The Microsoft Exchange Event Service does not start (867641)

MORE INFORMATION

Scenario 1

Symptoms

When you try to start the Microsoft Exchange Event Service, you may receive the following error message: Additionally, the following Event ID may be logged in the Application log:Event Type: Error
Event Source: MSExchangeES
Event Category: General
Event ID: 5
Computer: SERVERNAME
Description: An unexpected MAPI error occurred. Error returned was [0x80004005].

Cause 1

This issue may occur if one of the following conditions is true:

• The Exchange Server computer has been installed with the wrong organization name, with the wrong server name, or with the wrong site name.
• The registry values for the organization, for the server name, or for the site name have been modified.

Resolution 1

To resolve this issue if you know the correct organization name, server name, or site name, modify the appropriate registry value. To do this, follow these steps. Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

1. Start Registry Editor.
2. Under the following key in the registry, locate the Enterprise value, the Server value, or the Site value:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeSA\Parameters

3. On the Edit menu, click String, modify the value to match the correct organization name, server name, or site name. Click OK.
4. Quit Registry Editor.

Note The organization name, the server name, and site name are case sensitive. Make sure that you type the correct name and case for each value. If another Exchange Server computer exists in the same site, you can compare the values from the X.500 distinguished name (DN) registry value in the following registry key:

Cause 2

This issue may occur if the following conditions are true:

• The Microsoft Exchange Event Service is using a different service account than the other Microsoft Exchange services.
• The permissions on the service account that is used to start the service have been changed.

Note This event may also be logged if you change one server's (Server A's) private store to use the public store on another server (Server B). This change is not complete until the directory changes have been replicated from Server A to Server B. Replication may take 10 to 15 minutes. You can also initiate replication. After replication, the Microsoft Exchange Event Service should start typically.

Resolution 2

To resolve this issue, use the Exchange service account to start the Microsoft Exchange Event Service, or modify the permissions on the current service account. The account used to start the Microsoft Exchange Event Service should have Service Account Admin rights on the Exchange organization, on the site, and on the configuration containers.

Scenario 2

Symptoms

The Microsoft Exchange Event Service may not start on your Microsoft Exchange Server 5.5 computer. Additionally, the following event is logged in the Application log: Event Type: Error
Event Source: MSExchangeES Event
Event Category: General
Event ID: 5
Description: An unexpected MAPI error occurred. Error returned was [0x80040110].

Cause

This issue occurs when the following section is missing from the WINNT\System32\Mapisvc.inf file:

[MSEMS_MSMail_Section]
UID=13DBB0C8AA05101A9BB000AA002FC45A
66000003=01050000
66010003=04000000
66050003=03000000
66040003=02000000

Resolution

To resolve this issue, add the missing section to the WINNT\System32\Mapisvc.inf file, and then start the Microsoft Exchange Event Service.

Scenario 3

Symptoms

The Microsoft Exchange Event Service does not start. The following Event ID appears in the Application log: Event ID: 5
Event Source: MSExchangeES
Event Type: Error
Description: An unexpected MAPI error occurred 0x80040154 <0x80040107>

Cause

Error 0x80040154 signifies that there is an unregistered .dll file. This behavior may occur when Microsoft Outlook is installed on the server at one point and is then uninstalled. The removal of Outlook unregisters a shared server and a client .dll file. This issue may also occur if one of the .dll files that is used by the Microsoft Exchange Event Service is corrupted.

Resolution

To resolve this issue, reregister the Microsoft Exchange Event Service .dll files by using regsvr32. To do this, follow these steps:

1. At a command prompt, change directories to the Exchsrvr\bin subdirectory.
   
   Note The location of the binary libraries on your server may vary. Change the path in this step accordingly.
2. Type the following command. In the command, Filename is the name of the .dll file, such as "Scripto.dll":

   regsvr32 Filename.dll

3. Run the command on the following .dll files:
   • Scripto.dll
   • Ss.dll
   • Esconf.dll
   • Emsmdb32.dll
   • Mapi32.dll
   • Esconf.dll
   • Eventmsg.dll
   • Exflow.dll

Workaround

If this problem was caused by uninstalling Outlook on the Exchange Server computer, you can resolve the problem by reinstalling the Microsoft Outlook client on the Exchange Server computer. This action allows the service to start.

To reinstall the Outlook client on an Exchange Server computer, follow these steps:

1. Stop all the Exchange services, and then change the Exchange System Attendant to Disabled
2. Stop and disable all third-party services such as monitoring agents, backup programs, and antivirus programs.
3. Stop the SNMP service if it is running.
4. Quit all programs.
5. Restart the server.
6. Reinstall the Outlook client on the server.
7. Change the Exchange System Attendant startup back to Automatic.
8. Manually start the Exchange services, except for the Microsoft Exchange Event Service.
9. Manually start the Microsoft Exchange Event Service.

Scenario 4

Symptoms

When you try to start the Microsoft Exchange Event Service, you receive the following error message: The Event Viewer in Microsoft Windows 2000 Server or in Windows NT Server may display the following Event ID: Event Type: Error
Event ID: 4
Event Category: General
Event Source: MSexchangeES
Description: An unexpected OS error occurred. Error Returned was [5]. Access Denied

Cause

The Exchange service account does not have the required permissions.

Resolution

To resolve this problem, add the Exchange service account to the local Power Users group or to the local Administrators group on a member server. On a domain controller, add the account to the built-in Administrators group.

Scenario 5

Symptoms

The Microsoft Exchange Event Service does not start. The following Event ID appears in the application event log: Event Type: Error
Event Source: MSExchangeES
Event Category: General
Event ID: 5
Description: An unexpected MAPI error occurred. Error returned was [0x80030005]. The hexadecimal error 0x80030005 equals -2147287035. The 2147287035 error maps to the STG_E_ACCESSDENIED error.

Cause

This issue may occur if there are not sufficient permissions for the Exchange service account on the Esics.dat file. This file is created in your %SystemRoot% folder every time that the Microsoft Exchange Event Service is started. The Exchange service account should have Full Control permissions to this file.

Resolution

Grant the Exchange service account Full Control permissions to the Esics.dat file. If the problem still occurs, rename the Esics.dat file, and then try to start the Microsoft Exchange Event Service.

Additional information

This issue may also occur if the Esics.dat file is being scanned by an antivirus program. You should add the Esics.dat file to the exclusions list for any file-level virus scanning. This file is used by the Microsoft Exchange Event Service to maintain Incremental Change Synchronization (ICS) state information. This file keeps track of the changes in the information store that have been handled by the Microsoft Exchange Event Service. The Esics.dat file is removed every time that the Microsoft Exchange Event Service shuts down. When the service is started again, the file is re-created. Do not rename or delete this file when the Microsoft Exchange Event Service is running.

For additional information about troubleshooting the Microsoft Exchange Event Service, click the following article number to view the article in the Microsoft Knowledge Base: