My environment:Windows Server 2003 64-bit and Exchange 2007 with all the latest SPs and patchesRecently I had cause to install/configure NFS on this server, which does triple duty as both a mail server, file server and domain controller, so that we could store files from off our VMware servers. It was all working swimmingly until a few days ago. Sequence of events as best I can piece it together:24 FEB ... installed v6.0.10 of Symantec Mail Security for MS Exchange26 FEB ... Windows Updates installed, including .NET Framework 3.0 SP201 MAR ... server was rebooted05 MAR ... minor changes made to Default Domain Policy (reverting from customised back to default values) resulting in all users needed to undergo a password change10 MAR EARLY MORNING ... server stopped sending emailI then tried manually stopping all the Exchange services, however the Information Store process would not stop. After waiting about 15 minutes, I eventually had to reboot the server. After the reboot, Exchange was working fine again ... but ... it started throwing Event ID 4004 errors relating to "Server for NFS" service. The NFS services would not start. As we are not using NFS much now, I have uninstalled it, so not much harm done, but I am at a loss to understand what happened to the server which triggered this issue.So am wondering whether there have been any updates released recently which have caused anyone else any grief with Exchange 2007 or with NFS.

Oh, one more thing, I couldn't find many specific matches on the error messages when I Googled, however one of the suggestions made was that it might be related to RPC issues. I am pretty sure that Symantec Mail Security for Exchange utilises RPC in some way. But there's a 2 week gap and a lot of activity between the upgrade of Symantec Mail Security and the issues which hit this morning, so I am doubtful that it is related.

Don't forget that it might require a reboot to be noticeable. You might want to uninstall symantec mail security and see if it fix the problem but that will be the last resort.

Thanks Michael ... yes, I have scheduled a reboot for tomorrow morning, to finalise the uninstall of the NFS services.

Hi Frosty, I wanted to see what I can repro what you're seeing on a simmilar setup (I'm just going to use the MS products involved for now). Can you let me know what sort of mapping solution you're using for NFS and what users you are using to connect. I don't think the problem lies there but it's possible. Also, let's check and see which NFS services are running. There's four of them to worry about here, portmap, rpcxdr, nfssvc and nfssvr. Running the following commands should give you a head's up to the state of each of these. sc query portmap sc query rpcxdr sc query nfssvr sc query nfssvc We can be pretty sure by the 4004 event that last one in the list isn't running but I'm really curious if nfssvr the driver beneath it is still running. Also, if portmap isn't running then it's likely we're seeing something else running on port 111. Check for event 1058 in the event log. That would be a portmap failure. If you can drop back here with the state of those services and let me know if you're seeing those events we'll try to run with this. Thanks. -Michael

Hi Michael,Unfortunately, having already removed NFS from my server, none of the "sc query ..." commands above produce anything useful. All I can really advise is the approximate setup we were using. The server had a SAN device attached which was formatted with the Windows filesystem (roughly 4TB storage). NFS was running with Administrator level access IIRC and was pointing to one folder on the SAN called Backups. We then configured our VMware server which runs ESXi 4.0 to use this NFS share as a datastore for backup purposes. No special user accounts were configured. It was an extremely basic configuration.The 4004 error I got was:Source: Server for NFSDescription: The description for Event ID ( 4004 ) in Source ( Server for NFS ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE = flag to retrieve this description ... etc etcEach 4004 error was preceded by a 4006 and followed by a 4008 information event with basically the same Description content. Each of these triplets of events coincided with an attempt to start the Server For NFS service.Regarding the 1058 error question, I've not had any of those.

Got it, so we're working with events alone for now to figure out what happened. I have a couple of hunches though.Before I get there let me tell you a bit about what you're seeing. EventID 4006 is a pretty standard "nfs service is trying to start" and 4008 is a "we're tearing everything nfs server related down because something wen't wrong".The 4004 was a bit generic back in the days of 2003 (we've made our events a bit more specific on the following two releases) but it could also mean that you're low on resources for NFS to start. Since NFS generally starts later during the boot process it might be the guy who doesn't get any system resources since there aren't any left. You mentioned this machine was doing triple duty so I figured I'd ask to see if that might be the case. How much memory do you have available on the box?It could also be something closer to what the error message is saying. If you reinstall NFS you'll get a clean slate with respect to the registry and it might work fine. That would make life easy as it would be registry corruption from somewhere (and then I could go the route of tracking down where).The last possibility might be something grabbing the portmapper's port 111 first and upon closer inspection you might not see the 1058. Sorry to send you back to eventvwr again but look for events 3001 and 3002 from the portmap service. Let me know if you have any luck.

Thanks Michael,I may have a need to reinstall NFS on this server, so reinstallation is certainly a possibility ... I will have a think about that today and discuss with another tech here. It really comes down to whether its necessary for usto achieve some VMware Converter jobs that we have to run, or whether we can come up with an alternative and put the images straight on to one of our data stores. Will keep you posted on that front once we know what we are going to do.Task Manager on this server (a 4-core CPU, which is running Server 2003 64-bit) shows:Commit Charge (K):-- Total 6,088,468-- Limit 7,392,704-- Peak 6,710,592Physical Memory (K):-- Total 4,193,380-- Available 629,848-- System Cache 493,800Kernel Memory (K):-- Total 337,576-- Paged 208,476-- Nonpaged 129.104CPU is running fairly constantly at about 10%. Page File usage seems high at > 80%.Server would probably benefit from an injection of extra RAM. But since we plan to replace it soon and split it into multiple servers running under VMware:-- new DC running Windows Server 2008 R2-- new file server-- new Exchange 2010 serverand then convert it into a VMware host for our DR site, I want to avoid that just for the short term.I had a look in the Event Logs for errors 3001 and 3002 as requested, but there are none of those.I agree with the idea that maybe some other process grabbed port 111 (portmapper), though what that process might have been is unclear. I ran: netstat -n | moreand had a careful look for port 111, but there's nothing using it now as far as I can see. I mentioned earlier about the possibility that it was RPC issues, perhaps related to Symantec software, but I haven't made any further progress on that front as after uninstalling NFS it became a fairly low priority for me.I will post again if we decide to reinstall NFS and we'll see how that goes.

Well, it feels like portmap is comming up just fine if those 3000 events aren't being triggered. I ran the same hunch of an RPC/Portmap conflict by one of my teammates as well and we can both remember something along these lines with symantec products but can't be 100% sure. Neither of us have been able to point to anything specific and the evidence just isn't there. You're a bit on the high end of your memory usage but you have enough for the nfs service to load for sure (this is where I'd love to have the more specific perf counters in 2k8R2 :-)). The one warning is that if you see your machine with less than 256M of RAM available it can drop into what we call "meiser mode" unofficially. It basically keeps enough resources around to keep the system responsive (thrashing prevention) but it will start denying new processes resources. I'm leaning toward the registry having an issue which a reinstall should solve. If you get to it let me know.