Exchange 2016 - AD Topology Service won't start - 1053

[Pazuzu]

All on premises, 3 servers.

2008 R2 - DC/GC
2012 R2 - DC/GC
2012 R2 - Exchange 2016 on-prem

We had some real drama with the recent updates disabling services and needed a lot of manual intervention to get it working but that was all sorted about 40 days ago.

Did a bog standard restart of the Exchange server on Friday night, no updates, and now the Exchange AD Topology Service will not start and just says 1053 - service did not respond in a timely manner.

We've tried just about everything that can be found on the web, tried disabling Firewalls on all servers, tried disabling ESET AV as well with no change.

We've checked a verified that AD is working properly, all servers are time synched, GPO are accessible and work correctly, everything can browse everything else and ping.

We've reset NICs, cleared DNS caches, disabled IPv6 all to no avail - just the same 1053 error with a 6000 millisecond timeout.

Any ideas where I can get more information about why the service will not start?

Thanks!

[Mutts]

found something similar from here:

https://community.spiceworks.com/topic/2058997-exc...

Never heard of event viewer logs causing issues

[Pazuzu]

Had seen that one, did it and no change.

[robsdesk]

Check DNS on the exchange server, not that many things which can break AD topology service, make sure it's pointed at your DCs etc.

[Chimune]

Any old or retired dcs with records still in AD somewhere?
Shut all services down and rerun the last cu?
Anything of note in dcdiag?

[bangerhoarder]

I’ve seen this happen where one of the self signed certs in Exchange has expired - it’ll keep running, but won’t restart the service once it stops. That usually explains why a server which was working fine then plays the fool.

You can check and renew these through the EMC if it loads, Powershell if that loads, or through the Certificate Management MMC.

[Pazuzu]

Thanks, I've looked at the other things - all checks out fine.

I will check for expired certs.

Currently want to uninstall our Exclaimer sig software it seems Exchange needs to be running to do this!

[Pazuzu]

It looks like CU20 has saved my bacon. All services started, just waiting for incoming mail to start flowing again.

[seefarr]

Security guy here.

Glad the server seems fixed but if you hadn't patched that Exchange server and it was available on the web on 80 / 443 for OWA, there's a near certainty that it has been compromised. This could be the cause of your issues and should be investigated if so.

A good summary here:
https://www.bleepingcomputer.com/news/security/the...

And while I'm lecturing you like the ultimate Internet bellend, it would be remiss to not mention that Win 2008 R2 is EOL and should be retired yesterday. But you already knew that.

[bitchstewie]

I can't even put into words how nice it is being in Office 365 and not having to care about this kind of st any more.

Waking up and seeing the NSA tweeting that they recommend you patch your internet facing Exchange servers is not my idea of a good start to the day.

Sorry internet bellend number 2 here