Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1042 Source: MSExchangeMU

Source
Level
Description
Metabase Update failed to read the Configuration namespace property from the domain controller. Error code is <error code>.
Comments
 
- Error code: 80040a01 - The Microsoft Exchange System Attendant service may not come online on a server that is running Microsoft Exchange Server 2003 in a Microsoft Windows 2000 active/passive cluster. This problem occurs if the RootVer registry value is invalid. See ME906154 to correct this problem.
As per Microsoft: "This event indicates that Exchange was not able to read the configuration namespace property from any domain controller. The error code in the event may vary, depending on why Exchange was not able to read the configuration namespace property. One of the more common values is 0x80040a01. This event frequently occurs when the topology discovery process in Directory Service Access (DSAccess) fails. Some reasons that the topology discovery process in DSAccess fails include intermittent or faulty network connectivity, DNS problems, or permissions problems". See MSEX2K3DB for more details.
From Microsoft Technical Support: "This error event may be logged for a variety of reasons. The associated symptoms may include the following:

1. Information Store service may not start.
2. Store databases may not mount.
3. POP3 Service may not start.
4. IMAP4 Service may not start.
5. Clustered Exchange Resources may not come online.

CAUSES:
=======
One of the causes of for this event is that a Domain Controller that was running Exchange Server 2003 Server was demoted to a Member Server. During this demotion, the ASPNET Security account is removed, due to which the Metabase Update process is unable to initialize.

This Event may also be seen if there are underlying network connectivity and DNS issues.

This problem may be caused by an invalid or unexpected data in the RootVer String value under the following registry key: HKLM\SOFTWARE\Microsoft\ASP.NET.
For example, when the .NET Framework 1.1 is installed, the value of the RooVer key should be 1.1.4322.0. However, if the .NET Framework 1.0 is later installed on the same computer, the RootVer key will be changed to also include the hotfix version, for example, 1.1.4322.573. When this happens, the Metabase update process can no longer access the proper registry path to the ASP.NET\1.1.4322.0 hive as required and, therefore, fails. Similarly, if the data in the String Value RootVer is changed to an invalid value, say, 0.0.0.0, you may see the same error event.

Finally, this Event message can also be logged if there are permissions problems in the Exchange Server environment.

RELATED EVENTS:
=================
The following are some of the other Event Messages that may be seen:

MSExchangeSA Event ID 1031: One of the System Attendant's task is blocked. Function: ScStartVM Required.

MSExchangeMU Event ID 1043: Metabase Update failed to initialize enumerator of virtual server on cluster database. Error code is error 800706b5 (The interface is
unknown.).

POP3SVC Event ID 1036: An error occurred while starting the Microsoft Exchange POP3 Service: server instance number 1 failed to start with error 0x80040a01.

IMAP4SVC Event ID 1036: An error occurred while starting the Microsoft Exchange IMAP4 Service: server instance number 1 failed to start with error 0x80040a01.

MSExchangeCluster Event ID 1019: Exchange System Attendant - (EXCHANGE): Failed to bring this resource online because of timeout.

MSExchangeCluster Event ID 1003: Exchange System Attendant - (EXCHANGE): Failed to bring the resource online.

MSExchangeCluster Event ID 1012: Exchange Information Store Instance - (EXCHANGE): The RPC call to the service to take the resource offline failed.

RESOLUTION:
============

1. If this Event is caused by the demotion of a Domain Controller running Exchange Server 2003 to a Member Server, then you will have to reinstall Exchange Server 2003 to resolve this issue.

2. If this Event is logged due to a suspected permissions issue, you can run SETUP/DOMAINPREP to resolve the issue.

3. If this Event is caused by an invalid entry in the RootVer key, then edit the value to be 1.1.4322.0".

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...