Feb 01

Problem Spotlight: Cannot Start Microsoft Exchange System Attendant and Event ID 9157 is Logged in the Event Viewer

Two weeks ago, I got an emergency call on a Friday afternoon. A local Scottsdale Arizona business was having issues with its email server. They stated that their Microsoft Exchange Server was down. When I arrived onsite, the business’ IT support personnel filled me in on the issue and what they had tried to fix the issue. The server apparently had gone down the previous night after it was rebooted to install OS updates. They had been trying to fix the issue for most of the day.

After inspecting the server, I realized that the Information Store was dismounted. They were running Microsoft Exchange Server 2003. After closer inspection, I found out that the Microsoft Exchange System Attendant service couldn’t start, and the event ID 9157 was logged in the Event Viewer. The following is a description of that event: “Microsoft Exchange Server computer system attendant does not have sufficient rights to read Exchange Server configuration objects in Active Directory. System attendant will try again in approximately one minute.” This was, obviously, a problem.

The Microsoft Exchange System Attendant is critical to Exchange Server’s stability and performance. Its components and sub components work together to facilitate Active directory communication from and to clients (Outlook) and Exchange Services. Also, many Exchange related Services will not function without it. If the Microsoft Exchange System Attendant is not running, many services will not run including the Information Store. This was the reason their Information Store was dismounted, and their Exchange Server was down.

Based on the error message, instinct would tell us to start checking and troubleshooting permissions. Fortunately, I had seen this problem before and was able to find a solution quickly without wasting much time troubleshooting. It turns out that when the Microsoft System Attendant service starts, it looks for certain groups ONLY in the default Users Active Directory Container. The groups the System Attendant service looks for are the following:

  • Exchange Services
  • Exchange Domain Servers
  • Exchange Enterprise Servers

If any of these groups have been moved to a different container, the System Attendant service will not find these groups and will not start. To fix this problem just move these groups back to the default Users container and restart the System Attendant service.

That was all I needed to do to fix my Customer’s issue. It turned out they had hired a “Network Engineer” to maintain their network a week before. This person started to “clean” Active Directory. One of the things he did to “clean” Active Directory was move all the contents of the default Users container to an Organizational Unit created by him. Then a week later the server was restarted and the System Attendant Service did not start. I was called in because he wasn’t able to fix the problem.

Well, there you have it. It was a simple fix. Until next time!