Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 8260 Source: MSExchangeAL

Could not open LDAP session to directory '' using local service credentials. Cannot access Address List configuration information. Make sure the server is running.
I had a Windows 2003 DC running Exchange 2003 SP2 that was demoted. After demoting this server to a member server and rebooted, event ID 8260 appeared on another Exchange 2003 SP2 server. Exchange services were running okay. The event was logged because the RUS service was still pointing to the DC/GC that was demoted. I updated the RUS service to point to one of the other DCs and the error went away.
PING the server to see if it is online. In one case, the DC was down for some reason. We had to reboot the DC and then it worked fine.
As per Microsoft: "This event indicates that the Recipient Update Service was unable to contact a domain controller. The directory may not be available, or the name of the domain controller specified in the properties of the Recipient Update Service may be incorrect". See MSEX2K3DB and ME842116 for more details.

From a newsgroup post: "I had just completed a hardware upgrade of Exchange 2000 server using the upgrade path described in the ME297289 article. The "new" installation was successful. However, I had to manually mount the information stores after I restart the server. This happened every time I restarted the server. Once I have mounted the stores everything works like a champ. I was receiving this event along with event 8260 from MSExchangeAL. After a few days trying to fix this problem I finally called Tech Support only to find that there is a check box EX Sys Manager->storage group->database tab->"do not mount this store at start up" that is checked by default".
As per Microsoft: "The most likely cause of this event ID is that the Kerberos ticket for the server has temporarily expired. Recovery should occur very quickly. This event ID is not normally a cause for alarm.". See the link below.
This happened when an Exchange server in branch of my domain tree was deleted. To fix it, I went into Recipient Update Services, and had to delete the service for the old exchange server.

After you run dcpromo to demote a domain controller (DC) in your domain, the Exchange 2000 MSExchangeAL service starts to log an Event 8026 and an Event 8260 every 10 minutes.

ME272552 talks about changing the Recipient Update Services DC names in Exchange System Manager
This error can occure if you have spread your FSMO roles on different servers, and the one DC that are Domain Naming Master and Schema Admin for some reason are down. Your domain will still be up but errors are logged.
I activated the second Global Catalog for my domain, and then deactivated it again, this error occured.
Appeared when a child-domain was removed. Fixed by manually removing the membership of the (deleted) domain controller from AD Users and computers --> "Exchange Enterprise Servers" group, of ALL children-domains (group is Domain Local).

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.