Exchange Server Forums

Windows 2003 SP1 and Exchange 2003 SP1

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> General >> Windows 2003 SP1 and Exchange 2003 SP1

Page: [1]

Message

<< Older Topic Newer Topic >>

Limited time MSExchange.org offer! -- 1.Sep.2008 1:00:00 PM

TechGenix and SolarWinds have partnered to provide free copies of SolarWinds Exchange Monitor to all visitors who join the MSExchange.org Forums. SolarWinds Exchange Monitor is a handy desktop dashboard that continuously monitors Microsoft Exchange to deliver real-time insight into Exchange services, mail queue sizes, and host server health. Learn more about Exchange Monitor and the free offer!

Windows 2003 SP1 and Exchange 2003 SP1 - 27.Apr.2005 6:06:00 PM

kforsman2

Posts: 5
Joined: 5.Apr.2005
From: Edmonton
Status: offline

An issue I'm encountering, which I'm going to call MS soon about. With installing W2k3 SP1, the boot.ini file was modified and /NoExecute=OptOut was added to it. This forces on PAE, even though we have the /NOPAE switch in the ini file. Exchange really doesn't like PAE.

Anythoughts as to why this is being added before I attempt to remove it?

Post #: 1

Featured Links*

RE: Windows 2003 SP1 and Exchange 2003 SP1 - 27.Apr.2005 9:50:00 PM

Henrik Walther

Posts: 6848
Joined: 21.Nov.2002
From: Copenhagen, Denmark
Status: offline

I'll try to hear some of my MS and MVP contacts and come back with an update.

Haven't heard about this issue before now.

(in reply to kforsman2)

Post #: 2

RE: Windows 2003 SP1 and Exchange 2003 SP1 - 28.Apr.2005 10:42:00 PM

kforsman2

Posts: 5
Joined: 5.Apr.2005
From: Edmonton
Status: offline

I've been working with Premier support, and they are now seeing this as a bug. Right now we have no way of turning off PAE on our servers which are running SP1. These particulare servers do not appear to have anything in the BIOS to disable. Fortunately they are not production, but they were supposed to be today at noon. Below is a summary that I've sent out to a few people but there doesn't appear to be that many who are testing SP1 on high end Exchange servers yet.

In testing SP1 for Windows 2003 on Exchange 2003 servers, both cluster and standalone, we've encountered a couple of issues that appear to be undocumented as of yet by Microsoft. I do have an open call with them at this time and are currently listing it as a bug.

1) SP1 introduced DEP (Data Execution Protection) to Windows 2003, which is basically protects a computer from executing applications from buffer overruns. This has a two pronged problem.
a) On an Exchange cluster, the SMTP service either will fail to start or fail to shut down
b) with DEP enabled, PAE is turned on, which is not supported by Exchange.
2) The BUG, is that we can't turn off PAE, even with DEP disabled.

The way to disable DEP is to go into the Boot.ini file, where there is a new entry, /NoExecute=OptOut, change this to =AlwaysOff. This is supposed to turn of PAE as well as DEP but at this time that doesn't happen. Even specifying /NOPAE has no effect. One possible way is to go into the BIOS and disable DEP support.

This of course will not be an issue for everyone but as usual, test test test, and don't be afraid to the the Exchange Best Practices Analyser.

(in reply to kforsman2)

Post #: 3

RE: Windows 2003 SP1 and Exchange 2003 SP1 - 28.Apr.2005 11:01:00 PM

WayCool

Posts: 3
Joined: 18.Jan.2005
From: NM
Status: offline

My only question here.. is why would this be considered a bug ?? I mean other than perhaps it should not be enabled by default ?

I can see the hardware PAE as an issue.. but still it can be disabled with the switch you indicated.

The optout setting could be handled by using the "optout" setting in system properties by opting out the SMTP service(if that is the service affected ?) or at least that is how I understand DEP to work in 2k3 Server.

Thnks for the info !

(in reply to kforsman2)

Post #: 4

RE: Windows 2003 SP1 and Exchange 2003 SP1 - 9.May2005 8:29:00 PM

jmcbee

Posts: 118
Joined: 9.May2005
From: Honolulu, HI
Status: offline

Hi Henrik:
Did you ever get an official response on this? My friendly neighborhood Ranger recommends /NOPAE /EXECUTE. I'm looking for the definitive answer. :-)

Thanks!

(in reply to kforsman2)

Post #: 5

RE: Windows 2003 SP1 and Exchange 2003 SP1 - 9.May2005 9:05:00 PM

Henrik Walther

Posts: 6848
Joined: 21.Nov.2002
From: Copenhagen, Denmark
Status: offline

Only feedback was below (from Tim McMichael):

If this is helpful�

/noexecute Switch

================

The /noexecute parameter enables Data Execution Prevention (DEP), a set of hardware and software technologies designed to prevent harmful code from running in protected memory locations

/noexecute={alwayson | optout | optin | alwaysoff}

Switch noexecute=OptOut

Enables DEP for the operating system and all processes, including the Windows kernel and drivers.

Switch noexecute=alwayson

Enables DEP for the operating system and all processes, including the Windows kernel and drivers. All attempts to disable DEP are ignored.

Switch noexecute=optin

Enables DEP only for operating system components, including the Windows kernel and drivers.

Switch noexecute=alwaysoff

Disables DEP. Attempts to enable DEP selectively are ignored. This parameter also

disables physical address extension (PAE). To re-enable (PAE), use the /pae parameter.

More information on DEP and Noexecute

================================

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/memory/base/data_execution_prevention.asp

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2mempr.mspx

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ddtools/hh/ddtools/bootini_aff45176-bd02-43cf-9895-c212fa392de2.xml.asp

Actually I forgot all about it since then...

(in reply to kforsman2)

Post #: 6

RE: Windows 2003 SP1 and Exchange 2003 SP1 - 22.Jul.2005 2:45:00 PM

bproteau

Posts: 14
Joined: 22.Jul.2005
From: Dallas
Status: offline

A collegue of mine sent Korbyn's post to Premier. This is the response:

Up until recently, it was a best practice to disable physical address extensions (with the /NOPAE switch) on Exchange servers where the /3GB switch was set. This recommendation existed because Exchange 200x had not been tested with the PAE kernel, nor was the PAE kernel necessary on an Exchange server. New hardware and software capabilities now require the PAE kernel to be loaded. For example, servers with Lindenhurst or Twincastle chipsets require the PAE kernel to be loaded, otherwise not all installed memory will be recognized. In another example, Windows 2003 SP1 supports hardware-enforced data execution prevention (DEP). This functionality cannot be enabled if the PAE kernel is not loaded.

As a result of testing by the Exchange server product team, it is now a best practice to allow the PAE kernel to load on an Exchange server. Therefore, the /NOPAE switch is no longer necessary unless you are troubleshooting a specific issue where the PAE kernel is suspected as a contributory factor. On some servers running Windows 2003 SP1, the /NOPAE switch may be ineffective as hardware-enforced DEP (enabled with the /NoExecute switch) will override this instruction to disable PAE. If required, the /Execute switch can be used to disable the PAE kernel, as described in KB900524. Note: the /Execute switch will also disable DEP on the system.

Regards

(in reply to kforsman2)

Post #: 7