Troubleshooting Failure to Publish Exchange Management Pack Data for Mailbox Monitoring

Troubleshooting Failure to Publish ...

Topic Last Modified: 2006-04-07

By Jonathan Runyon

This article discusses troubleshooting failure to publish Microsoft® Exchange Management Pack data, which is required for performing MAPI logon on Exchange Server. You sometimes encounter this issue when trying to configure Microsoft Operations Manager (MOM) to monitor your Exchange servers.

Overview
How Do You Know When Something Is Wrong?
DCOM Helper Objects
- Troubleshooting
Encrypted Credentials
For More Information

Overview

MOM monitors mailbox availability on each monitored Exchange server by performing a MAPI logon to monitor mailboxes, using a Mailbox Access Account (MAA) that has been granted rights to those mailboxes. The logon occurs locally on each server using the script "Exchange 2003 - MAPI logon verification." For the MOM agent on the Exchange server to successfully run the script and log on to the monitored mailboxes, it must use the credentials of the MAA. This is accomplished by decrypting a copy of the MAA credentials that have been stored in the Exchange server registry. The credentials are encrypted and written to the registry using either SetCredentialUtility or the Exchange Management Pack Configuration Wizard.

Before the encrypted credentials can be stored in the registry on the Exchange server, the key must be generated by a Distributed COM (DCOM) application, which is triggered by the script "Exchange - Publish ExMP Data." When the script runs successfully and the registry key is generated, the following MOM event is logged for the Exchange server.

Description: Successfully published Exchange Management Pack data required for performing MAPI logon on Exchange server: "SERVERNAME"

This event was generated by the script: "Exchange - Publish ExMP Data"

Domain: DOMAINNAME

Computer: SERVERNAME

Time: 4/1/2005 3:04:21 PM

Type: Information

Provider Name: Script-generated Data

Event Number: 9986

Provider Type: Generic Provider

Source: Exchange MOM

There are several reasons for failure to generate Event 9986. The remainder of this article discusses those reasons and how to troubleshoot this issue.

How Do You Know When Something Is Wrong?

If Event 9986 is not logged for the Exchange server, the registry key may not be present, and the encryption and storage of the MAA credentials will not be possible. If so, you will see the following error when you run the configuration wizard.

Error: Cannot configure the mailbox access account on computer <servername>. This configuration can only be made after the Exchange MOM event 9986 is registered by MOM.

You can also check the registry manually for the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ExMPLS

If the key is not present, you will need to first determine what failure is preventing the key generation. The script "Exchange - Publish ExMP Data" may generate other MOM events for the Exchange server, which show what the problem is, instead of Event 9986. The following are some examples. Note that these events will not appear in the Exchange application event log. The events are only present in the MOM event log.

Example for Exchange 2000 Server Management Pack on MOM 2000 SP1

The following shows MOM Event 9970 logged for the Exchange server.

Event Number 9970

Type: Error

Source: Exchange MOM

Description: Failed to publish Exchange Management Pack data required for performing MAPI logon on Exchange server <servername>

This error means that the Component Object Model (COM) object used to create the registry key failed during execution.

The following shows MOM Event 9972 logged for the Exchange server.

Event Number 9972

Type: Error

Source: Exchange MOM

Description: Failed to create the object 'ExchKP.PubKeyPublisher'

This error means that the COM object used to create the registry key is not installed or is not registered.

Example for Exchange Server 2003 MP on MOM 2000 SP1 and MOM 2005

The following shows MOM Event 10000 logged for the Exchange server.

Event Number 10000

Type: Error

Source: Exchange MOM

Description: Failed to publish Exchange Management Pack data required for performing MAPI logon on Exchange server:" SERVERNAME. This event was generated by the script: "Exchange - Publish ExMP Data"

This error means that the COM object used to create the registry key has failed during execution.

The following shows MOM Event 10001 logged for the Exchange server.

Event Number 10001

Type: Error

Source: Exchange MOM

Description: Failed to create the object 'EMPKP.PubKeyPublisher'. This event was generated by the script: "Exchange - Publish ExMP Data"

This error means that the COM object used to create the registry key is not installed or is not registered.

These events will not appear as alerts in MOM, so you need to check for them. After you confirm that the event is logged, you can continue troubleshooting. However, if these events are not logged, you need to verify if the "Exchange - Publish ExMP Data" script is running without failure on the Exchange server. The script is called from the following two rules:

Daily Agent Mailbox data generation By default, this rule is triggered every day at 02:00.
Publish data for Agent Mailbox impersonation This rule is called any time the "Check mailbox store availability - MAPI logon test" rule is triggered, and determines that an Exchange server does not have the ExMPLS registry key. It generates Event 9987.

If these rules are not triggered, or if the script fails to run, troubleshoot accordingly.

DCOM Helper Objects

MOM and the Exchange Management Pack require several COM applications to run on the Exchange server to enable various monitoring tasks and functions. These applications are delivered to the Exchange server through DCOM helper objects that are installed and registered on the server and are called by Management Pack scripts as needed. The DCOM object responsible for publishing the MAA credential storage key depends on the version of MOM and Exchange. The following sections describe the DCOM helper objects for specific versions of MOM and Exchange.

Exchange 2000 Server and MOM 2000 SP1

The Exchange 2000 Server helper files for MOM 2000 SP1 are ExchKP.exe and ExchKPps.dll. These files are installed on the server running Exchange 2000 Server by MOM when the Exchange Management Pack is deployed and the associated rules are distributed to the Exchange agent servers. They are installed in the C:\Program Files\Microsoft Operations Manager 2000\OnePoint folder.

Exchange 2000 Server and MOM 2005

The Exchange 2000 Server helper file for MOM 2005 is Empkp.exe. This file is also distributed to the Exchange agent server by MOM when the Exchange Management Pack for MOM 2005 is deployed. The file is installed to C:\Program Files\Common Files\Exchange 2000 Management Pack Objects.

Exchange Server 2003 and MOM 2000 SP1 or MOM 2005

The Exchange helper file Empkp.exe is copied to an Exchange Server 2003 server during setup as shown in the following Exchange Server Setup Progress.log file.

[18:22:01] Copying c:\program files\exchsrvr\bin\empkp.exe

Later, the DCOM application is registered as setup continues, as shown in a continuation of the log file.

[18:34:03] Interpreting line <CreateProcess:C:\Program Files\Exchsrvr\bin;"C:\Program Files\Exchsrvr\bin\empkp.exe" /regserver;60000> -- ID:31259 --

[18:34:03] Process created ... waiting (60000)

[18:34:03] Process has exited with 00000000

Any Exchange Server 2003 server should have the DCOM application EMPKP registered as part of setup, regardless of whether MOM and the Exchange Management Pack are deployed.

Troubleshooting

DCOM Helper Object Troubleshooting

To troubleshoot DCOM helper objects

Confirm the presence of the helper files described previously. If the helper files are not present on the server, they can be copied from another source to the appropriate location on the server, depending on the version of Exchange and MOM.
Determine if the DCOM object has been registered and is available.

To check for registration of the ExchKP or EMPKP helpers on an Exchange server running on Microsoft Windows® 2000 Server, do the following:
1. On the affected Exchange server, click Start, click Run, type dcomcnfg, and then click OK.
2. When the Distributed COM Configuration Properties application opens, from the Applications tab, locate the ExchKP (Exchange 2000 Server with MOM 2000 SP1 only) or EMPKP (Exchange Server 2003 or Exchange 2000 Server) object in the Applications list.
To check for registration of the EMPKP helper on an Exchange Server 2003 server running on Windows Server™ 2003, do the following:
1. On the affected Exchange Server 2003 server running on Windows Server 2003, click Start, click Run, type dcomcnfg, and then click OK.
2. When the Component Services application opens, expand Component Services, expand Computers, expand My Computer, and then click DCOM Config.
3. Locate the DCOM object EMPKP. EMPKP has been successfully registered if it shows up in the registered components tree.
If ExchKP was not registered successfully, and the DCOM object does not exist, it can be manually registered. To manually register ExchKP, do the following:
1. Open a Command Prompt window and go to the folder that contains ExchKP.exe and ExchKP.dll.
2. At the command prompt, type ExchMP /regserver. Note that there will be no indication of success or failure.
3. At the command prompt, type ExchMP /regsvr32.
4. Check for the ExchMP DCOM object as described previously.
If EMPKP was not registered successfully, and the DCOM object does not exist, it can be manually registered. To manually register EMPKP, do the following:
1. Open a Command Prompt window and go to the folder that contains EMPKP.
2. At the command prompt, type EMPKP /regserver. Note that there will be no indication of success or failure.
3. Check for the EMPKP DCOM object as described previously.

DCOM Registry Troubleshooting

If the DCOM object is registered but will not start, there will be a failure generated in the system event log on the Exchange server. This will occur each time the "Exchange - Publish ExMP Data" script runs. The event may be similar to the following.

Event Type: Error

Event Source: DCOM

Event Category: None

Event ID: 10000

Date: 10/28/2004

Time: 12:20:00 PM

User: NT AUTHORITY\LOCAL SERVICE

Computer: SDGDENI02

Description: Unable to start a DCOM Server: {94A6DCD0-B6F5-40E8-8C9D-CEE2C7796380}. The error: "d:\Program Files\Exchsrvr\BIN\empkp.exe -Embedding is not a valid Win32 application." Happened while starting this command: c:\Program Files\Exchsrvr\BIN\empkp.exe -Embedding

There are various reasons for this type of failure, usually due to a problem locating the DCOM application executable. The registry entries vary based on your version of MOM and Exchange.

Important:
This article contains information about editing the registry. Before you edit the registry, make sure you understand how to restore the registry if a problem occurs. For information about how to restore the registry, view the "Restore the Registry" Help topic in Regedit.exe or Regedt32.exe.

ExchKP.exe on Exchange 2000 Server
Check the following registry entry:
HKEY_CLASSES_ROOT\CLSID\{E3D2F927-69FA-4EFD-8D05-8726EF540A06}\LocalServer32
In this key, there should be a REG_SZ value that contains the path to the ExchKP.exe file.
EMPKP on Exchange Server 2003 or Exchange 2000 Server
Check the following registry entry:
HKEY_CLASSES_ROOT\CLSID\{94A6DCD0-B6F5-40E8-8C9D-CEE2C7796380}\LocalServer32
In this key, there should be a REG_SZ value that contains the path to the EMPKP file.
The following is an example of the expected default value:
C:\PROGRA~1\Exchsrvr\bin\empkp.exe
Verify that the file exists in the path specified.
Exchange 2000 Server and MOM 2000 SP1
If the DCOM object is registered but the ExMPLS registry key has not been generated, the next time the "Exchange - Publish ExMP Data" script runs, there may be an underlying DCOM permissions issue that is preventing the script from creating the ExchKP.PubKeyPublisher object when it runs. This will generate the Exchange MOM Event 9972 or 10001, depending on the versions of Exchange and MOM.
To test this, save the following three lines of code as a .vbs script and run the script from the affected Exchange server.
Set oKeySet=CreateObject("ExchKP.PubKeyPublisher")
ErrID=oKeySet.Publish()
Msgbox ErrID
Exchange Server 2003, Exchange 2000 Server, and MOM 2005
If the DCOM object is registered but the ExMPLS registry key has not been generated, the next time the "Exchange - Publish ExMP Data" script runs, there may be an underlying DCOM permissions issue that is preventing the script from creating the ExchKP.PubKeyPublisher object when it runs. This will generate the Exchange MOM Event 9972 or 10001, depending on the versions of Exchange and MOM.
To test this, save the following three lines of code as a .vbs script and run the script from the affected Exchange server.
Set oKeySet=CreateObject("EMPKP.PubKeyPublisher")
ErrID=oKeySet.Publish()
Msgbox ErrID
If there is no DCOM permissions issue, the results should be zero, the ExMPLS key should be generated, and the REG_BINARY value named DATA0 should be written to the key. If there is an underlying DCOM permissions issue, the results will be non-zero.
For instructions, see Microsoft Knowledge Base article 274696, "Actions such as search and drag and drop do not work because the default access permissions have been changed in the Dcomcnfg.exe tool." Follow the steps described to re-establish default permissions for DCOM objects.

Encrypted Credentials

After the DCOM helper application is registered and running, the script "Exchange - Publish ExMP Data" can successfully run and generate the key for storing the encrypted credentials of the MAA. If Event 9986 has been logged on the MOM server for the Exchange server, the ExMPLS key should be present on the Exchange server.

This key will hold the REG_BINARY value named DATA0. The value holds the binary data that represents the Public Key Blob of the MAA credentials. If you see this key and value, the Exchange server is now ready to store the encrypted credentials for the MAA.

The next step would be to run the configuration wizard or the SetCredential tool to encrypt and write the MAA credentials to the registry. The domain, user name, and password for the MAA will be written to the ExMPLS key to values DATA1, DATA2, and DATA3 respectively, when the credentials are successfully stored.

For More Information

For more information, see Microsoft Knowledge Base article 274696, "Actions such as search and drag and drop do not work because the default access permissions have been changed in the Dcomcnfg.exe tool."