Microsoft KB Archive/867641

= The Microsoft Exchange Event Service does not start =

Article ID: 867641

Article Last Modified on 10/28/2006

-

APPLIES TO


 * Microsoft Exchange Server 5.5 Standard Edition

-



Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



INTRODUCTION
Various issues may cause the Microsoft Exchange Event Service to not start. This article discusses the causes and the resolutions for each issue.



Symptoms
When you try to start the Microsoft Exchange Event Service, you may receive the following error message:

Could not start the Microsoft Exchange Event Service on Local Computer. The service did not return an error. This could be an internal Windows error or an internal service error. If the problem persists, contact your system administrator.

Additionally, the following Event ID may be logged in the Application log: Event Type: Error

Event Source: MSExchangeES

Event Category: General

Event ID: 5

Computer: SERVERNAME

Description: An unexpected MAPI error occurred. Error returned was [0x80004005].

Cause 1
This issue may occur if one of the following conditions is true:
 * The Exchange Server computer has been installed with the wrong organization name, with the wrong server name, or with the wrong site name.
 * The registry values for the organization, for the server name, or for the site name have been modified.

Resolution 1
To resolve this issue if you know the correct organization name, server name, or site name, modify the appropriate registry value. To do this, follow these steps. Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.  Start Registry Editor. Under the following key in the registry, locate the Enterprise value, the Server value, or the Site value:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeSA\Parameters

 On the Edit menu, click String, modify the value to match the correct organization name, server name, or site name. Click OK. Quit Registry Editor.

Note The organization name, the server name, and site name are case sensitive. Make sure that you type the correct name and case for each value. If another Exchange Server computer exists in the same site, you can compare the values from the X.500 distinguished name (DN) registry value in the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeMTA\Parameters

Cause 2
This issue may occur if the following conditions are true:
 * The Microsoft Exchange Event Service is using a different service account than the other Microsoft Exchange services.
 * The permissions on the service account that is used to start the service have been changed.

Note This event may also be logged if you change one server's (Server A's) private store to use the public store on another server (Server B). This change is not complete until the directory changes have been replicated from Server A to Server B. Replication may take 10 to 15 minutes. You can also initiate replication. After replication, the Microsoft Exchange Event Service should start typically.

Resolution 2
To resolve this issue, use the Exchange service account to start the Microsoft Exchange Event Service, or modify the permissions on the current service account. The account used to start the Microsoft Exchange Event Service should have Service Account Admin rights on the Exchange organization, on the site, and on the configuration containers.

Symptoms
The Microsoft Exchange Event Service may not start on your Microsoft Exchange Server 5.5 computer. Additionally, the following event is logged in the Application log: Event Type: Error

Event Source: MSExchangeES Event

Event Category: General

Event ID: 5

Description: An unexpected MAPI error occurred. Error returned was [0x80040110].

Cause
This issue occurs when the following section is missing from the WINNT\System32\Mapisvc.inf file: [MSEMS_MSMail_Section] UID=13DBB0C8AA05101A9BB000AA002FC45A 66000003=01050000 66010003=04000000 66050003=03000000 66040003=02000000

Resolution
To resolve this issue, add the missing section to the WINNT\System32\Mapisvc.inf file, and then start the Microsoft Exchange Event Service.

Symptoms
The Microsoft Exchange Event Service does not start. The following Event ID appears in the Application log: Event ID: 5

Event Source: MSExchangeES

Event Type: Error

Description: An unexpected MAPI error occurred 0x80040154

Cause
Error 0x80040154 signifies that there is an unregistered .dll file. This behavior may occur when Microsoft Outlook is installed on the server at one point and is then uninstalled. The removal of Outlook unregisters a shared server and a client .dll file. This issue may also occur if one of the .dll files that is used by the Microsoft Exchange Event Service is corrupted.

Resolution
To resolve this issue, reregister the Microsoft Exchange Event Service .dll files by using regsvr32. To do this, follow these steps:  At a command prompt, change directories to the Exchsrvr\bin subdirectory.

Note The location of the binary libraries on your server may vary. Change the path in this step accordingly.</li> Type the following command. In the command,  is the name of the .dll file, such as &quot;Scripto.dll&quot;:

regsvr32 .dll

</li> Run the command on the following .dll files: <ul> Scripto.dll</li> Ss.dll</li> Esconf.dll</li> Emsmdb32.dll</li> Mapi32.dll</li> Esconf.dll</li> Eventmsg.dll</li> Exflow.dll</li></ul> </li></ol>

Workaround
If this problem was caused by uninstalling Outlook on the Exchange Server computer, you can resolve the problem by reinstalling the Microsoft Outlook client on the Exchange Server computer. This action allows the service to start.

To reinstall the Outlook client on an Exchange Server computer, follow these steps:
 * 1) Stop all the Exchange services, and then change the Exchange System Attendant to Disabled
 * 2) Stop and disable all third-party services such as monitoring agents, backup programs, and antivirus programs.
 * 3) Stop the SNMP service if it is running.
 * 4) Quit all programs.
 * 5) Restart the server.
 * 6) Reinstall the Outlook client on the server.
 * 7) Change the Exchange System Attendant startup back to Automatic.
 * 8) Manually start the Exchange services, except for the Microsoft Exchange Event Service.
 * 9) Manually start the Microsoft Exchange Event Service.

Symptoms
When you try to start the Microsoft Exchange Event Service, you receive the following error message:

The service did not respond to the start or control request in a timely fashion Microsoft Windows NT ID no:0xc002041D

The Event Viewer in Microsoft Windows 2000 Server or in Windows NT Server may display the following Event ID: Event Type: Error

Event ID: 4

Event Category: General

Event Source: MSexchangeES

Description: An unexpected OS error occurred. Error Returned was [5]. Access Denied

Cause
The Exchange service account does not have the required permissions.

Resolution
To resolve this problem, add the Exchange service account to the local Power Users group or to the local Administrators group on a member server. On a domain controller, add the account to the built-in Administrators group.

Symptoms
The Microsoft Exchange Event Service does not start. The following Event ID appears in the application event log: Event Type: Error

Event Source: MSExchangeES

Event Category: General

Event ID: 5

Description: An unexpected MAPI error occurred. Error returned was [0x80030005].

The hexadecimal error 0x80030005 equals -2147287035. The 2147287035 error maps to the STG_E_ACCESSDENIED error.

Cause
This issue may occur if there are not sufficient permissions for the Exchange service account on the Esics.dat file. This file is created in your %SystemRoot% folder every time that the Microsoft Exchange Event Service is started. The Exchange service account should have Full Control permissions to this file.

Resolution
Grant the Exchange service account Full Control permissions to the Esics.dat file. If the problem still occurs, rename the Esics.dat file, and then try to start the Microsoft Exchange Event Service.

Additional information
This issue may also occur if the Esics.dat file is being scanned by an antivirus program. You should add the Esics.dat file to the exclusions list for any file-level virus scanning. This file is used by the Microsoft Exchange Event Service to maintain Incremental Change Synchronization (ICS) state information. This file keeps track of the changes in the information store that have been handled by the Microsoft Exchange Event Service. The Esics.dat file is removed every time that the Microsoft Exchange Event Service shuts down. When the service is started again, the file is re-created. Do not rename or delete this file when the Microsoft Exchange Event Service is running.

For additional information about troubleshooting the Microsoft Exchange Event Service, click the following article number to view the article in the Microsoft Knowledge Base:

192174 Removing and reinstalling the Event Service

Keywords: kbinfo KB867641

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.