Exchange services do not start, and event IDs 2114 and 2112 are logged in the Application log in Exchange Server 2003 or in Exchange 2000 Server

• The default domain policy or the default domain controllers policy is not blocked by a "No override" configuration on an organizational unit object or on the domain object.
• The Manage Auditing Security Privilege user right in the default domain controllers policy is applied to the Exchange Enterprise Servers group.
• The computer account of the affected Exchange server is included in the Exchange Domain Servers group.

When you start or restart the computer that is running Microsoft Exchange Server 2003 or Microsoft Exchange 2000 Server, the Exchange services may not start. Additionally, the following event is logged to the Application log:

Event ID : 2114
Event Category : Topology
Event Source : MSExchangeDSAccess
Event Type : Error
Computer : Server_Name
Description : Process (Process_Name) (Process_ID). Topology Discovery failed, error 0x80040a02.
For more information, click http://search.support.microsoft.com/search/?adv=1.

Additionally, you may find that the following warning events were logged in the Application log earlier:

Event ID : 2112
Event Category : Topology
Event Source : MSExchangeDSAccess
Event Type : Warning
Computer : Server_Name
Description : Process (Process_Name) (Process_ID). Exchange Server Server_Name.Domain_Name.Root_Domain does not have Audit Security Privilege on Domain Controller Server_Name.Domain_Name.Root_Domain. This Domain Controller will not be used by DSAccess.
For more information, click http://search.support.microsoft.com/search/?adv=1.

This problem occurs because the Exchange security groups do no have the appropriate user rights to enable the Directory Service Access (DSAccess) component to communicate with Active Directory.

To resolve this problem, verify the following:

• The default domain policy or the default domain controllers policy is not blocked by a "No override" configuration on an organizational unit object or on the domain object.
• The Manage Auditing Security Privilege user right in the default domain controllers policy is applied to the Exchange Enterprise Servers group.
• The computer account of the affected Exchange server is included in the Exchange Domain Servers group.

To do this, follow these steps.

Note You must perform the steps that are described in step 1 only if you have additional group policies other than the default policies configured in the organization. If you do not have additional group policies configured, go to step 2.

1. Verify that the default domain policy or the default domain controllers policy is not blocked.
   1. Start the Active Directory Users and Computers snap-in.
   2. Right-click Your_Domain.Your_Root_Domain, and then click Properties.
   3. Click the Group Policy tab.
   4. In the Current Group Policy Object Links for Your_Domain window, click a Group Policy entry other than the Default Domain Group Policy entry.
   5. Click Options.
   6. Verify that the No Override: prevents other Group Policy objects from overriding policy set in this one check box is not selected. If it is selected, click to clear this check box after you make sure that the effective policy settings that you want are not changed when the default domain policy is applied.
   7. Click OK two times.
   8. Repeat steps 1d to 1f for any other group policies that you have configured.
   9. Repeat steps 1b to 1g for any organizational unit object that is located in your environment.
   10. Right-click Domain Controllers, and then click Properties.
   11. In the Current Group Policy Object Links Domain Controllers window, click a Group Policy entry other than the Default Domain Controllers Group Policy entry.
   12. Verify that the No Override: prevents other Group Policy objects from overriding policy set in this one check box is not selected. If it is selected, click to clear this check box after you make sure that the effective policy settings that you want are not changed when the default domain controllers policy is applied.
   13. Click OK two times.
   14. Exit the Active Directory Users and Computers snap-in.
   15. Wait for this change to replicate to all other domain controllers.
2. Use the Policytest tool (Policytest.exe) to troubleshoot permissions. Policytest.exe is located on the Exchange Server 2003 or Exchange 2000 Server CD in the Support\Utils\I386 folder. Use Policytest.exe to determine whether the Manage auditing and security logs permission for the Exchange Enterprise Servers group is missing on any of the domain controllers. A successful result returns information that resembles the following:

   Local domain is"<example.com>" (EXAMPLE) Account is"EXAMPLE\Exchange Enterprise Servers" ======================== DC ="<ComputerName>" In site ="<Default-First-Site-Name>" Right found:"SeSecurityPrivilege"

   Note A successful result shows that the Manage auditing and security logs permission exists. You must have domain administrator rights to run Policytest.exe successfully. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
   281537 Description of the Policytest.exe utility
3. Reset the Exchange Enterprise Server default permissions at the domain level:
   1. Run the setup /domainprep command from the Exchange Server 2003 or Exchange 2000 Server CD or from a network installation point. This command adds the Exchange Enterprise Servers group to the domain together with default permissions. When you run this command, the permissions are immediately added to one domain controller. The change then replicates to the other domain controllers.
   2. Restore permissions inheritance to other organizational units. Then, wait for the domain controllers to replicate the changes throughout the domain.
   3. Run Policytest.exe, and then note which domain controllers return the following successful result:
      Right found:"SeSecurityPrivilege"
      If all the domain controllers have the correct permissions, restart the Exchange services. If no domain controllers have the appropriate permissions, go to step 4.
4. Verify the default domain controllers policy:
   1. Start the Active Directory Users and Computers snap-in.
   2. Right-click the Domain Controllers container, and then click Properties.
   3. Click the Group Policy tab, and then make sure that Default Domain Controllers Policy is listed in the Current Group Policy Object Links for Your_Domain window. If it is not, click Add, click Default Domain Controllers Policy, and then click OK. Then, wait for this change to replicate to all other domain controllers.
   4. Run the setup /domainprep command from the Exchange Server 2003 or Exchange 2000 Server CD or from a network installation point. This command adds the Exchange Enterprise Servers group to the domain together with default permissions.
   5. Run Policytest.exe, and then note which domain controllers return the following successful result:
      Right found:"SeSecurityPrivilege"
      If all the domain controllers have the correct permissions, restart the Exchange services. If some domain controllers do not have the correct permissions, go to step 5.
5. Manually add permissions to the domain controller.
   
   The File Replication service (FRS) may not replicate the updated security policy to one or more domain controllers after you run the setup /domainprep command. If this occurs, you must manually assign the correct permissions to the Exchange Enterprise Servers group. If some or all domain controllers do not have the correct permissions, assign the Exchange Enterprise Servers group the Manage auditing and security logs permission. Then, wait for the setting to replicate to the other domain controllers.
   1. Start the Active Directory Users and Computers snap-in.
   2. Right-click the Domain Controllers container, and then click Properties.
   3. Click the Group Policy tab, click Default Domain Controllers Policy in the Group Policy Object Links box, and then click Edit.
   4. Expand Computer Configuration, expand Windows Settings, expand Security Settings, expand Local Policies, and then click User Rights Assignment.
   5. In the right pane, double-click Manage auditing and security log, click Add, click Browse, and then add the Exchange Enterprise Servers group.
   6. In the Add user or group dialog box, click OK, and then click OK again.
   7. Exit the Group Policy snap-in, and then click OK in the Domain Controllers Properties dialog box.
      
      Note Sometimes, you may not be able to see the Exchange Enterprise Servers group when you click Browse in the Add user or group dialog box. If this occurs, add the Exchange Domain Servers group, and then run the setup /domainprep command again. This process makes the addition of the Exchange Enterprise Servers group by the setup /domainprep command persist across all domain controllers.
   8. Restart the Exchange services.

Before you make policy changes on a domain controller, confirm that FRS replication has copied the necessary policy to that domain controller. Use Policytest.exe so that you do not have to manually check every domain controller in a large domain. Policytest.exe connects to every domain controller in the domain. Then, Policytest.exe verifies that the Exchange Enterprise Servers group has the rights to manage the security and auditing log, either directly or through inheritance. You must have domain administrator rights to run Policytest.exe successfully.

For more information about a similar issue that may occur after you install the Microsoft Windows 2000 Security Rollup Package 1, click the following article number to view the article in the Microsoft Knowledge Base: