Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1005 Source: MSExchangeSA

Source
Level
Description
Unexpected error <error description> occurred.
Comments
 
Event 1005 seems to be a general event code used to indicate that something the System Attendant needs is missing or corrupt. Exchange records a 1005 error in various conditions. See the links below.

- Error code 0xc0040000 - The Microsoft Exchange Server computer is not available. Either there are network problems or the Microsoft Exchange Server computer is down for maintenance. Microsoft Exchange Server Information Store ID no: 8004011d-0526-00000000 - As per Microsoft: "Though the event appears to be a problem with the server, it is actually an expected behavior. The Exchange system attendant is attempting to contact the information store, which is not available at the specified time. After the Exchange Setup program has completed, it begins restarting all the related services". See ME175100 and ME236582.
- Error: The specified domain either does not exist or could not be contacted. Facility: Win32 ID no: c007054b Microsoft Exchange System Attendant occurred. - See ME252137
- Error: Function 'EcGetProxies2'. Exception: 0xc0000005 Location: 0x78001799 - no info
- Error: The required MAPI profile cannot be created because the file MAPISVC.INF cannot be modified. - no info
- Error: 80040a01 Microsoft Exchange System Attendant
From a newsgroup post: "I recently had occasion to talk at length with an SBS support rep from MS PSS. He told me that he completely uninstalls his anti-virus program before installing service packs, hotfixes, etc. This seems a little extreme to me, but they apparently have a huge database of problems that are caused by anti-virus programs interfering with other processes."
Several other posts suggested that the problem was fixed bu uninstalling the antivirus program before any Exchange service packs.
- Error code 0x8009000f = "Object already exists" - See ME329033, ME325964
- Error code 0x8009030c = "Logon denied"
Error: 0x8009030c = "Logon denied". We received this error on a Veritas Cluster. This was caused by the VCS Helper Service account not having permissions. Fixed it by running the Veritas Cluster Configuration Wizard and setting a new account for the Helper Service to run under.
- Error: The Local Security Authority cannot be contacted ID no: 80090304 Microsoft Exchange System Attendant - See ME940845.
- Error code 0xc0040000 - The object cannot be found in the directory. This may be because replication has not completed" - See "ME249712.
- Error code 0xc0040000 - Network problems are preventing connection to the Microsoft Exchange Server computer. Microsoft Exchange Server Information Store ID no: 80040115-0514-000006bf - See ME288952.
- Error: No site name is available for this computer. Facility: Win32 ID no: c007077f Microsoft Exchange System Attendant - See ME261949 and ME299563.
- Error: An unknown error has occurred. ID no: 80040a01 Microsoft Exchange System Attendant - See ME314294.
- Error code 0xc0040000 - The Microsoft Exchange Server computer is not available. Either there are network problems or the Microsoft Exchange Server computer is down for maintenance. Microsoft Exchange Server Information Store ID no: 8004011d-0526-00000000 - See ME275538.
- Error: The specified module could not be found. Facility:Win32 ID no: c007007e Microsoft System Attendant - See ME274447.
- Error code 0xc1050000 - This error can occur when one of the mailbox stores is shutdown for maintenance (or for other reasons).
- Error: Network problems are preventing connection to the Microsoft Exchange Server computer -  For Small Business Server 4.5 as per Microsoft this event does not cause problems. See ME228747.
- Error code 80040a01 - See ME327401.


- Error: The specified directory service attribute or value does not exist. Facility: Win32 ID no: 8007200a Microsoft Exchange System Attendant occurred. As per Microsoft: "This behavior can occur when the permissions set by the first Exchange 2000 server are modified and overwritten with the data from the second server during replication that occurs during the same time frame. This can occur when you install an additional Exchange 2000 server in another domain before the configuration objects of the first installation of Exchange 2000 Server in the grandchild domain have propagated throughout the entire Exchange organization". See ME247473 on how to troubleshoot this problem.
- Error: Unexpected error. There is no such object on the server.Facility: Win32 ID no: 80072030 Microsoft Exchange System Attendant occurred. See ME273389.
- Error: Unexpected error The system could not find the environment option that was entered. Facility: Win32 ID no: c00700cb Microsoft Exchange System Attendant occurred. See ME833395.
- Error: Unexpected error An unknown error has occurred. ID no: fffffffd Microsoft Exchange System Attendant occurred. See ME251640.
- Error: Unexpected error An unknown error has occurred. Facility: Win32 ID no: c0070810 Microsoft Exchange System Attendant occurred. See ME283257.
- Error: Unexpected error. The specified procedure could not be found. Facility: Win32 ID no: c007007f Microsoft Exchange System Attendant occurred. See ME295620.
- Error: Network problems are preventing connection to the Microsoft Exchange Server computer. Facility: Win32 ID no: c0040000 Microsoft Exchange Server Information Store occured. See ME252543.
- Error: Unexpected error The specified domain either does not exist or could not be contacted. Facility: Win32 ID no: c007054b Microsoft Exchange System Attendant occurred. See ME273428.
- Error: Unexpected error An unknown error has occurred. Facility: Win32 ID no: c0070952 Microsoft Exchange System Attendant occurred. See ME297363.
- Error: Unexpected error Access is denied. ID no: 00000005 Microsoft Exchange System Attendant occurred. See ME271920.
- Error: Unexpected error Access denied. Facility: LDAP Provider ID no: 80070005 Microsoft Exchange System Attendant occurred. See ME301364.
- Error: Unexpected error An unknown error has occurred. ID no: 80040a01 Microsoft Exchange System Attendant occurred. See ME318431, ME327844, and ME328646.
- Error: Unexpected error A local error has occurred. Facility: Win32 ID no: 8007203b Microsoft Exchange System Attendant occurred - See ME316710.
- Error: Unexpected error Invalid Signature. ID no: 80090006 Microsoft Exchange System Attendant occurred - See ME831393.
- Error: Unexpected error No site name is available for this machine.
Facility: Win32 ID no: c007077f Microsoft Exchange System Attendant occurred - See ME316349.
- Error code 0xc1050000 - The attempt to log on to the Microsoft Exchange Server computer has failed. The MAPI provider failed. Microsoft Exchange Server Information Store ID no: 8004011d-0512-00000000 - See ME888179 and ME896703.
- Error: Unexpected error - The RPC server is unavailable - See ME842471.

Event ID 1005 in the application log is usually accompanied by the problem of the System Attendant not starting. See MSEX2K3DB for troubleshooting tips on this event.
- Error: Unexpected error A local error has occurred. Facility: Win32 ID no: 8007203b Microsoft Exchange System Attendant occurred - I received this error and found that the netlogon service had stopped. I started the netlogon service and then the Exchange System Attendant started correctly.
Unexpected error No site name is available for this machine - An error appears on Exchange 2000 W2K functions as second DC with AD, after removing AD by running DCPROMO. See ME322834.
ME269489 was pretty much all the information that was needed. It was corrupted/missing registry key (HKEY_CLASSES_ROOT\LDAP\Clsid) for me that prevented the MSExchangeSA from starting. Re-created the key and the correct valua (GUID) and MSExchangeSA started OK along with the rest of the E2K services. According to MS this is problem with the MS product before IE 5.5SP2.
Error code 0xc0040000 - This issue can occur because when you restore an earlier online backup to an empty Mdbdata folder (or restore an earlier online backup with the erase all existing data option) and start the Information Store service, a new Edb.log file is created with the current log generation. See ME275602.
The error can occur if you try to mount the Mailbox Store or the Public Folder Store. This issue may occur if the Microsoft Windows 2000 Group Policy Object has been deleted or modified. See ME316709 link below.
I got this error along with 1197 after I restored Exch 5.5 server to another box with a different name when attempting to start the IS. Then referenced MS ME244976. I then just ran Exch SP 4 and all the services restarted.
When this event appears together with 9022 and 9149, as per ME325674 "This issue may occur if the server account does not have the correct permissions on both the Exchange Organization container and the server container in Active Directory".

For Error code 0xc00706b7 see ME267573. Read also about Error/1028/MSExchangeSA as they are related.
As per ME312859, this issue may occur if a domain controller or a global catalog is not available or if there is only a very slow connection to the domain controller or global catalog.


Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...