Event ID 1025 is logged two times in the Application log with the "EcGenerateNRN: Error: 0x80070005" and "EcGenerateReadReport: Error: 0x80070005" error codes on a computer that is running Exchange Server 2003 or Exchange 2000 Server (899393)

RESOLUTION

Step 1: Export the permission entries for the Exchange server object

1. Determine the distinguished name of the Exchange server. To do this, follow these steps.
   
   Warning If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client, and you incorrectly modify the attributes of Active Directory objects, you can cause serious problems. These problems may require that you reinstall Microsoft Windows 2000 Server, Microsoft Windows Server 2003, Microsoft Exchange 2000 Server, Microsoft Exchange Server 2003, or both Windows and Exchange. Microsoft cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk.
   1. Start the ADSI Edit tool. To do this, click Start, click Run, type adsiedit.msc in the Open box, and then click OK.
      
      Note The ADSI Edit tool is included with the Microsoft Windows Support Tools. Use one of the following methods to install the Microsoft Windows Support Tools:
      • Double-click Setup.exe in the Support\Tools folder on the Microsoft Windows 2000 CD.
      • Double-click Suptools.msi in the Support\Tools folder on the Microsoft Windows Server 2003 CD.
   2. In the ADSI Edit Microsoft Management Console (MMC) snap-in, expand Configuration Container [domaincontrollername.example.com].
   3. Expand CN=Configuration,DC=example,DC=com, expand CN=Services, expand CN=Microsoft Exchange, expand CN=organizationName, expand CN=Administrative Groups, expand CN=yourAdministrativeGroup, expand CN=Servers, and then expand CN=ExchangeServerName.
      
      Note that the ExchangeServerName placeholder is the name of the Exchange server of which you want to obtain the distinguished name.
   4. Right-click CN=ExchangeServerName, and then click Properties.
   5. In the Select which properties to view list, click Both.
   6. In the Select a property to view list, click distinguishedName.
   7. Copy the value from the Value(s) box, and then click Cancel.
   8. Quit ADSI Edit.
2. Click Start, click Run, type cmd in the Open box, and then click OK.
3. At the command prompt, type the following command, and then press ENTER:

   dsacls "distinguishedName" > serverName.dsacls

   In this command, replace distinguishedName with the distinguished name that you copied from the Value(s) box in step g. Replace serverName with the NetBIOS name of the Exchange server.
   
   Note Include the quotation marks around the distinguished name of the Exchange server.
4. Use a text editor, such as Notepad, to open the serverName.dsacls file that was created in the command from step 3. This file should display the computer account as having the Full Control permissions similar to the following example:

   Access list:
   Effective Permissions on this object are:
   
   Allow <EXAMPLE>\<SERVERNAME>$		FULL CONTROL

   Note For an Exchange server that is in a clustered environment, this entry appears similar to the following example:

   Access list:
   Effective Permissions on this object are:
   
   Allow <EXAMPLE>\<node-1>$		FULL CONTROL
   Allow <EXAMPLE>\<node-2>$		FULL CONTROL

   Additionally, the Exchange Domain Servers group should inherit a Deny permission for the Receive As permission as follows:

   Access list:
   Effective Permissions on this object are:
   
   Deny <EXAMPLE>\Exchange Domain Servers	Receive As  <Inherited from parent>

   Important If the Exchange server has an explicit Deny permission for the Receive As permission assigned instead of an inherited Deny permission for the Receive As permission, this explicit permission overrides the explicit Full Control Allow permission that the computer is assigned.

• The computer account is missing from the permission entries.
• Inheritance is removed for the Receive As permission and the computer account has an explicit Deny permission for the Receive As permission.

Step 2: Restore the computer account permissions

1. Start Exchange System Manager.
2. If Administrative Groups are enabled, expand Administrative Groups, and then expand your administrative group.
3. Expand Servers, right-click the Exchange server where the event ID 1025 events are logged, and then click Properties.
4. In the ServerName Properties dialog box, click the Security tab, and then click Advanced.
5. Click Add, click the computer account of the Exchange computer in which you experience this issue, and then click OK.
6. In the Apply onto list, click This object, subcontainers and children objects if this option is not already selected.
7. In the Permissions list, click the Full control check box in the Allow column.
8. Click to clear the Apply these permissions to objects and/or containers within this container only check box if this check box is selected, and then click OK two times.
   
   Important If you click to select the Apply these permissions to objects and/or containers within this container only check box, the Full Control permission assignment does not propagate to child objects even with permission inheritance enabled. In this situation, the events that are mentioned in the "Symptoms" section are still logged when Exchange tries to generate a non-read notification message.

Step 3: Restore permission inheritances for the computer account

1. Start Exchange System Manager.
2. If Administrative Groups are enabled, expand Administrative Groups, and then expand your administrative group.
3. Expand Servers, right-click the Exchange server where the event ID 1025 events are logged, and then click Properties.
4. In the ServerName Properties dialog box, click the Security tab.
5. If the Allow inheritable permissions from parent to propagate to this object check box is selected, follow these steps:
   1. Click to clear the Allow inheritable permissions from parent to propagate to this object check box, and then click Remove.
   2. Click Apply.
      
      Note You might have a situation where the following conditions are true:
      • The Allow inheritable permissions from parent to propagate to this object check box was previously cleared.
      • The existing permissions were copied to this object.
      • The Allow inheritable permissions from parent to propagate to this object check box was again selected.
      In this situation, it is best to remove all copied permissions, and then re-enable the inherited permissions.
6. Click to select the Allow inheritable permissions from parent to propagate to this object check box, and then click Apply.
7. Click OK, and then quit the Exchange System Manager program.