PRB: Zetafax Connector service fails to start when set to use the local system account

ZTN1490

ID: ZTN1490

This Zetafax technical note applies to:

• Zetafax 9 Connector for Exchange 2000/3

Symptom

On rare occasions the Zetafax connector service will not start with the default logon credentials of local system (LocalSystem). The Services manager and Event viewer reports that it failed to start due to a logon failure.

Cause

In Microsoft Windows 2000 Server and Microsoft Windows Server 2003, services typically run under the account of the computer where they are installed. This account is the local system account, and its password is created and recycled by Windows 2000 or Windows Server 2003. By default, you can use this service account to gain access to the Exchange, however in these rare cases the Exchange organisation or operating system have been changed so that the local system account is no longer able to access the Zetafax Connectors resource mailbox.

Resolution

The resolution will differ depending on if the Exchange server is installed on a Domain Controller or not.

Member servers

You need to create a new service account for the Connector to use.

Note: If you change the logon account to the Administrator account or a member of the Domain Admins or Enterprise Admins groups, then you are explicitly denied access to all mailboxes other than your own, even if you otherwise have full administrative rights over the Exchange system.

Follow the instructions below to create a new service account:

1. Start Active Directory Users and Computers to create a new user account. Make this user a member of Domain Users group only.
2. Once created, add this user to the local administrators group (NOT Domain Admins) on the member server.
3. You now need to give this user access to the Exchange Organisation. You can grant Windows 2000 or Windows Server 2003 administrators rights to all the mailboxes in the whole organization by changing the permissions on the organization object at the top of the Exchange System Manager tree.
4. To change the security on the organization object, you must force the display of the Security tab in Exchange System Administrator.

   WARNING: Using Registry Editor incorrectly can cause serious, system-wide problems that may require you to reinstall Windows to correct them. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

5. To force the display of the Security tab, follow these steps:
• Click Start and then click Run.
• In the Open box, type regedit, and then press ENTER.
• In Registry Editor, locate the following subkey in the registry:

HKEY_CURRENT_USER\Software\Microsoft\Exchange\EXAdmin

• On the Edit menu, point to New, and then click DWORD Value.
• Type ShowSecurityPage, and then press ENTER.
• Press ENTER.
• In the Edit DWORD Value dialog box, type 1 in the Value data box, and then click OK.
• Quit Registry Editor.
6. Start Exchange System Manager and navigate to the organization object at the top.
7. Right click and choose Permissions.
8. Add the newly created service account user with full permissions. Ensure that the user is not explicitly denied "Send as" and "Receive as" permissions.
9. Ensure that these permissions have filtered through all the levels down to the Mailbox Store level within the Exchange System Manager tree.

   Note: If you do not want to grant such blanket access, you can use the instructions that are provided in " Method Two" of the following Microsoft article http://support.microsoft.com/default.aspx?scid=kb;en-us;821897 to grant access only to individual databases.

10. Start the Services MMC and locate the Zetafax Connector service. Change the logon account from LocalSystem to the new user account.
11. The Connector will now start and begin processing faxes.

Domain controllers

As there is no local user database on a domain controller, you need to create a domain user account.

The user must only be a member of Domain Users and the built-in Administrators group. Then follow the steps above from step 3 onwards.

Status

This has been identified by Equisys as a problem with the software versions given above.

Last reviewed: 4 August 2006 (AC/EB)

Date Published: 5 August 2005 (GC/EB/SV)

keywords: