Well, I knew that I wasn't getting the error when I left work but it would be there the next morning. So I scheduled the get-storagegroupcopystatus to run every 5 minutes and pipe to a file. The only thing in the event log for the 5 minute interval when I started getting the error again was the group policy update. So I fixed the error by moving the cluster and then ran gpupdate to verify that it immediately broke. Then we could narrow it down to a specific policy by selectively removing policies. Then I had to keep removing things from that policy to find that it was the winreg thing. And then I had to manipulate the permissions to figure out which one(s) are needed. And thus I landed on the machine account. I also found out that if I removed administrators from the key, I couldn't manually move the cluster. :-) ___________________________________ Laura Bibel Bechtel Marine Propulsion Corporation
________________________________ From: Michael B. Smith [mailto:mich...@theessentialexchange.com] Posted At: Thursday, February 05, 2009 5:07 PM Posted To: Sunbelt Exchange Forum Conversation: storage group copy status error Subject: RE: storage group copy status error How on earth did you figure that out? Regards, Michael B. Smith, MCITP:SA,EMA/MCSE/Exchange MVP My blog: http://TheEssentialExchange.com/blogs/michael I'll be at TEC'2009! http://www.tec2009.com/vegas/index.php From: Bibel, Laura [mailto:bibe...@bettis.gov] Sent: Thursday, February 05, 2009 5:01 PM To: MS-Exchange Admin Issues Subject: RE: storage group copy status error Since I resolved this, I figured I'd post in case someone else googles the error. I found that when we get the RPC replication error, moving the cluster to the other node fixes the error but it breaks some time after that. I found that a policy restricts hklm\system\currentcontrolset\control\securepipeservers\winreg to full control for administrators, service and system. It turns out that each node must also grant permissions to the other node's machine account (or a group in which the machine account is a member) with a minimum of "read control" in order to query the storage group copy status. When we fail the cluster to the other node, Windows will reset the permissions (including the machine accounts of the nodes) on the key which is why the storage group copy status then works again. From what I understand, that key is for remote registry access. Apparently a lot of things can break without the proper permissions on this key! Laura Bibel Bechtel Marine Propulsion Corporation ________________________________ From: Michael B. Smith [mailto:mich...@theessentialexchange.com] Posted At: Saturday, January 31, 2009 8:46 AM Posted To: Sunbelt Exchange Forum Conversation: storage group copy status error Subject: RE: storage group copy status error As another poster pointed out, if test-replicationhealth succeeds, you would be running into a known issue. But it doesn't. I don't know any simple explanation for your problem. I recommend a call to PSS. Regards, Michael B. Smith, MCITP:SA,EMA/MCSE/Exchange MVP My blog: http://TheEssentialExchange.com/blogs/michael I'll be at TEC'2009! http://www.tec2009.com/vegas/index.php From: Sunbelt Exchange Forum [mailto:sunbeltexchangefo...@bettis.gov] Sent: Friday, January 30, 2009 7:35 AM To: MS-Exchange Admin Issues Subject: RE: storage group copy status error Sorry, it's Server 2008 on ESX. Test-replicationhealth reports passed for: ClusterNetwork QuorumGroup FileShareQuorum CmsGroup NodePaused DnsRegistrationStatus followed by the Microsoft Exchange Replication service RPC failed error from my original post. On the active node, the app log recorded recent errors 3044 and 3043: Error 0x8004010f occurred while performing a site folder teardown check for Public Folder Store "Second Storage Group\Public Folder Store". Error 0x8004010f occurred while performing a site folder check for Public Folder Store "Second Storage Group\Public Folder Store". Ping times are <1ms. Laura Bibel ________________________________ From: Michael B. Smith [mailto:mich...@theessentialexchange.com] Posted At: Thursday, January 29, 2009 5:05 PM Posted To: Sunbelt Exchange Forum Conversation: storage group copy status error Subject: RE: storage group copy status error OK, is this Server 2003 or Server 2008? What is the output from test-replicationhealth? What is in the event log? What is the latency between source and target? Regards, Michael B. Smith, MCITP:SA,EMA/MCSE/Exchange MVP My blog: http://TheEssentialExchange.com/blogs/michael I'll be at TEC'2009! http://www.tec2009.com/vegas/index.php From: Sunbelt Exchange Forum [mailto:sunbeltexchangefo...@bettis.gov] Sent: Thursday, January 29, 2009 4:48 PM To: MS-Exchange Admin Issues Subject: storage group copy status error Exchange 2007 RU5 CCR ... test system - I can't paste the errors or output here so I've typed part of the error below. The management console shows copy status=unknown. Get-storagegroupcopystatus gives: Microsoft Exchange Replication service RPC failed: Microsoft.Exchange.Rpc.RpcException: Error e0434f4d from cli_GetCopyStatusEx at Microsoft.Exchange.Rpc.Cluster.ReplayRpcClient.GetCopyStatusEx... Get-storagegroupcopystatus -standbymachine <servername> results in "not configured" for the SummaryCopyStatus. I deleted the log shares (which was about the only solution I could find via google) and let them recreate. The status will show healthy for a short time then revert to unknown in the console. Have I neglected to configure something? _______________ Laura Bibel ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~
