I encountered this problem shortly after installing a second Exchange Server 2010 server into my organization. Initially I thought that this second server had caused the problem but on further investigation I found out the real culprit.
The initialization error I was receiving when opening the Exchange Management Console was:
Initialization Failed: Connecting to remote server failed with the following error message: Access is denied.
The Event Log of the server had this error:
Log Name: Application
Source: MSExchangeSA
Date: 13/12/2009 8:22:28 PM
Event ID: 9385
Task Category: General
Level: Error
Keywords: Classic
User: N/A
Computer: ex1.exchangeserverpro.local
Description:
Microsoft Exchange System Attendant failed to read the membership of the universal security group ‘/dc=local/dc=exchangeserverpro/ou=Microsoft Exchange Security Groups/cn=Exchange Servers’; the error code was ’8007203a’. The problem might be that the Microsoft Exchange System Attendant does not have permission to read the membership of the group.If this computer is not a member of the group ‘/dc=local/dc=exchangeserverpro/ou=Microsoft Exchange Security Groups/cn=Exchange Servers’, you should manually stop all Microsoft Exchange services, run the task ‘add-ExchangeServerGroupMember,’ and then restart all Microsoft Exchange services.
I double checked the “Exchange Servers” group in Active Directory and confirmed that the two servers were already in there.
I then found this error in the Event Log of the server:
Log Name: Application
Source: MSExchangeIS
Date: 13/12/2009 9:14:29 PM
Event ID: 5003
Task Category: General
Level: Error
Keywords: Classic
User: N/A
Computer: ex1.exchangeserverpro.local
Description:
Unable to initialize the Information Store service because the clocks on the client and server are skewed. This may be caused by a time change either in the client or the server, and may require a reboot of that computer. Verify that your domain is properly configured and is currently online.
As we know a time sync problem will cause Kerberos authentication issues. I checked and sure enough the clocks on the Exchange servers were out by more than 5 minutes from the domain controllers.
The reason for this was that my Exchange servers were hosted on a Hyper-V server that is not synced to the same time source as the domain controllers which are hosted on a separate VMware ESX server. Normally the Exchange servers would still sync their time with the PDC-E for their domain but the Hyper-V integration settings were overriding this.
Clearing the Time Synchronisation option and then running net time /set on the two Exchange servers brought their clocks back into sync with their domain controllers.
Restarting the servers then allowed all of the Exchange services to come online properly again, and the intialization error no longer occurred when launching the Exchange Management Console.
About Paul Cunningham
I’ve had the same issue, but I couldn’t solve it by set the time synchronisation.
Additional I had to reinstall the WinRM service. After installation type on PowerShell “winrm qucikconfig” and reboot the Server.
This might help too.
Regards,
Smu
Thanks. This saved my Friday afternoon. Time sync problem.
I can’t find settings for EX2010.xxxxxxx.local.
Management
Integration Services
Services
Time synchronization
Please help with the path as this looks like the closest fix to the exact same issue I’m having.
Cheers,
eiger3970.
Those settings are in Hyper-V, which I’m using to virtualize those servers. If yours are physical servers, or virtualized on another platform, then you’ll need to look for different time sync settings.
You will find these settings in your Hyper-V Manager if you are using MS Hyper-V. Right-Klick on the Servers in the management console and select “settings”, than you will find the Tome Synchronisation.
net time /set was success
Nice post paul. hoping you were gonna be able to save the day for me once again. I guess i went to the well one too many times. I know it’s way out of best practices, but i have one consolidated box. DC / Exch 2010 & Ocs 2007 R2. Unsure when it happened, but can’t authenticate to EMC or EMS due to the following error. Not a time issue, even tried resetting the computer and user account passwords.
Did the winRM thing, no luck
IIS seems to have a binding to port 80 on the default website too.
Certificate issue perhaps. I’ve seen it break when people mess with SSL certs via the IIS mgmt tools.
But yeah you might have gone one step too far with all that role stacking
Nice post Paul. I’ve been racking my brain trying to find a decent post to resolve this issue. I even came close to throwing in the towel and trying a recover on Exchange box.
Good call, and exact message error in Google – homed it in !!!
Thanks…
Paul: good post but i’ve got a different error and hoping you can point me in the right direction. “The attempt to connect to http://server/powershell using “kerberos” authentication failed: connecting to remote server failed with the following error message: The winRM client sent a request to an http server and got a response saying the requested http url was not available. This is usually returned by a http server that does not support the ws-management protocol”
This is what i get when trying to connect emc 2010 to a 2003 server to try to add a new forest to start the mailbox migration process. any ideas would be totally apperciated
Hi Kevin, you can’t connect to a remote Exchange 2003 server/org with the EMC for Exchange 2010. I believe you will need to run the mailbox move requests via the Exchange Management Shell instead.
It really was just a Time setting for the system. When running Exchange in a VM, if you sync the Time of the Guest OS to the ESXi host using VMtools, you need to make sure that the ESXi host time is consistent with the time on the host of the Active Directory too. Best way is to use NTP client on ESXi so they are surely synchronized. Otherwise disable time sync between the host and the guest and make sure everything is within a few minutes of each other. But NTP is really the smartest choice. Once the times are set, you might have to disable then re-enable the time sync in VMtools and all should be fine again.
Hi Paul
Thanks. This solved my problem. Time sync problem.
Regards!!
this was helpful.
did a net time / set after turning off the Hyper-v time sync. It all worked.
Sarbjit
OMG thank you so much, I was using a test lab with Hyper-V and didnt think to check the time.