Dear All, I ran into Exchange system attendant service not starting on a new Exchange2007 64 bit server in a Windows 2008 32 bit active directory I have symantec endpoint antivirus installed on the Domain controller and the Exchange computer. Everything works fine for about two days after installation and the proble came the third after powering the machine in the morning. The issue is :Unexpected error. The logon attempt failed ID no: 8009030c Microsoft Exchange System Attendant. Event ID:1005, Event Source: MSEXCHANGESA. Anybody has any idea about resolving this. TaofikNG

Exchange services should be running as the local system account, can you check and verify this?Raj

Hi,Event ID 1005 is indicative of an authentication problem with Active Directory. This can be caused by a broken secure channel connection between the Exchange server and an Active Directory domain controller. Please run get-eventloglevel | where {$_.identity -like "MSExchange AD*"} | set-eventloglevel -level highAnd then restart the MSExchangeADTopology service. After that, please check the event log again and then post the error event log here. More information to share with you: Error Message: http://technet.microsoft.com/en-us/library/cc957196.aspx Regards,Xiu

Many thanks , Will do just that and revert.

Yes it is rununnig as a local system account

Can you check this link and update us , if every thing is there in AD and Exchange http://support.microsoft.com/default.aspx?scid=kb;en-us;283257Raj

Dear All, Many thanks for your suggesstions. I finally solve the problem.The solution might be of help to other Exchange Administrators. I just uninstalled the Symantec Endpoint II Antivirus client on the exchange server and all the services automaticallly loaded including MSEXCHANGE system attendant during startup. With the Symantec Endpoint client II on the exchange computer, My observations were: 1. The NIC ( Network Card ) on the computer freezes with a red cross for about two minutes. 2. After about two minutes, the NIC got enabled and start sending and receiving packets from the Network 3. The following exchange services were stopped : Information store,System attendant and Transport. However, once i uninstalled all the three issues disappeared. POSTULATIONS: 1. I am of the opining that probably the 32bit version of the Symantec Endpoint is not supported on the 64bit Windows 2008/64bit Exchange 2007. 2. Also, Symantec is found of installing TEEFER2 Network component on any NIC once the Endpoint is installed. The teefer2 blocks network traffic from and to the host NIC until it is uninstalled. 3. Though in this present case ( on the Windows 2008 server ) the TEEFER2 was not shown as an installed components, but i guess it might be working Steathly blocking in & out traffic between the Active directory and the Exchange 2007 server.Hence, the need to completely uninstalled the whole Endpoint package. Regards. Taofik NG

Thanks for you feedback.