Topic Last Modified: 2007-02-27

The Microsoft® Exchange Database Troubleshooter Tool detected one or more MSExchangeIS 5000 events with error code 0x3f5 in the Application Log. This error occurs when the Microsoft Exchange Information Store service is configured to start with an account other than Local System.

Explanation

This issue can occur if the Microsoft Exchange Information Store service (Store.exe) is using an account other than the Local System account, or if the domain controller, the domain, or the Local Machine Security Policy does not include the Local Service account in the Generate Security Audits policy. When this problem occurs, the Exchange Information Store service fails to initialize. The error applies to the following versions of Exchange server:

  • Microsoft Exchange Server 2007

  • Microsoft Exchange Server 2003

  • Microsoft Exchange 2000 Server

User Action

To resolve this issue, perform one or more of the following:

  • By default, the Exchange Information Store service uses the Local System account to start the Information Store service (MACHINENAME$). Use the Services.msc snap-in to check which account is being used to start the Information Store service. If the account is the Local System account, you must grant the Local System account the Generate Security Audits right. To do this, use one of the following methods:

    • Rerun the Exchange Setup /domainprep command from this computer.

    • Manually grant the Local System account the Generate Security Audits right on one of the following policies:

    1. The domain controller's policy

    2. The domain policy

    3. The Local Machine Security Policy

      To re-grant this right to the Local Machine Security Policy of a member server, follow these steps.

      Note:
      This is the recommended solution if this issue is only occurring on one server.
      To re-grant audits right to the Local Machine Security Policy of a member server
      1. Click Start, click Administrative Tools, and then click Local Security Policy.

      2. Expand Security Settings, click Local Policies, and then click User Rights Assignment.

      3. In the right pane, double-click Generate security audits, click Add, enter the MACHINENAME$, and then click OK two times.

      4. Exit the Group Policy snap-in.

  • If you start the Information Store service by using an account that is not the Local System account, you should change it back to the Local System account (MACHINENAME$). Then, try to start the Information Store service. For more information about why Exchange 2000 Server and Exchange Server 2003 use the Local System account to start Exchange services, see Microsoft Knowledge Base article 239762, Exchange S ervices R un U nder LocalSystem.

For More Information