You cannot fail over the Exchange 2000 System Attendant cluster resource to the passive node where the latest service pack was installed (887722)


The information in this article applies to:

  • Microsoft Exchange 2000 Server

SUMMARY

After you install a Microsoft Exchange 2000 Server service pack on an Exchange 2000 passive cluster node, you may find that you cannot fail over the Exchange System Attendant cluster resource to the passive node.

You may experience this issue if one of the following conditions is true:

If the Cluster Service on the Exchange computer does not have Exchange Full Administrator permissions.

If the Cluster Service on the Exchange computer is not a member of the local administrators groups on the nodes

This article describes how to resolve this issue.

SYMPTOMS

After you apply an Exchange 2000 service pack to the passive node of a Microsoft Windows 2000 active or passive cluster, you may experience the following behavior:
  • When you restart the Exchange 2000 computer, you cannot fail over the Exchange System Attendant resource to the passive node to update the active node.
  • The following event ID messages are logged in the Application log: Event Type: Error
    Event Source: MSExchangeCluster
    Event Category: Services
    Event ID: 2146
    Date: Date
    Time: Time
    User: N/A
    Computer: Node_Server_Name
    Description:
    Virtual _Server_Name System Attendant: An Error occured during the Exchange resource upgrade, please make sure the Admin Group and Routing Group was not changed after the creation of the Exchange resource. Refer to the upgrade documentation for details. Event Type: Error
    Event Source: MSExchangeCluster
    Event Category: Services
    Event ID: 2065
    Date: Date
    Time: Time
    User: N/A
    Computer: Node_Server_Name
    Description:
    Virtual_Server_Name System Attendant: Failed to bring the resource online.
  • When you view the Exchange Server Setup Progress.log file, information that is similar to the following is displayed:
    [14:10:07] Looking for an existing server object
    [14:10:07] Didn't find an existing server object
    [14:10:07] Enumerating all admin groups in the org
    [14:10:07] No admin groups found; extending org-level perms to AG level
    [14:10:07] Final set of permissions: 0X40400000

    [14:10:07] Entering CBaseAtom(Microsoft Exchange Server-Level Objects)::ScRefreshDSObjects
    [14:10:07] Entering CAtomServer::ScAddDSObjects
    [14:10:07] Creating Active Directory objects for Microsoft Exchange Server-Level Objects
    [14:10:07] Entering ScCreateServerObject
    [14:10:07] Creating Server Object with DN=/dc=com /dc=domain/cn=Configuration/cn=Services/cn=Microsoft Exchange/cn=Organization_Name/cn=Administrative Groups/cn=Group_Name/cn=Servers/cn=Computer_Name
    [14:10:07] ScCreateServerObject (i:\admin\src\

CAUSE

This issue can occur if the Cluster service account does not have the Full Exchange Administrator permissions at the organization level, or if it is not a member of the local administrators group on both nodes.

RESOLUTION

To make sure that the Cluster service account has Exchange Full Administrator permissions at the organization level, follow these steps:
  1. Click Start, point to Programs, point to Microsoft Exchange, and then click System Manager.
  2. In the Exchange System Manager console tree, right-click your Exchange organization name, and then click Delegate control.
  3. In the Exchange Administration Delegation Wizard dialog box, click Next.
  4. In the Users or Groups page of the wizard, click Add.
  5. In the Delegate Control Box dialog box, click Browse.
  6. In the Select Users, Computers or Groups list, click Cluster_Service_Account, and then click OK.
  7. In the Role area of the Delegate Control dialog box, click Exchange Full Administrator, and then click OK.
  8. Click Next, and then click Finish.
To make sure that the Cluster service account is a member of the local administrators group, follow these steps:
  1. Click Start, point to Programs, point to Administrative Tools, and then click Computer Management.
  2. Expand the Computer Management (local) container.
  3. Expand the System Tools container.
  4. Expand the Local Users and Groups container.
  5. Click the Groups container.
  6. In the right pane, double-click the Administrators group to see the members.
  7. Click Add, and then click Advanced.
  8. Click Locations, click Your_Domain_Name container in the Location list, and then click OK.
  9. Click Find Now.
  10. Click the Cluster_Service_Account, and then click OK three times.

REFERENCES

For more information about rolling upgrades and how they are applied, visit the following Microsoft Web sites, and download a white paper on this subject:

http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/security/secdefs.mspx

http://microsoft.com/windows2000/docs/RollUpgr.doc

Modification Type:MajorLast Reviewed:2/9/2006
Keywords:kbtshoot kbprb KB887722 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.