Home
  •  

DSACCESS returned an error on Active Directory notification. System Attendant will re-set Active Directory notification at a later time.

DSACCESS_returned_an_error_on_Active_Directory_notification__System_Attendant_will_re_set_Active_Directory_notification_at_a_later_time__ (Rule)

Knowledge Base article:

Summary

This event is displayed in the application event log when the Exchange server is unable to access a domain controller. For example, this event may occur when a domain controller is restarted, if that is the only domain controller in the site to which the Exchange server belongs.

Sample Event:

There are two flavors of this event, as shown below:

Event ID: 9154

Event Source: MSExchangeSystem Attendant

Event Category: General

Description: DSAccess returned an error 0x80004005 on DS notification. Microsoft Exchange System

Attendant will reset DS notification later.

Event Type: Error

Event Source: MSExchangeSystem Attendant

Event Category: General

Event ID: 9154

Description: DSAccess returned an error 0x80070862 on DS notification. Microsoft Exchange System

Attendant will reset DS notification later.

Causes

The most likely cause for this event is that the Kerberos ticket timed out. This typically happens in a topology that has a single domain controller. When the Kerberos tickets that are associated with the Lightweight Directory Access Protocol (LDAP) connections time out, all LDAP connection attempts show errors because the security contexts have failed. These connections must be established again. Because there is only one domain controller in this topology, there are no other servers to obtain a ticket from while this establishment takes place. Therefore, the error occurs.

Incorrect DNS configuration.

Resolutions

The client LDAP connections should establish again automatically and the errors should go away once this establishment has taken place. It is recommended that additional domain controllers be installed in the site in order to avoid such errors.

Ensure that both the primary and alternate DNS servers listed in the Exchange Server IP Properties are up and running and have been configured properly.

Check the domain controller to ensure that it is running properly. For example, ensure that is not restarting unnecessarily.

External

For more information about MSExchangeSA event 9154, see:

Element properties:

TargetMicrosoft.Exchange.ExchangeComponent.SystemAttendant
CategoryEventCollection
EnabledTrue
Event_ID9154
Event SourceMSExchangeSA
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
DSACCESS returned an error on Active Directory notification. System Attendant will re-set Active Directory notification at a later time.
{0}
Event LogApplication

Member Modules:

ID Module Type TypeId RunAs 
EventDS DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="DSACCESS_returned_an_error_on_Active_Directory_notification__System_Attendant_will_re_set_Active_Directory_notification_at_a_later_time__" Enabled="onEssentialMonitoring" Target="Exch2003Core!Microsoft.Exchange.ExchangeComponent.SystemAttendant" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="EventDS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>.</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>Channel</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Application</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>MSExchangeSA</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>9154</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertOwner>$Data/PublisherName$</AlertOwner>

      <AlertMessageId>$MPElement[Name="DSACCESS_returned_an_error_on_Active_Directory_notification__System_Attendant_will_re_set_Active_Directory_notification_at_a_later_time__.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue/>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>