Exchange 2010 Management Console Initialization Failed

I encountered this problem shortly after installing a second Exchange Server 2010 server into my organization.  Initially I thought that this second server had caused the problem but on further investigation I found out the real culprit.

The error I was receiving when opening the Exchange Management Console was:

Connecting to remote server failed with the following error message: Access is denied.

The Event Log of the server had this error:

Log Name:      Application
Source:        MSExchangeSA
Date:          13/12/2009 8:22:28 PM
Event ID:      9385
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      ex1.exchangeserverpro.local
Description:
Microsoft Exchange System Attendant failed to read the membership of the universal security group ‘/dc=local/dc=exchangeserverpro/ou=Microsoft Exchange Security Groups/cn=Exchange Servers’; the error code was ‘8007203a’. The problem might be that the Microsoft Exchange System Attendant does not have permission to read the membership of the group.

If this computer is not a member of the group ‘/dc=local/dc=exchangeserverpro/ou=Microsoft Exchange Security Groups/cn=Exchange Servers’, you should manually stop all Microsoft Exchange services, run the task ‘add-ExchangeServerGroupMember,’ and then restart all Microsoft Exchange services.

I double checked the Exchange Servers group and confirmed that the two servers were already in there.

I then found this error in the Event Log of the server:

Log Name:      Application
Source:        MSExchangeIS
Date:          13/12/2009 9:14:29 PM
Event ID:      5003
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      ex1.exchangeserverpro.local
Description:
Unable to initialize the Information Store service because  the clocks on the client and server are skewed.   This may be caused by a time change either in the client or the server,  and may require a reboot of that computer.   Verify that your domain is properly configured and  is currently online.

As we know a time sync problem will cause authentication issues.  I checked and sure enough the clocks on the Exchange servers were out by more than 5 minutes from the domain controllers.

The reason for this is that the Exchange servers are hosted on a Hyper-V server that is not synced to the same time source as the domain controllers which are hosted on a separate VMware ESX server.  Normally the Exchange servers would still sync their time with the PDC-E for their domain but the Hyper-V integration settings were overriding this.

Clearing the Time Synchronisation option and then running net time /set on the two Exchange servers brought their clocks back into sync with their domain controllers.

Restarting the servers then allowed all of the Exchange services to come online properly again.

Tagged as: Exchange 2010, Hyper-V