Module 1: Setup Changes Contents Document Overview Setup Changes Setup Architectural Changes Setup Actions Require New Active Directory Permissions New Setup Prerequisite Checks: 21 Lab 1.1: Finding renamed, moved, or deleted groups 26 Cluster-related prerequisite checks 31 Exchange System Manager-only installation prerequisites 33 2000 to 2003 Setup and Upgrade Scenarios blocked 36 New Features/Components in Setup: 39 Setup Changes 44 Security improvements to setup: 49 Troubleshooting Exchange Server 2003 setup failures: 53 General Log Flow 57 Lab 1.2: Logparser and examination of progress logs 68 Lab 1.3: Applying troubleshooting concepts 70 Appendix A: Answers 74 Acknowledgments 76 Information in this document, including URL and other Internet Web site references, is subject to change without notice Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place or event is intended or should be inferred Complying with all applicable copyright laws is the responsibility of the user Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property  2003 Microsoft Corporation All rights reserved Microsoft, MS-DOS, Windows, Windows NT, Active Directory, ActiveX, Excel, Exchange Server 5.5, Exchange 2000 Server, Exchange Server 2003, Internet Explorer, Internet Information Server, Word are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries The names of actual companies and products mentioned herein (Groupwise, Lotus cc:Mail, Lotus Notes) may be the trademarks of their respective owners Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes Document Overview This module discusses differences in the setup process between Microsoft Exchange 2000 Server and Microsoft Exchange Server 2003 In addition to discussing bug-level changes, students will focus on troubleshooting the Exchange Server setup progress logs Topic Setup changes from Exchange 2000 Server Topic Troubleshooting Exchange Server 2003 setup Topic Learning measure/Labs Prerequisites Experience with installing Exchange 2000 into Exchange Server 5.5 sites Experience with creating an Exchange Virtual Server (EVS) on Windows 2000 clusters Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes Setup Changes This topic discusses differences between the setup architecture from the last product, as well as new features and work items in the setup process Those accustomed to supporting Exchange 2000 Server will expect some of the same product features and behaviors to exist in Exchange 2003 The goal of this topic is to cover any “gotchas” in differences between the two products that would otherwise cause difficulty in support Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes Setup Architectural Changes In Exchange Server 5.5, many customers established administration models so that Exchange administrators were able to administer only Exchange, and domain administrators handled almost everything else Yet Exchange 2000 Server required the installer to be given blanket permissions to the enterprise forest and the Exchange Server 5.5 directory – to the dismay of many companies migrating from, or coexisting with, Exchange Server 5.5 In order to separate these roles once more, the product group established the following “Full Administrative Group Administrator” setup changes so that network/domain admin roles could be separated from Exchange administrator roles These changes were so extensive that the process flow of setup is nearly re-architected Setup /forestprep creates a placeholder object When Exchange 2003 setup is run explicitly in ForestPrep mode (using the /forestprep switch), and there is no existing Exchange organizational object within the configuration naming context, setup will create a “temporary” organization with a hard-coded name (That name is a GUID: “{335A10875131-4D45-BE3E-3C6C7F76F5EC}”.) Setup can delegate the first Exchange administrator on this object, create the Exchange configuration underneath it, and so on At a later time, when setup is run to install the first server in the organization – by someone who is an Exchange administrator – setup can rename the existing placeholder object, either to a user-specified name or to match the name of an Exchange 5.5 organization The final naming is decided by the answer to the “Installation Type” screen Improving upon Exchange 2000 setup, the organization name deferral was designed so that • Administrators are not forced to make the organization name decision during forestprep • Enterprise/schema admins are not forced to be given Exchange Server 5.5 admin site permissions to run forestprep Conversely, Exchange 2003 installers (who are admins of an Exchange 5.5 site) are not required to have enterprise/schema admin permissions when later installing the first Exchange Server 2003 machine Installers are also no longer Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes required to have the Active Directory Connector (ADC) installed when running forestprep Troubleshooting temporary org object creation: Should there be any problems creating this GUID, it will most likely be a permissions issue, caught at the prerequisite stage with a descriptive error message If this is the case, one should ensure that the logged-on user has full control privileges on the cn=Microsoft Exchange,cn=services,cn=configuration,dc= container (By default, Enterprise Admins has this permission) Although it is possible to manually-create the temporary org object, it is neither recommended nor supported since it would also require manually creating scores of child objects and setting their permissions appropriately “Installation Type” prompt moves to server setup mode In Exchange 2000 Server, running setup with the /forestprep switch whilst in a clean forest (where there is no Exchange organization object) would always prompt the installer with the “Installation Type” screen This page of the setup wizard would ask if a new Exchange organization needed to be created or if setup should join an existing Exchange 5.5 organization Therefore, Exchange 2000 setup /forestprep not only extended the schema; for the 5.5-joining case, it would also connect and perform intensive sync operations (via a temporary config CA) with the Exchange 5.5 directory This is why with Exchange 2000 setup, the platinum-osmium synchronizer ran twice: once during explicit forestprep and again during normal server setup (The exception is if only setup.exe is run without switches, thereby setting the forestprep component to “Install” mode so that the platinum-osmium synchronizer runs only once.) Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes Figure 1.1: The “Installation Type” prompt is no longer shown during /forestprep mode In Exchange Server 2003, the “Installation Type” prompt has moved to the server setup mode That is, the prompt will only occur when running setup.exe without switches, and it will only occur once: when the first Exchange Server 2003 machine is being installed into a forest with no pre-existing Exchange organization object (The Exchange organization object is located at (cn=,cn=Microsoft Exchange, cn=services, cn=configuration, dc=.) If the installer chooses to create a new organization, the placeholder orgname is renamed to whatever the installer desires If the installer chooses the Exchange 5.5 coexistence option, the temporary orgname is renamed to match the Exchange 5.5 organization name In Exchange Server 2003, the 5.5 (Osmium) synchronization process with Active Directory will occur only once, so only a permanent config CA comes into existence (i.e no temporary config CA will exist) Table 1.1 outlines the different states of the organizational object that can exist in Active Directory: Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes Setup Action/ Detected State setup /ForestPrep setup (install a server) No organization object Create temporary org Ask user for org type/name; create org Temporary organization object N/A Ask user for org type/name; rename temporary org N/A N/A {335A1087-5131-4D45-BE3E3C6C7F76F5EC} Named organization object (exists in place of GUID) Table 1.1: Creation flow for Exchange Organization object in Active Directory This architectural change does not affect manual creation of first Administrative Group through System Manager (per 215930) However, when customers launch Exchange System Manager to manually create their administrative group, they might be surprised to see the GUID, {335A1087-5131-4D45BE3E-3C6C7F76F5EC} Note: When the temporary organization object exists, you must not run Exchange 2000 Server setup Although it does not get blocked through a prerequisite check, later in the setup process the Exchange 2000 Server setup wizard does not understand the GUID organization object, and the installation is likely to fail catastrophically Server Setup mode no longer stamps organization-level permissions Previously, the Exchange 2000 Server SETUP program would re-stamp Exchange Organization permissions on each server install The drawback was that this action would overwrite any custom changes to the permissions structure, such as removing the permission for all users to create top level public folders So if a customer kept having his/her top-level permissions reset, this was a perceived security risk In Exchange Server 2003, the setup process has changed so that it will only stamp default permissions on the Exchange Organization object once (on the first server install/upgrade) and will not re-stamp permissions for subsequent installations Although this resolves the workaround for security, the previous behavior was a useful support tool for quickly fixing customers who have inappropriately modified their Active Directory permissions on containers that cause operational problems in Exchange A typical problem would be a paranoid administrator removing required access control lists (ACLs) on various objects underneath the “Microsoft Exchange” container So in order to correct the problem, or to revert back to Exchange 2000 Server settings, one must now manually correct the Active Directory permissions by applying the permissions listed in Table 1.4 under the section entitled “New per-object permissions changes during setup.” If the customer does not mind that the security settings revert back to the Exchange 2000 Server configuration, then run Exchange 2000 setup to “join” a new Exchange 2000 server object to the existing Exchange 2003 organization Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes Setup Actions Require New Active Directory Permissions Because there are several setup modes and component options, setup will require different combinations of Active Directory permissions, depending upon the detected topology For example, setup operations dealing with a Site Replication Service (SRS) still require Exchange Full Administrator at the Organization level Table 1.2 outlines the required permissions of the person being logged on Setup Action Active Directory Permission(s) required Install first Exchange 2003 server in a domain Exchange Full Administrator at Organization level Install first Exchange 2003 server into a 5.5 site (SRSenable) Exchange Full Administrator at Organization level Uninstall/reinstall Exchange 2003 with an SRS Exchange Full Administrator at Organization level First “ForestPrep” in forest [with schema update] or ADC’s Setup when older schema is detected or Enterprise Admin [+ Schema Admin] ADC’s setup used with the explicit “schemaonly” switch Subsequent “ForestPrep” Exchange Full Administrator at Organization level “DomainPrep” Domain Administrator Install a server to have first instance of a Groupwise/Lotus Notes connector Exchange Full Administrator at Organization level Install, maintain or remove server containing Key Management Server Enterprise Admin Install, maintain or remove server with SRS enabled Exchange Full Administrator at Organization level Install additional server (non-SRSs, clusters EVSs) Exchange Full Administrator at Admin Group level + machine account added to Domain Servers group Run maintenance mode on any server (except Key Management Server or SRS enabled) Exchange Full Administrator at Admin Group level Remove a server (no SRS present) Exchange Full Administrator at Admin Group level + remove machine account from Domain Servers group Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes after setup Remove last server in org Exchange Full Administrator at Organization level Apply service pack Exchange Administrator at Admin Group level Table 1.2: Setup Matrix Several of the above actions require “Exchange Full Administrator” at the organizational level Although it is possible to manually create and grant Exchange Administrator-like permissions through ADSI Edit, it is not recommended because the specific combination of permissions and inherited rights settings are not easy to set, and setting “Full Control” on the organization object would be overkill The recommended methods for granting Exchange Full Administrator at the org level are to either: Rerun /forestprep so that the Exchange setup wizard will prompt for an additional account to be granted Org permissions, or Use the Exchange System Manager’s delegation wizard by right-clicking on the top-most organization object The proper method of granting Exchange Full Administrator at the Admin Group level is to launch Exchange System Manager’s delegation wizard by right-clicking on an Administrative Group name In Exchange 2000, you needed to be a full admin at the organization level to install, maintain, or remove any server Unfortunately, customers desired to deploy with well-separated admin groups and delegate administrators on those administrative groups who would be able to handle routine tasks like installing and maintaining servers (This had been the 5.5 model, of course.) Many efforts from our customer experience team and customers, themselves, expended considerable ingenuity in trying to find ways to work around this requirement in Exchange 2000 setup, but all in vain even if you managed to bypass the permission prerequisite, setup would still fail, since it refreshed orglevel settings and permissions during every server install; and without org-level rights, you wouldn't have access to those objects In Exchange 2003, full admin-group level admins can now install, maintain, and remove most servers within their own administrative group However, there are still exceptions: You still need full org admin permissions when installing the SRS or first Exchange 2003 server into a domain In the latter case, the first server installed into any given domain must set the access control entries (ACEs) for that domain’s "Exchange Domain Servers" group on the org-level object, which means that setup needs full org permissions Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM 62 Module 1: Setup Changes In these cases, setup may be trying to query the status of a service it has not yet created, or starting a service that is not installed, or trying to clean up directory objects that not exist However, in the case of a fatal string of errors, you might see something more like this (notice the component error message, in bold): Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes 63 [11:13:59] The command "x:\Exchange Server 2003\rtm\6623.0\server\rtl\usa\setup\i386\exchange\adc" console -RO -CA "cn=Config CA_FirstAG_EXSETUPLAB57,cn=Active Directory Connections,cn=Microsoft Exchange,cn=Services,cn=Configuration,dc=alextestdom22,dc=exte st,dc=microsoft,dc=com" -dc EXSETUPLAB64 -log "D:\Active Directory Connector.Log" failed, returning error code -2147467259 (8An unknown error has occurred.) ScCreateProcess (k:\admin\src\libs\exsetup\hiddenw1.cxx:1816) Error code 0XC103798A (31114): An internal component has failed [11:13:59] CAtomPtOz::ScLaunchADCToSynchPtWithOzTopology (k:\admin\src\udog\exsetdata\components\server\a_ptoz.cxx:462) Error code 0XC103798A (31114): An internal component has failed [11:13:59] While launching the ADC for synchronization, Setup encountered an error:' Error: 'An internal component has failed.' (k:\admin\src\udog\exsetdata\components\server\a_ptoz.cxx:1045 ) Error code 0XC103798A (31114): An internal component has failed [11:13:59] CAtomPtOz::ScAddDSObjects(), while calling ScLaunchADCToSynchPtWithOzTopology (k:\admin\src\udog\exsetdata\components\server\a_ptoz.cxx:1046 ) Error code 0XC103798A (31114): An internal component has failed [11:13:59] CAtomPtOz::ScAddDSObjects (k:\admin\src\udog\exsetdata\components\server\a_ptoz.cxx:271) Error code 0XC103798A (31114): An internal component has failed [11:13:59] CBaseAtom::ScAdd (k:\admin\src\udog\setupbase\basecomp\baseatom.cxx:885) Error code 0XC103798A (31114): An internal component has failed [11:13:59] Service = '' CBaseServiceAtom::ScAdd (k:\admin\src\udog\setupbase\basecomp\basesvcatom.cxx:203) Error code 0XC103798A (31114): An internal component has failed [11:13:59] CAtomPtOz::ScAdd (k:\admin\src\udog\exsetdata\components\server\a_ptoz.cxx:204) Error code 0XC103798A (31114): An internal component has failed [11:13:59] mode = 'Install' (61953) CAtomPtOz::ScSetup (k:\admin\src\udog\exsetdata\components\server\a_ptoz.cxx:2176 ) Error code 0XC103798A (31114): An internal component has failed Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM 64 Module 1: Setup Changes [11:13:59] >>>>>>>>>> Setup encountered a fatal error during Microsoft Exchange Forest Preparation Install component task CBaseComponent::ScSetup (k:\admin\src\udog\exsetdata\components\forprep\compforprep.cx x:461) Error code 0XC103798A (31114): An internal component has failed This is the kind of error that would result in a failed installation Strategy Tip for any Error Messages: If you have an instance of setup running, and are being presented with an error message, you can open up the setup log while setup is still running and skip right to the end of the log, which should have as its last entry the error which generated the UI error message Highlight the last log entry, and several lines above it (look for the closest Entering CAtom… line above the error entry It will contain the name of the function being called by setup at the time of the failure, which is very useful for tracking down the section of code in which the error occurred), and cut and paste that section into a separate text file By grabbing the error text in this way, you will make it easier to find in the log later If you instead continue with the setup, allowing setup to complete, the error message can be difficult to find, “hidden” as it is in the body of the log file Strategy for “Retry” dialog boxes: If your setup is with a retry/cancel pair of buttons, you are often at a recoverable state if the problem is a transient network error (as mentioned in the Troubleshooting Exchange 2003 failures section) A bad entry in a DNS cache (i.e negative DNS caching), would be an example of a transient error that can go away if not retried in ten minutes However, if resolving the root cause requires user interaction, and if the errors in the progress log are vague, there are some utilities you can use to assist in assisting setup to recover: Use network monitor to capture packets between the installing server, any Exchange 5.5 servers in the site, the ADC server, and the domain controllers and global catalogs chosen by setup (gleaned from the progress log’s configuration information section) Once the capture filter is set, start the capture and immediately hit retry The server will usually make the same calls (hopefully across the wire) and you can later examine the capture to determine where the problem resides To keep the number of frames small so that you need not examine extraneous traffic, immediately stop the capture as soon as the “retry/cancel” dialog returns If the error message relates to Active Directory Service Interfaces (ADSI), or if the error code in the progress log is accompanied by an LDAP protocol error similar to those listed in 218185 - Microsoft LDAP Error Codes, the directory service is probably from a domain controller In the case where the problem is reproducible, running setup again using the /chooseDC switch is used to narrow-down the domain controller choices, thereby making it easier to decipher the netmon capture If the error code or the surrounding progress log entries mention ‘DAPI’, then you can focus on the Exchange 5.5 directory service The root cause could just be a simple permissions setting on a naming context However, in most cases, the root cause is with IIS, WMI, or some other operating system-level Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes 65 component Use the clues from the progress log to initiate general troubleshooting in those areas, and contact a platforms specialist in case KBhunting results in nothing fruitful Strategy for common “Exchange 2000” errors: Often, error messages that you search upon will produce search results matching Exchange 2000 errors Do not discount the errors, as Exchange 2000 and Exchange 2003 setup engines are essentially the same For example, if you receive a 0xC103798A error during Exchange 2003 setup, and setup is having problems registering a DLL, you may find Exchange 2000 KB article Q245029 Do attempt the workaround in that article, even if the documented DLL is different It is likely that there is still an Exchange 5.5 exchmem.dll present on the server 0xC103798A is an EXTREMELY generic error, and so a Knowledge Base resolution should never be used after diagnosing that error code alone This error means that an internal component has failed, and thus you must ALWAYS dig within the progress log when troubleshooting this Customers will typically only use the error code before searching in KB, and so their initial problem reports may mislead you by quoting from the KB Thus, you should always be diligent in obtaining the progress log when troubleshooting 0X80072030 is another common error code, and it typically means that an object could not be found – either a file on the local disk, a local registry entry, but more typically in the Active Directory If it is the first two, use filemon or regmon (from www.sysinternals.com) to monitor the setup program If it is the latter, use network monitor to determine what object the setup program is attempting to use The packets in the network monitor trace can be viewed by timestamp (Display | Options | Time of Day), and you can correlate these with the timestamps on the errors in the setup progress log Strategy for clusters: Unlike single-server installations, where the files are copied and registered and directory service objects are added in a single session, cluster installs are divided into phases The first phase is the file-copy and registration phase of the binaries onto each node Here, the setup engine logs to the progress log as usual However, setup does not create objects in Active Directory Although setup will declare success for installing on each node, the installation is only partially complete The second phase involves manipulating the cluster administrator program (cluadmin.exe) to create the necessary resources At this stage, the setup engine is not running, and instead, cluadmin.exe performs the background processing Surprisingly, the creation of the Exchange System Attendant resource will write to the setup progress log, logging another session beginning with “Beginning setup run.” So when troubleshooting problems with the System Attendant creation or initial startup, check in places: The Exchange Server Setup Progress.Log The cluster.log file, located in %windir%\cluster on each node The cluster.log file shows important cluster properties such as whether or not a parameter is being set, based upon an application’s needs: Progress log sometimes misleading: The progress log will usually tell you what actions the user selected on the “Component selection” screen However, you cannot always trust what the Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM 66 Module 1: Setup Changes progress log says the installer has selected This is because the progress log will pre-process through some of the installation types even before the user has a chance to pick an action from the component picker tree For example, in a forest containing a single domain controller that already has Exchange 2000 Server SP2 installed, the progress log for Exchange 2003 setup will say: [09:18:51] Prerequisites for Microsoft Exchange Messaging and Collaboration Services failed: The component "Microsoft Exchange Messaging and Collaboration Services" cannot be assigned the action "Upgrade" because: - The local domain configuration is not up-to-date You must run setup with the "/DomainPrep" switch within this domain If you have already done this with the current version of Setup, then you must wait for replication to complete Consult your documentation for details - Server Z2 must be a Microsoft Exchange 2000 server with Microsoft Exchange Service Pack 3, or higher, installed The above text may mislead you to believe that the installer chose the “upgrade” action, but this is what the progress log contains, even before the user has a chance to choose an action on the component selection screen Another strategy is to search the progress log for the string “is set to action” for the components’ selected action in the component picker tree However, these too may show system-selected component actions You may be inclined at this point to look at the setup.log in \program files\microsoft integration\Microsoft Exchange\logs, but that log only lists the summary of chosen components postinstallation To accurately determine what action the customer selected during installation, look for a series of looping entries (These looping entries correspond to user clicks onto the component picker screen itself, but not an action that the user has selected.) At the end of those loops, you may find an entry similar to the following: [09:39:25] Using cached result for domain "/dc=com/dc=contoso" Following the “cached result” entry, the progress log will show the actual userselected action In most cases, it will look exactly like the pre-processed entries from above However, in some cases, the installer may have chosen another action, such as “remove.” Troubleshooting setup example: Problem description: Setup shows a popup with “Setup failed while installing sub-component Miscellaneous Atom with error code 0xC1037989 (please consult the installation logs for a detailed description) You may cancel the installation or try the failed step again.” Setup has already exited, and the customer has already attempted to uninstall/reinstall WMI per Q318731 However, the next setup attempt results in the same error Troubleshooting steps: If the knowledge base does not produce any hits, you would search for 0xC1037989 from the end of “Exchange server setup progress.log” located at the root of the system partition Here is the relevant text within the progress log file, when logparser is used to view problems at level 0: Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes 67 [18:34:08] CInsParser::ScProcessLine (K:\admin\src\libs\exsetup\hiddenw1.cxx:1226) Error code 0XC1037989 (31113): An internal component is not responding [18:34:08] Processing file 'z:\setup\i386\exchange\Misc.ins', at or near line 10 (CreateProcess:C:\WINNT\System32\WBEM;C:\WINNT\System32\WBE M\mofcomp.exe "C:\WINNT\System32\WBEM\exwmi.mof";600000) CInsParser::ScProcessLine (K:\admin\src\libs\exsetup\hiddenw1.cxx:486) Error code 0XC1037989 (31113): An internal component is not responding [18:34:08] Registry file name: 'z:\setup\i386\exchange\Misc.ins' CRegistryManager::ScProcessFile (K:\admin\src\udog\setupbase\tools\regmgr.cxx:95) Error code 0XC1037989 (31113): An internal component is not responding [18:34:08] Filename = '%sourcedir%\Misc' CBaseAtom::ScRefreshRegistryKeys (K:\admin\src\udog\setupbase\basecomp\baseatom.cxx:1217) Error code 0XC1037989 (31113): An internal component is not responding [18:34:08] CBaseAtom::ScReinstall (K:\admin\src\udog\setupbase\basecomp\baseatom.cxx:1015) Error code 0XC1037989 (31113): An internal component is not responding [18:34:08] Service = '' CBaseServiceAtom::ScReinstall (K:\admin\src\udog\setupbase\basecomp\basesvcatom.cxx:231) Error code 0XC1037989 (31113): An internal component is not responding [18:34:08] mode = 'Reinstall' (61955) CBaseAtom::ScSetup (K:\admin\src\udog\setupbase\basecomp\baseatom.cxx:775) Error code 0XC1037989 (31113): An internal component is not responding Any of these functions could be causing the problem, and the main clue may likely have appeared when setup runs the misc.ins script Since setup has already exited, you may often find that manually running some of the commands that setup attempted will reveal more clues: When running ‘mofcomp.exe "C:\WINNT\System32\WBEM\exwmi.mof” from the command prompt revealed that it was successful after 25 minutes (1,500,000 milliseconds), this meant that the 600,000 millisecond sleep parameter wasn’t enough At this point, one would copy all of the setup files to the hard drive, modify line ten of the misc.ins script file by bumping-up the sleep time, and then rerun setup In this case, setup proceeded past this point and completed successfully Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM 68 Module 1: Setup Changes Lab 1.2: Logparser and examination of progress logs Objective: This lab will get the student familiarized with logparser and significant sections of the progress log Answers are in Appendix A, but the learning experience will be ruined if answers viewed prematurely Power on any virtual machine (preferably SOLO since we will be using it in the next lab) Mount the “Admin_Labfiles.ISO” CD image into the virtual machine Open the file d:\module1_setupquestions\question1.log using notepad Can you tell what option(s) were set during component selection? Open the Exchange Server Setup Progress log from d:\module1_setupquestions\question2.log Can notepad easily show you how many times setup was run? Navigate to the D: drive and install the new version of the logparser utility Launch logparser and reopen the question2.log How many times was setup run? (Hint: The number of sessions is on the upper-left panel of logparser) When was Exchange initially installed? Which version was it? What version was the most recent install? Was it successful? 10 On the last setup session, is the user installing into the forest root domain? Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes 69 11 Try to find out the scenario (i.e pure Exchange 2003, mixed Exchange 2003 with Exchange 5.5, Exchange 2003 and Exchange 2000, or all server versions (5.5/2000/2003) installed) (Hint, if logparser only has configuration information checked, you might find useful data.) 12 Open the Exchange Server setup progress log from d:\module1_setupquestions\question3.log 13 Was setup successful? Did the services start? 14 If the customer says that his Exchange services are inoperable, and he sent you progress3.log, can you explain why it is not operable? Do you think the stores mounted? 15 Open the Exchange Server setup progress log from d:\module1_setupquestions\question4.log 16 Was the /chooseDC switch used? 17 How many administrative groups exist in the Exchange organization? Do we have proper permissions to read them? Other questions: 18 Marker checks are enforced in which of the following scenarios? (Check all that apply) a) Setup of a new Exchange 2003 server in a site where Exchange 5.5 and Exchange 2000 servers exist b) Setup of a new Exchange 2003 server in a site where Exchange 2003 and Exchange 5.5 servers exist c) Setup of new Exchange 2003 server in a site where Exchange 5.5 exists d) Setup of new Exchange 2000 server in a site where Exchange Server 5.5 and Exchange 2000 Server exist e) Setup of new Exchange 2000 server in a site where only one Exchange Server 2003 server already exists 19 T/F: There are a fixed number of atoms running during setup Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM 70 Module 1: Setup Changes Lab 1.3: Applying troubleshooting concepts Objectives: In the next three exercises, students will practice troubleshooting using the above procedures recognize that even the simplest of problems are ambiguous Exercise 1: In this exercise, students will troubleshoot an upgrade from Exchange 2000 SP3 to Exchange Server 2003 build 6851 There is a specific problem to this prerelease build that does not exist in the released/shipped build However, we can practice troubleshooting using the procedures discussed in the troubleshooting lesson Lab setup: Power-on “Solo.” Username: Standalone\Administrator Password: password “Solo” is a Windows 2000 SP3 domain controller running Exchange 2000 Server SP3 It is a standalone server with no complicated components (no SRS or installed connectors) Exchange Server 2003 build 6851 forestprep and domainprep have already been executed without problems 1) Use Logparser to examine the existing progress log file on the C: drive Can you determine if forestprep and domainprep have already been executed? Were there any problems with those installs? 2) Mount the Exchange 2003 beta build (6851) ISO image onto the virtual CD ROM drive, and start the server upgrade process Setup will fail catastrophically during the setup phase DO NOT choose the CANCEL button! 3) For each time you choose “retry” confirm that you see “Retrying failed operation.” DO NOT choose the CANCEL button! 4) Make a copy of the setup progress.log file, and you may run logparser against that copy (The reason we choose to make a copy is because the logparser cannot open the file that is already locked by setup Similarly, if logparser opens a previous progress log, a new setup instance cannot append to the progress log because is locked Then, setup will resort to creating a new progress log with a “2” suffix.) DO NOT choose the CANCEL button! As in the upgrade scenario, pressing cancel will result in a partial/broken installation 5) Proceed to troubleshoot only using logparser against the progress log file Instructor notes: The mssearch service has been disabled In this simple exercise, students are to simply review the progress log file while they get the “retry/cancel” option They should open the progress log, view the last setup session, and look for these errors: Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes 71 [16:58:04] Entering CAtomMDB::ScInstallCreateSearchApplication [16:58:04] Creating Microsoft Search application [16:58:04] Creating search admin component [16:58:04] Getting the applications interface [16:58:04] CAtomMDB::ScInstallCreateSearchApplication (f:\df6803\admin\src\udog\exsetdata\components\server\a_mdb cxx:1975) Error code 0X80070422 (1058): The service cannot be started, either because it is disabled or because it has no enabled devices associated with it [16:58:04] Leaving CAtomMDB::ScInstallCreateSearchApplication [16:58:04] Entering CAtomMDB::ScPauseSearchFullPopulation [16:58:04] Entering CAtomMDB::ScGetBuildCatalogsInterface [16:58:04] Creating search admin component [16:58:04] Getting the applications interface [16:58:04] CAtomMDB::ScGetBuildCatalogsInterface (f:\df6803\admin\src\udog\exsetdata\components\server\a_mdb cxx:2253) Error code 0X80070422 (1058): The service cannot be started, either because it is disabled or because it has no enabled devices associated with it [16:58:04] Leaving CAtomMDB::ScGetBuildCatalogsInterface [16:58:04] CAtomMDB::ScPauseSearchFullPopulation (f:\df6803\admin\src\udog\exsetdata\components\server\a_mdb cxx:2352) Error code 0X80070422 (1058): The service cannot be started, either because it is disabled or because it has no enabled devices associated with it [16:58:04] Leaving CAtomMDB::ScPauseSearchFullPopulation [16:58:04] CAtomMDB::ScRefreshMDBDSObjects (f:\df6803\admin\src\udog\exsetdata\components\server\a_mdb cxx:835) Error code 0X80070422 (1058): The service cannot be started, either because it is disabled or because it has no enabled devices associated with it [16:58:04] Leaving CAtomMDB::ScRefreshMDBDSObjects [16:58:04] CAtomMDB::ScRefreshDSObjects (f:\df6803\admin\src\udog\exsetdata\components\server\a_mdb cxx:627) Error code 0X80070422 (1058): The service cannot be started, either because it is disabled or because it has no enabled devices associated with it [16:58:04] Leaving CAtomMDB::ScRefreshDSObjects Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM 72 Module 1: Setup Changes [16:58:04] CBaseAtom::ScReinstall (f:\df6803\admin\src\udog\setupbase\basecomp\baseatom.cxx:1 138) Error code 0X80070422 (1058): The service cannot be started, either because it is disabled or because it has no enabled devices associated with it [16:58:04] Service = 'MSExchangeIS' CBaseServiceAtom::ScReinstall (f:\df6803\admin\src\udog\setupbase\basecomp\basesvcatom.cx x:247) Error code 0X80070422 (1058): The service cannot be started, either because it is disabled or because it has no enabled devices associated with it [16:58:04] Leaving CBaseServiceAtom(Information Store Service)::ScReinstall [16:58:04] CBaseServiceAtom::ScUpgradeFrom2000 (f:\df6803\admin\src\udog\setupbase\basecomp\basesvcatom.cx x:418) Error code 0X80070422 (1058): The service cannot be started, either because it is disabled or because it has no enabled devices associated with it [16:58:04] Leaving CBaseServiceAtom(Information Store Service)::ScUpgradeFrom2000 [16:58:04] mode = 'Upgrade' (61968) CBaseAtom::ScSetup (f:\df6803\admin\src\udog\setupbase\basecomp\baseatom.cxx:8 41) Error code 0X80070422 (1058): The service cannot be started, either because it is disabled or because it has no enabled devices associated with it The strategy is to look a few lines above the initial error for the calling function They will see that setup tried to create the MSSearch service Hopefully, the students will understand that this Exchange 2000 service was disabled, and it must be re-enabled Once started, they hit the retry button, and the upgrade to Exchange 2003 proceeds When you are finished with your troubleshooting and have proceeded through the upgrade past the point of failure, power off the virtual machine and discard changes on the undo drive Exercise 2: Turn on the virtual machine located in the “SetupExercise2” folder Servername: Z2 Username: MS\Administrator Password: Password1 Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes 73 This virtual machine is similar to the virtual machine in the first exercise Practice upgrading and troubleshooting the errors you encounter You may use the release bits (Ti6844.4) to perform the upgrade In this exercise, the disk is near capacity, but not full enough for setup to fail the prerequisite check The GUI portion of setup should fail without any indication of a true reason Thus, students have an opportunity to investigate using the progress log When you are finished with this lab, power off Z2 and discard any changes to the undo drive Exercise 3: Upgrading a cluster The purpose of this exercise is to observe the steps required for a rolling upgrade on a cluster There is nothing “broken” in this configuration Power on the cluster nodes and located in the “c:\vms\flats\module setup*” folder (or it may be called something similar) Please be sure not to start the cluster virtual machines from module #5 (Clustering Lab) Setup: Each cluster node is also a domain controller Note: This configuration is meant to optimize lab equipment; it is not a recommended configuration in reality, as cluster nodes should not reside on domain controllers What build of Exchange Server 2003 is installed? Open cluster administrator Right-click on the EXVS1 group What new option you see? Right-click on the system attendant resource Observe that the same option is selectable In the “net name test” cluster group, create a new System Attendant resource Open the setup progress log using logparser (located on the desktop) Although you never ran setup.exe, you see any changes? Mount the Ti6944.4EntEval.ISO image to the virtual machine Upgrade each node via rolling upgrade (refer to getting started guide) But instead of choosing “upgrade” on the component selection screen, choose “reinstall.” Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM 74 Module 1: Setup Changes Appendix A: Answers 1.2.4: "The component Microsoft Exchange is set to "Reinstall" 1.2.5: Not really If we wanted to find out, we'd need to search for the string "Beginning Setup" or patterns of asterisks ("*****") and count the lines they occur 1.2.6: Nine times 1.2.8: Setup was run on 1/13/2003 This was Exchange 2000 Server release build (4417) 1.2.9: Build 6895 No, it was not successful because this entry does not exist at the end: CComBOIFacesFactory::QueryInterface (f:\df6895\admin\src\udog\bo\bofactory.cxx:54) Error code 0X80004002 (16386): No interface Instead, it was probably killed in the middle of a dialog box 1.2.10: No, this is where we can make use of our "m_str" searches to find server role information All in the same general area, we find: DSROLE_PRIMARY_DOMAIN_INFORMATION::DomainNameFlat = "MLABNET" DSROLE_PRIMARY_DOMAIN_INFORMATION::DomainNameDns = "mlabnet.com" DSROLE_PRIMARY_DOMAIN_INFORMATION::DomainForestName = "mlabroot.com" m_strRootDomain = "mlabroot.com" In this case, the user is installing to some other domain in the forest (mlabnet.com) that appears to be a root of its own tree The forest root domain is mlabroot.com 1.2.11: Not likely to have Exchange 5.5 in the environment, because 55serviceaccountlogin is uninitialized Furthermore, there are no hrdirprereq* strings anywhere in the log This is likely a Pure Exchange 2003 or Exchange 2000/2003 admin group However, this cursory inspection doesn't rule-out the possibility that there might be an Exchange Server 5.5 server in some other admin group in the org 1.2.13: Yes, setup was successful from seeing this string: !!!!!!!!!!Setup completed successfully! And a few lines above that, we see many services starting 1.2.14: The server is not operational because this was a cluster node installation And as such, no Active Directory objects were created representing the server or its stores So users will not be able to use it until a virtual server Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes 75 has been created, which in turn creates the IS resource, in which case the stores can mount In its present state, no stores are mounted 1.2.16: No, setup chose its own suitable domain controller for setup: No user-specified DC; setup has chosen m_strDC = "CRPDALDCS00" 1.2.17: Four administrative groups exist, and we have perms to read: [08:28:00] Enumerating all admin groups in the org [08:28:00] Found admin groups [08:28:00] Checking permissions on the admin group: /dc=com/dc=testofamerica/cn=Configuration/cn=Services/cn=Micro soft Exchange/cn=Bank of America/cn=Administrative Groups/cn=ASIA Administrative Group [08:28:00] We have permission ExchAG_Read [08:28:00] We have permission ExchAG_Write [08:28:00] We have permission ExchAG_SetPerms [08:28:00] Checking permissions on the admin group: /dc=com/dc=testofamerica/cn=Configuration/cn=Services/cn=Micro soft Exchange/cn=Bank of America/cn=Administrative Groups/cn=EMEA Administrative Group [08:28:00] We have permission ExchAG_Read [08:28:00] We have permission ExchAG_Write [08:28:00] We have permission ExchAG_SetPerms [08:28:00] Checking permissions on the admin group: /dc=com/dc=testofamerica/cn=Configuration/cn=Services/cn=Micro soft Exchange/cn=Bank of America/cn=Administrative Groups/cn=North American Administrative Group [08:28:00] We have permission ExchAG_Read [08:28:00] We have permission ExchAG_Write [08:28:01] We have permission ExchAG_SetPerms [08:28:01] Checking permissions on the admin group: /dc=com/dc=testofamerica/cn=Configuration/cn=Services/cn=Micro soft Exchange/cn=Bank of America/cn=Administrative Groups/cn=Routing Adminisrative Group [08:28:01] We have permission ExchAG_Read [08:28:01] We have permission ExchAG_Write [08:28:01] We have permission ExchAG_SetPerms [08:28:01] Final set of permissions: 0XF0C0E0E0 1.2.18: A and C (B is not an answer because the first Exchange 2003 server install had already performed its marker checks) 1.2.19: False The number of atoms running varies, depending on the scenarios detected, and which options the installer chooses from the component picker Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM 76 Module 1: Setup Changes Acknowledgments Microsoft Employee Vincent Yim Max Vaysburg, Ross TenEyck, Alexander MacLeod, Gwen Zierdt, Bryan Atwood KB article 823145 XADM: Exchange 2003 Server Setup and Installation Top Support Issues Last Saved: 7/24/2003 1:55 AM Last Printed: 7/24/2003 12:55 PM ... 7/24/2003 1:5 5 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes 35 property sheets on Exchange 2003 servers Last Saved: 7/24/2003 1:5 5 AM Last Printed: 7/24/2003 12:55 PM 36 Module 1: Setup. .. Active Directory: Last Saved: 7/24/2003 1:5 5 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes Setup Action/ Detected State setup /ForestPrep setup (install a server) No organization... 7/24/2003 1:5 5 AM Last Printed: 7/24/2003 12:55 PM Module 1: Setup Changes Setup Actions Require New Active Directory Permissions Because there are several setup modes and component options, setup