You might encounter a situation when the MSExchangeSA service is stopped and you are not able to start the service.
When you try to start the service the follow event log error is logged:
Log Name: Application
Date: 08.01.2016 09:40:33
Event ID: 1005
Task Category: General
Unexpected error Access is denied. Facility: Win32 ID no: c0070005 Microsoft Exchange System Attendant occurred.
This issue happens most likely due to an endpoint protection solution (aka AV Scanner) blocking access to the MSExchangeSA executable.
The simple apporach to get the service running is to restart the server.
If you need to run local endpoint protection on your Exchange servers, keep in mind to configure the appropriate scan exclusions: