7bd09] MS Exchange Directory RFR Interface :NOT_PINGED 10.0.100.33[1031] [1544f5e0-613c-11d1-93df-00c04fd7bd09] MS Exchange Directory RFR Interface :NOT_PINGED 10.0.100.34[1031] [1544f5e0-613c-11d1-93df-00c04fd7bd09] MS Exchange Directory RFR Interface :NOT_PINGED 10.0.100.32[1031] [f930c514-1215-11d3-99a5-00a0c9b61b04] MS Exchange System Attendant Cluster Interface :NOT_PINGED 10.0.100.33[1031] [f930c514-1215-11d3-99a5-00a0c9b61b04] MS Exchange System Attendant Cluster Interface :NOT_PINGED 10.0.100.34[1031] [f930c514-1215-11d3-99a5-00a0c9b61b04] MS Exchange System Attendant Cluster Interface :NOT_PINGED 10.0.100.32[1031] [83d72bf0-0d89-11ce-b13f-00aa003bac6c] MS Exchange System Attendant Private Interface :NOT_PINGED 10.0.100.33[1031] [83d72bf0-0d89-11ce-b13f-00aa003bac6c] MS Exchange System Attendant Private Interface :NOT_PINGED 10.0.100.34[1031] [83d72bf0-0d89-11ce-b13f-00aa003bac6c] MS Exchange System Attendant Private Interface :NOT_PINGED 10.0.100.32[1031] [469d6ec0-0d87-11ce-b13f-00aa003bac6c] MS Exchange System Attendant Public Interface :NOT_PINGED 10.0.100.33[1031] [469d6ec0-0d87-11ce-b13f-00aa003bac6c] MS Exchange System Attendant Public Interface :NOT_PINGED 10.0.100.34[1031] [469d6ec0-0d87-11ce-b13f-00aa003bac6c] MS Exchange System Attendant Public Interface :NOT_PINGED

The following sample output shows that some service entries are missing. These missing service entries include the Microsoft Information Store entry and the MS Exchange System Attendant entry.

<pre class="fixed_text">ncacn_ip_tcp(Connection-oriented TCP/IP) 10.0.100.32[3595] [38a94e72-a9bc-11d2-8faf-00c04fa378ff] MS Exchange MTA 'QAdmin' Interface :NOT_PINGED 10.0.100.33[3595] [38a94e72-a9bc-11d2-8faf-00c04fa378ff] MS Exchange MTA 'QAdmin' Interface :NOT_PINGED 10.0.100.34[3595] [38a94e72-a9bc-11d2-8faf-00c04fa378ff] MS Exchange MTA 'QAdmin' Interface :NOT_PINGED 10.0.100.32[3595] [9e8ee830-4459-11ce-979b-00aa005ffebe] MS Exchange MTA 'Mta' Interface :NOT_PINGED 10.0.100.33[3595] [9e8ee830-4459-11ce-979b-00aa005ffebe] MS Exchange MTA 'Mta' Interface :NOT_PINGED 10.0.100.34[3595] [9e8ee830-4459-11ce-979b-00aa005ffebe] MS Exchange MTA 'Mta' Interface :NOT_PINGED 10.0.100.32[1032] [f5cc5a18-4264-101a-8c59-08002b2f8426] MS Exchange Directory NSPI Proxy :NOT_PINGED 10.0.100.33[1032] [f5cc5a18-4264-101a-8c59-08002b2f8426] MS Exchange Directory NSPI Proxy :NOT_PINGED 10.0.100.34[1032] [f5cc5a18-4264-101a-8c59-08002b2f8426] MS Exchange Directory NSPI Proxy :NOT_PINGED 10.0.100.32[3518] [1544f5e0-613c-11d1-93df-00c04fd7bd09] MS Exchange Directory RFR Interface :NOT_PINGED 10.0.100.33[3518] [1544f5e0-613c-11d1-93df-00c04fd7bd09] MS Exchange Directory RFR Interface :NOT_PINGED 10.0.100.34[3518] [1544f5e0-613c-11d1-93df-00c04fd7bd09] MS Exchange Directory RFR Interface :NOT_PINGED

Step 2: Determine whether Exchange is configured to use static port mappings
If you determined that one or more Exchange-related service entries are missing from the list of RPC port mappings, examine the Windows registry to determine whether Exchange is configured to use static port mappings. For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:

270836 Exchange Server static port mappings

If you do not require static port mappings for the Exchange interfaces, remove the static port mappings. If you need static port mappings for the Exchange interfaces, use the netstat -an command to determine which ports are currently being used. Then, configure the Exchange interfaces to use different ports.

After you remove all the static port mappings, or after you assign unused TCP ports to the Exchange interfaces, restart all the Exchange-related services.

Additional query words: XADM

Keywords: kbeventlog kbtshoot kberrmsg kbprb KB926210

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.