70-284: unable to run Exchange services using a service account

I'm working through the MS study kit for 70-284. I installed Exchange
2003 using a service account set up for the purpose; all OK. Initially
the services run as LocalSystem so I changed them to run using the
service account.

However the System Attendant now does not start. I get an Event ID
1005 with text: "Unexpected error The logon attempt failed ID no:
8009030c Microsoft Exchange System Attendant occurred. "

That would suggest a problem with authenticating as the service
account, yet I was logged on with that account and the Exchange
Management service starts up fine using it, so surely there can't be
an authentication issue.

If I change just System Attendant back to LocalSystem, then when I try
to start the information store I get this:

>Error 0x514 occurred while attempting to enable the "Generate Security Audits" privilege.
>
>To grant the Generate Security Audits privilege to the Microsoft Exchange service account, open the Windows 2000 Group Policy editor.
>If the machine is not domain controller, select the Local Computer policy object.
>If it is a domain controller, select the browse button and select the "Domain Controllers.<domain>" container. Within this container, select the "Default Domain Controllers Policy" object.
> Under either "Local Computer policy" or "Default Domain Controllers Policy", select the "Computer Configuration" container. Under the "Computer Configuration" container, select the "Windows Settings" container. Under the "Windows Settings" container, select the "Security Settings" container. Under the "Security Settings" container, select the "Local Policies" container. Under the "Local Policies" container, select the "User Rights Assignment" container.
> Under "User Rights Assignment", double click the "Generate Security Audits" object and add the Microsoft Exchange service account to the list of users granted the "Generate Security Audits" right. Click "OK", and close the editor.
>

If I do grant this right to the service account and start the
information store again, this time I get an application error:

Faulting application store.exe, version 6.5.6944.3, faulting module
unknown, version 0.0.0.0, fault address 0x695319ec.

For the time being I've reverted to the LocalSystem account but I'd be
interested if anyone else has seen this and knows what causes it.

Jim Hatfield

I'm wondering why you would have changed that? Exchange 2003 services are
meant to run under the Local System account...

--
Susan Conkey [MVP]



"Jim Hatfield" <> wrote in message
news:...
> I'm working through the MS study kit for 70-284. I installed Exchange
> 2003 using a service account set up for the purpose; all OK. Initially
> the services run as LocalSystem so I changed them to run using the
> service account.
>
> However the System Attendant now does not start. I get an Event ID
> 1005 with text: "Unexpected error The logon attempt failed ID no:
> 8009030c Microsoft Exchange System Attendant occurred. "
>
> That would suggest a problem with authenticating as the service
> account, yet I was logged on with that account and the Exchange
> Management service starts up fine using it, so surely there can't be
> an authentication issue.
>
> If I change just System Attendant back to LocalSystem, then when I try
> to start the information store I get this:
>
>>Error 0x514 occurred while attempting to enable the "Generate Security
>>Audits" privilege.
>>
>>To grant the Generate Security Audits privilege to the Microsoft Exchange
>>service account, open the Windows 2000 Group Policy editor.
>>If the machine is not domain controller, select the Local Computer policy
>>object.
>>If it is a domain controller, select the browse button and select the
>>"Domain Controllers.<domain>" container. Within this container, select
>>the "Default Domain Controllers Policy" object.
>> Under either "Local Computer policy" or "Default Domain Controllers
>> Policy", select the "Computer Configuration" container. Under the
>> "Computer Configuration" container, select the "Windows Settings"
>> container. Under the "Windows Settings" container, select the "Security
>> Settings" container. Under the "Security Settings" container, select the
>> "Local Policies" container. Under the "Local Policies" container, select
>> the "User Rights Assignment" container.
>> Under "User Rights Assignment", double click the "Generate Security
>> Audits" object and add the Microsoft Exchange service account to the list
>> of users granted the "Generate Security Audits" right. Click "OK", and
>> close the editor.
>>
>
> If I do grant this right to the service account and start the
> information store again, this time I get an application error:
>
> Faulting application store.exe, version 6.5.6944.3, faulting module
> unknown, version 0.0.0.0, fault address 0x695319ec.
>
> For the time being I've reverted to the LocalSystem account but I'd be
> interested if anyone else has seen this and knows what causes it.
>

Susan

"Susan" <> wrote in message
news:...
> I'm wondering why you would have changed that? Exchange 2003 services are
> meant to run under the Local System account...
>
Because the book he is using to study told him to do it. I ran into the same
problem when following the instructions myself and did what the OP did and
reverted back. I used the MSPress study guide for Exchange 2003 a couple of
years ago.

LRM

On Mon, 4 Dec 2006 09:10:32 -0600, "LRM" <>
wrote:

>"Susan" <> wrote in message
>news:...
>> I'm wondering why you would have changed that? Exchange 2003 services are
>> meant to run under the Local System account...
>>
>Because the book he is using to study told him to do it. I ran into the same
>problem when following the instructions myself and did what the OP did and
>reverted back. I used the MSPress study guide for Exchange 2003 a couple of
>years ago.

So is there any point in creating the service account at all? It is
granted Exchange Full Administrator privileges when you run
ForestPrep, and since at that time you are presumably logged into the
forest root domain as domain admin, that would be the default account
to receive the privileges, which seems quite OK to me.

Jim Hatfield

"Jim Hatfield" <> wrote in message
news:...
> On Mon, 4 Dec 2006 09:10:32 -0600, "LRM" <>
> wrote:
>
>>"Susan" <> wrote in message
>>news:...
>>> I'm wondering why you would have changed that? Exchange 2003 services
>>> are
>>> meant to run under the Local System account...
>>>
>>Because the book he is using to study told him to do it. I ran into the
>>same
>>problem when following the instructions myself and did what the OP did and
>>reverted back. I used the MSPress study guide for Exchange 2003 a couple
>>of
>>years ago.
>
> So is there any point in creating the service account at all? It is
> granted Exchange Full Administrator privileges when you run
> ForestPrep, and since at that time you are presumably logged into the
> forest root domain as domain admin, that would be the default account
> to receive the privileges, which seems quite OK to me.

Hmm, I asked myself the same question and decided there was no point.

LRM