Nearly every Exchange service depends on the Microsoft Exchange Active Directory Topology service. When it can't find enough usable domain controllers, services stall at startup, mail stops, and the Application log fills with event 2142: "Topology discovery failed". In this post I'll show how to read event 2080 to see exactly which domain controllers Exchange rejected and why, fix the site, DNS, firewall or permission problem behind it, and keep static domain controllers as the last resort they should be.
Errors this guide fixes
Event ID 2142 (MSExchangeADTopology)Application logTopology discovery failed, error details No Minimal Required Number of Suitable Directory Servers Found in ForestApplication log (event 2142)No Suitable Directory Servers Found in ForestApplication log (event 2142), OWA/ECPThe Exchange computer EX01.contoso.com does not have Audit Security Privilege on the domain controller DC02.contoso.com.Application log (ADAccess 2112)This domain controller will not be used by Exchange Active Directory Provider.Application log (ADAccess 2112)Event ID 2080 (MSExchange ADAccess)Application logEvent ID 2112 (MSExchange ADAccess)Application log
Symptoms#
Event ID 2142 (MSExchangeADTopology) errors like this one appear in the Application log:
Log Name: Application
Source: MSExchangeADTopology
Event ID: 2142
Task Category: Topology
Level: Error
Description: Process Microsoft.Exchange.Directory.TopologyService.exe (PID=2700) Forest contoso.com. Topology discovery failed, error details No Minimal Required Number of Suitable Directory Servers Found in Forest contoso.com Site Default-First-Site-Name and connected Sites.- A variant:
Topology discovery failed, error details No Suitable Directory Servers Found in Forest contoso.com Site Default-First-Site-Name and connected Sites.Admins report the same "No Suitable Directory Servers Found in Forest" text on OWA and ECP error pages. - Event ID 2112 (MSExchange ADAccess):
The Exchange computer EX01.contoso.com does not have Audit Security Privilege on the domain controller DC02.contoso.com. This domain controller will not be used by Exchange Active Directory Provider. - Exchange services stuck in Starting or stopped after a reboot, and mail flow halted, even though the domain controllers themselves look healthy.
Why it happens#
The topology service (MSExchangeADTopology, process Microsoft.Exchange.Directory.TopologyService.exe) finds domain controllers and global catalogs in the Exchange server's AD site and connected sites, tests each one, and logs the result as Event ID 2080 (MSExchange ADAccess). Event 2142 means too few servers passed. The 2080 columns point to the cause:
| What 2080 or 2142 shows | Likely cause |
|---|---|
| 2142 names an unexpected site, or no in-site servers are listed | The Exchange server's subnet isn't mapped to the right AD site |
| A removed DC still listed, or live DCs missing | Wrong DNS servers on the Exchange NIC, or stale records and metadata for a removed DC |
| Reachability or Netlogon below 7 on a global catalog (Reachability 6 is normal on a DC that isn't one) | A firewall or network path blocking LDAP, global catalog or RPC traffic |
| SACL right 0, plus event 2112 | The Exchange Servers group lost the Manage auditing and security log right on domain controllers |
| Synchronized below 7 or Critical Data 0 | AD replication problems |
| OS Version 0 | The DC's operating system isn't supported by your Exchange version |
How to fix it#
1. Read the latest event 2080#
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='MSExchange ADAccess'; Id=2080} -MaxEvents 1 |
Select-Object -ExpandProperty MessageEach line follows the header (Server name | Roles | Enabled | Reachability | Synchronized | GC capable | PDC | SACL right | Critical Data | Netlogon | OS Version). A healthy in-site line reads dc01.contoso.com CDG 1 7 7 1 0 1 1 7 1:
| Column | Healthy | Meaning |
|---|---|---|
| Roles | CDG | Usable as configuration DC, domain controller and global catalog |
| Enabled | 1 | ADAccess may use the server |
| Reachability, Synchronized | 7 (6 on a DC that isn't a global catalog) | Bit flags: 1 = global catalog (port 3268), 2 = domain controller and 4 = configuration DC (port 389); 7 means every role passed. Synchronized reflects isSynchronized on the DC's rootDSE |
| GC capable, PDC | 1, 0 or 1 | Global catalog; PDC emulator (informational) |
| SACL right | 1 | ADAccess can read the SACL part of security descriptors on that DC |
| Critical Data | 1 | This Exchange server's object was found in the DC's configuration container |
| Netlogon | 7 | The RPC check of the Net Logon service passed for each role |
| OS Version | 1 | The DC's OS meets Exchange's requirements |
2. Check the site and DNS#
nltest /dsgetsite
nltest /dsgetdc:contoso.com /gc /force
ipconfig /allnltest /dsgetsite must return the site that holds your Exchange servers and their DCs. If not, add the subnet in Active Directory Sites and Services › Sites › Subnets and associate it with the right site. The NIC should list only AD-integrated DNS servers, never a public resolver. Then check the site's SRV records (HQ is the site name here):
Resolve-DnsName -Type SRV "_ldap._tcp.HQ._sites.dc._msdcs.contoso.com"
Resolve-DnsName -Type SRV "_gc._tcp.HQ._sites.contoso.com"Every target should be a live DC. A DC that was removed without metadata cleanup can still be listed and tried, so finish the metadata cleanup and remove its DNS records.
3. Test the network path#
foreach ($p in 88, 135, 389, 3268) {
Test-NetConnection dc01.contoso.com -Port $p | Select-Object ComputerName, RemotePort, TcpTestSucceeded
}The Netlogon check uses RPC, so the dynamic RPC range must be open too. A firewall that allows LDAP but blocks RPC is a classic reason for Netlogon values below 7.
4. Restore the SACL right (SACL right 0 or event 2112)#
In Group Policy Management, open Default Domain Controllers Policy › Computer Configuration › Policies › Windows Settings › Security Settings › Local Policies › User Rights Assignment › Manage auditing and security log and make sure Exchange Servers is listed. User rights don't merge between GPOs: if a hardening GPO linked to the Domain Controllers OU with higher precedence defines the same right, its list wins, so add Exchange Servers there. Then run gpupdate /force on the DCs.
Exchange's domain preparation grants this right in each domain's Default Domain Controllers Policy (/PrepareAD covers the domain it runs in; /PrepareDomain or /PrepareAllDomains cover the others). Rerunning it repairs an edited policy, but not an override from another GPO. See PrepareSchema and PrepareAD errors before you run it.
5. Fix replication if Synchronized or Critical Data is wrong#
repadmin /replsummary
repadmin /showrepl dc01.contoso.comCritical Data 0 means that DC doesn't have this Exchange server's object in its configuration partition, so treat it as a replication problem.
6. Restart discovery#
Once the cause is fixed, run Restart-Service MSExchangeADTopology -Force or reboot the server in a maintenance window. Dependent Exchange services restart too, so expect a short outage.
7. Last resort: static domain controllers#
Set-ExchangeServer EX01 -StaticDomainControllers dc01.contoso.com,dc02.contoso.com -StaticGlobalCatalogs dc01.contoso.com,dc02.contoso.com -StaticConfigDomainController dc01.contoso.com
Get-ExchangeServer EX01 -Status | Format-List Static*, Current*
# Undo once the root cause is fixed
Set-ExchangeServer EX01 -StaticDomainControllers $null -StaticGlobalCatalogs $null -StaticConfigDomainController $nullWatch out: static entries bypass site-aware selection and failover. If those DCs go down, Exchange goes down with them, and the setting is easy to forget. To skip one broken DC, -StaticExcludedDomainControllers is the narrower tool. Set-ADServerSettings -PreferredServer only affects your own shell session, not the services.
Verify the fix#
- A new event 2080 lists your in-site global catalogs as
CDG 1 7 7 1 0 1 1 7 1(PDC column 1 on the PDC emulator). - No new 2142 or 2112 events:
PowerShell
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=2142, 2112; StartTime=(Get-Date).AddHours(-1)} -ErrorAction SilentlyContinue Get-ExchangeServer EX01 -Statusshows in-site DCs underCurrentDomainControllersandCurrentGlobalCatalogs.Test-ServiceHealthreportsRequiredServicesRunning : Trueand queues drain.
Prevent it next time#
- Record the Exchange Servers Manage auditing and security log requirement in your DC hardening baseline.
- Map every Exchange and DC subnet to a site, and keep more than one global catalog in each Exchange site.
- Run metadata cleanup whenever a DC is removed, and check the supportability matrix before upgrading DCs.
- Remove static DC settings as soon as the incident is over.
