You might encounter a situation when the MSExchangeSA service is stopped, and you cannot start the service.
When you try to start the service, the following event log error is logged:
Log Name: Application
Source: MSExchangeSA
Date: 08.01.2016 09:40:33
Event ID: 1005
Task Category: General
Level: Error
Keywords: Classic
User: N/A
Computer: SERVER01.MCSMEMAIL.DE
Description:
Unexpected error Access is denied. Facility: Win32 ID no: c0070005 Microsoft Exchange System Attendant occurred.
This issue happens most likely due to an endpoint protection solution (aka AV Scanner) blocking access to the MSExchangeSA executable.
The simple approach to get the service running is to restart the server.
If you need to run local endpoint protection on your Exchange servers, keep in mind to configure the appropriate scan exclusions:
