Windows 2003 SP1 Information

[kechambe]

As many of you know Microsoft released Windows 2003 SP1 yesterday. At this time Cisco has not qualified Windows 2003 SP1 for installation on Unity servers. Qualification for use on the Unity server will be complete within 60 days.

We are also aware of changes made by Microsoft to the default permissions for the Service Control Manager. Unity uses the Service Control Manager to check the status of Exchange servers within the network. If Unity is denied access to the Service Control Manager it will assume the Exchange server is offline and drop back to UMR mode. Because of these changes in Windows 2003 SP1 Cisco is HIGHLY recommending that all customers hold off on applying it to their Exchange servers until further notice.

For more information on diagnosing Exchange server offline issues please see:

http://www.cisco.com/en/US/products/sw/voicesw/ps2237/products_tech_note09186a008011934a.shtml

Exchange server log entry:

Event Type: Failure Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date: 4/1/2005

Time: 4:37:29 AM

User: DOMAIN\UnityMsgStoreSvc

Computer: EXCHANGE

Description:

Object Open:

Object Server: SC Manager

Object Type: SC_MANAGER OBJECT

Object Name: ServicesActive

Handle ID: -

Operation ID: {0,1705124}

Process ID: 524

Image File Name: C:\WINDOWS\system32\services.exe

Primary User Name: EXCHANGE$

Primary Domain: SJ-VNT

Primary Logon ID: (0x0,0x3E7)

Client User Name: UnityMsgStoreSvc

Client Domain: SJ-VNT

Client Logon ID: (0x0,0x1A0496)

Accesses: READ_CONTROL

Connect to service controller

Enumerate services

Query service database lock state

Privileges: -

Restricted Sid Count: 0

Access Mask: 0x20015

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Log on Unity with AvWM diagnostics enabled:

Event Type: Warning

Event Source: CiscoUnity_AvWM

Event Category: Error

Event ID: 29004

Date: 4/1/2005

Time: 4:50:14 AM

User: N/A

Computer: UNITY

Description:

Error accessing service control manager on EXCHANGE.

OpenSCManager:5. (AvUMRSyncSvr:3920)

For more information, click: http://www.CiscoUnitySupport.com/find.php

Thank you,

Keith

[kechambe]

Just bumping my own post. We have started to see a large number of cases come in on this so I want all the forum readers to be aware.

At this time the workarounds are:

1. Uninstall Windows 2003 SP1 from the Exchange 2003 server. Once this is complete the Unity server must be fully (Windows) rebooted.

or

2. Place the UnityMsgStoreSvc account (the account the AvMsgStoreMonitor service logs on as) in the local Administrators group on the Windows 2003 SP1/Exchange 2003 server. Once this is complete the Unity server must be fully (Windows) rebooted.

If the Windows 2003 SP1/Exchange 2003 server is a clustered Exchange server place the UnityMsgStoreSvc account in the local Administrators group for all nodes in the cluster. Once this is complete the Unity server must be fully (Windows) rebooted.

If the Windows 2003 SP1/Exchange 2003 server is a domain controller it is not recommend to place the UnityMsgStoreSvc account in the Domain Admins group because this group has explicit denies be default on all Exchange Message Stores. Placing the account in that group will allow Unity access to the Services Control Manager so Unity will be able to 'see' the Exchange server again but all mailbox logins will fail. Instead do option number 1 -- uninstall Windows 2003 SP1.

Thanks,

Keith

[slc2]

Keith:

You mention Exchange 2003. Are you saying that if SP1 is applied to Exchange 2003 servers in a UM implementation Unity will break. I can see if VM only but, I am wondering about UM.

Thx.

Sabas

[kechambe]

If you install Windows 2003 SP1 on the Exchange 2003 server Unity will not be able to get the status of Information Store process on the Exchange server. Microsoft changed the permissions required to remotely get service stats from the Services Control Manager remotely, which is how Unity was getting it.

We have new method for checking service status in test now. Our goal is to have the next method in the 4.0(5) release.

Thanks,

Keith

[kechambe]

Another bump/update.

We continue to see a number of cases on this issue. The 4.0(5) release has a new method for detecting the status of an Exchange server. If you have an Exchange 2003 server running on Windows 2003 please hold off applying Windows 2003 SP1 to that server until 4.0(5) is released. 4.0(5) will be released in the coming weeks.

Thanks,

Keith

[kechambe]

We still continue to see a couple cases on this issue every day so I am bumping the post again.

There is a field alert now:

http://www.cisco.com/en/US/products/sw/voicesw/ps2237/products_field_notice09186a00804412a6.shtml

4.0(5) will support Exchange installed on Windows 2003 SP1 out of the box.

Thanks,

Keith

[kechambe]

We still continue to see a couple cases on this issue every day so I am bumping the post again.

There is a field alert now:

http://www.cisco.com/en/US/products/sw/voicesw/ps2237/products_field_notice09186a00804412a6.shtml

4.0(5) will support Exchange installed on Windows 2003 SP1 out of the box.

Thanks,

Keith

[johutchins]

Keith,

I encountered this error and upgraded to 4.0(5) and the error persists. TAC is telling me that SR1 is not supported at all with any version of Unity. This was of July 8, 2005.

Any thoughts?

--Jon