The Mail Security for Microsoft Exchange service shuts down at apparently random times, and does not restart

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

The Symantec Mail Security for Microsoft Exchange (SMSMSE) service shuts down at apparently random times, and does not restart automatically. This results in no SMSMSE policies being applied against incoming email, including AntiSpam, Content Filtering and Virus policies.

The following events are observed in the System event log:

Type :        Warning
Event :        27
Source :        e1iexpress
Intel(R) 82574L Gigabit Network Connection
Network link is disconnected.

Followed by:

Type :        Information
Event :        7042
Source :        Service Control Manager
User :        \SYSTEM
Description:
The Symantec Mail Security for Microsoft Exchange service was successfully sent a stop control.
 The reason specified was: 0x40030011 [Operating System: Network Connectivity (Planned)]
 Comment: None

Cause

The Symantec Mail Security for Microsoft Exchange (SMSMSE) service has a service dependency set on the TCP/IP NetBIOS Helper (LmHosts) service. When Windows detects the network connection has been disconnected for any reason, for any amount of time, the LmHosts service is issued a shut down command by the service control manager. Because SMSMSE has a service dependency on LmHosts, the service control manager also issues a shut down command to the SMSMSE service. As soon as the network is restored, the LmHosts service is issued a start command, but no such command is issued to the SMSMSE service, resulting in the SMSMSE service staying stopped until a manual start command is issued.

It appears there is a known issue in VMWare drivers for the Intel E1000 and E1000E NIC types that result in random disconnects from the network.

Resolution

Determine the root cause for the network disconnect, and prevent this network disconnect event from occurring. This will prevent the SMSMSE service from being issued the stop request by the service control manager.

Workaround

Remove the service dependency for the SMSMSE service on the LmHosts service. This will prevent the service control manager from issuing the shut down request when the network interface disconnects.

To remove the service dependency:

1. Open the registry editor (Start -> Run, Regedit, OK) .
2. Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SMSMSE
3. In the right pane, locate the value DependOnService and double click it.
4. Remove the entry "LmHosts" from the list, and then click "OK".
5. Reboot the server.

After changing these settings, the SMSMSE service will no longer be issued a service shutdown request by the service control manager when the network interface is disconnected.