Access Violation in Store.exe in Exchange Server (194811)

SYMPTOMS

Shortly after you start the Microsoft Exchange Server information store, it may stop with an Access Violation. The stack trace in the Dr. Watson log is similar to the following:

   *----< Stack Back Trace >----*
   FramePtr ReturnAd Param#1  Param#2  Function Name
   0cb8f094 7767300c 00000000 0cb8f120 msvcrt!wcslen
   0cb8f0c4 00477958 00000000 0cb8f0e0 mswsock!EnumProtocolsA
   0cb8f8dc 00477893 00000002 0cb8f91c
   store!PUSH_NOTIFY::FIsValidAddressFamily [omap]  (FPO: [1,513,2])
   0cb8f8f4 004777d3 00143b5c 00000008 store!PUSH_::EcConfig [omap]  (FPO:
   [EBP 0x0cb8f91c] [5,0,4])
   0cb8f918 77e11841 00188380 00000000 store!EcRRegisterPushNotification
   [omap]  (FPO: [8,1,2])
   0cb8f948 77e52265 0047775c 0cb8fb3c rpcrt4!I_RpcFreeBuffer
   0cb8f964 77e52236 0047775c 0cb8fb3c rpcrt4!NdrStubCall
   0cb8fc28 77e51f9e 00000000 00000000 rpcrt4!NdrStubCall
   0cb8fc7c 77e11122 00403f25 0cb8fe08 rpcrt4!NdrServerCall
   0cb8fcd0 77e112fb 0cb8fe08 00000000 rpcrt4!<nosymbols>
   0cb8fcf0 77e119cf 0cb8fe08 00000000 rpcrt4!I_RpcGetBuffer
   0cb8fdc8 77e12b98 00143b10 0cb8fe68 rpcrt4!I_RpcFreeBuffer
   0cb8fe40 77e15fff 00143b10 0cb8fe68 rpcrt4!NdrPointerFree
   0cb8ff90 77e162f0 77e163e5 00156770 rpcrt4!NdrOleAllocate
   00003a98 00000000 00000000 00000000 rpcrt4!NdrOleAllocate

This stack trace shows that the function EcRRegisterPushNotification fails to complete due to problems enumerating the available protocols the transport stack can bind to.

CAUSE

The LanaMap value must contain a two-byte tuple for each string in the Bind value.

NOTE: Please see the Workaround section below, second method, for details on viewing these values.

An example of a single string in the Bind value is:

   \Device\NetBT_CPqNF31

If this is the only string in the Bind value, then the LanaMap value must contain only ONE two-byte tuple for the one Bind string.

If the LanaMap value does not contain the right number of two-byte tuples, for example:

   1 string in the "Bind" value  = 1 two-byte tuple  (for example, 01 01)
   2 strings in the "Bind" value = 2 two-byte tuples (for example, 01 01 01
   02)

The store stops when trying to register a "Push Notification" with the remote procedure call (RPC) end-point mapper.

WORKAROUND

You can work around this issue using one of two methods. The first method requires you to restart Windows NT at least twice. Using the second method, you do not need to restart Windows NT.

First Method

In Control Panel, click Network, and select the Services tab.
Select NetBIOS Interface, and click Remove to remove the NetBIOS Interface.
Restart Windows NT when prompted.
In Control Panel, click Network, and select the Services tab.
Click Add, and select NetBIOS Interface from the list of network services to install the NetBIOS Interface.
When you are prompted, supply the location of the Windows NT installation files.
Restart Windows NT when prompted.
If a service pack has been applied to Windows NT, you must reapply it.

Second Method

You can verify the number of strings in the Bind value and the number of corresponding two-byte tuples in the LanaMap value by following these steps:

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

Start Registry Editor (Regedt32.exe).
Locate the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBIOS\Linkage

View the value below (double-click the value using the mouse, or select the value, and on the Edit menu, click Multi String).

      Value Name: Bind
      Data Type:  REG_MULTI_SZ
      Value:      Its value will contain one or more strings such as
                  \Device\NetBT_CPqNF31

Click OK to close the Multi String Editor.

View the value below (double-click the value using the mouse, or select the value, and on the Edit menu, click Binary).

      Value Name: LanaMap
      Data Type:  REG_BINARY
      Value:      Its value will contain sets of two-byte tuples such as
                  0100 (a single two-byte tuple viewed in hex)

Click OK to close the Binary Editor.
Quit Registry Editor.

If the LanaMap value does not contain one set of two-byte tuples for each string in the Bind value, you need to follow the steps below to correct this:

Start Registry Editor (Regedt32.exe).
Locate the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBIOS\Linkage
Select the following value, and on the Edit menu, click Binary.
```
      Value Name: LanaMap
      Data Type:  REG_BINARY
      Value:
						
```
The Value field must contain one set of two-byte tuples for each string in the Bind value. The first tuple in each set is always 01; the second tuple must be the Lana number of the corresponding transport device NetBIOS should bind to (as listed in the Bind value). This value can be obtained from the NetBIOS Configuration dialog box. To do so:
1. In Control Panel, click Network, and select the Services tab.
2. Select NetBIOS Interface, and click Properties.
For example:

If the Lana Number obtained from the NetBIOS Configuration dialog box for the first device in the Bind value is 000, the first set of two-byte tuples in the LanaMap value would be:
0100
If the Lana Number for the second device in the Bind value is 002, the second set of two-byte tuples in the LanaMap value would be:
0102
Quit Registry Editor.
Start the Exchange Server information store.