Microsoft Exchange Transport Service won't start (keeps saying starting)

Question

… it says starting, but fails and keeps retrying & we are panicking!

Environment

• Windows Server 2012 R2 (Version 6.3 Build 9600) running Exchange Server 2013 (Version 15.00.1497.023) virtualised in Hyper-V.
• This server runs all of the exchange services
• Server also runs WSUS
• PDC is on another VM - all running fine
• DNS Server is on another VM - all running fine
• 50 Users all using Outlook (2013 or 2016), none using it at the moment
• Processor - Intel(R) Xeon(R) CPU E5-2620 v4 @ 2.10GHz, 2098 Mhz, 6 Core(s), 6 -Logical Processor(s)
• Total Physical Memory - 22.0 GB
• Available Physical Memory- 4.15 GB
  Server normally rebooted monthly with updates, normally takes 10 mins to come back to life completely
  All external e-mail is in / out via Mimecast cloud services.
  we run ESET Mail Security for Microsoft Exchange Serverv.7.1.10009.0
  There is no inbound access to the exchange server from the internet, only from LAN & Mimecast.

Symptom
Last week:
Whilst doing host (not the vm) updates saved and then resumed all servers. "Microsoft Transport Service" showed as starting and no e-mail was flowing. Weird as save / resume shouldn't have stopped any services. We don't have amazing notes, but restarted all servers. Same. Then about 30 minutes later the service just seemed to start and was OK.

Today:
Installing OMSA on host and as a precaution saved the VMS (Exchange followed by other servers)
After the VM state was Saved and then Started again, the "Microsoft Exchange Transport" Service was showing as 'Running', but we received an error when in the Exchange Mail Queue to say "Exchange can't connect to the Microsoft Exchange Transport Service". We then rebooted the Server VM and the Service status changed to "Starting" where it get stuck for a period of time before showing as no status, and then starting again. Each time the process ID for the MSExchnageTransport.exe would change.

Event Log of failure:
14001 - MSExchangeTransport - "The worker process with process ID 20024 is not responding and will be forced to shut down."
What we've tried
Rebooting the server again
Disabling the service so that it stopped on its next restart attempt (it looks like the service attempts to restart every 15 mins or so), moved all of the contents out of the ..\TransportRoles\data\Queue folder before changing the service back to automatic & start, so it attempted to re-start, but it again got stuck on Starting.
The Queue folder is populated with same files as we removed (although the mail.que is smaller).
Checked the Event Logs and we can't see anything in particular that may be causing the service to not start properly.
So we are stuck. Really could do with some help here.

Thanks in Advance - Jason

Answer 1

"we run ESET Mail Security for Microsoft Exchange Serverv.7.1.10009.0"

Are the Exchange dirs excluded? Does it start if you disable or remove the anti-malware software?

Answer 2

Hi @Jason Chapman

According to my search, I found this link seems to discusses the related issue as yours, please check if the troubleshooting steps in this link are helpful to your scenario.

MSExchangeTransport 7004
This event indicates that an issue may exist that prevents the Microsoft Exchange Transport service (MSExchangeTransport.exe) from starting in a timely manner. You may experience this issue in one of the following scenarios.

• The SenderReputation database takes a long time to replay log files for a large information store database. This may indicate that the SenderReputation database is corrupted. In this scenario, MSExchangeTransport Event ID 14001 may be logged every five minutes. Additionally, a SenderReputation database event for successfully replaying log files is never displayed.
• You apply an Exchange Update Rollup package to a computer on which the local computer account does not have Internet access. The binary files in the Update Rollup packages are digitally signed. This requires the computer to perform certificate validation checks to verify the packages. If the local computer account does not have direct access to the Internet, the certificate verification check must time-out. This issue may occur when the computer's default gateway does not allow for Internet access or when the computer uses an authenticating proxy server for Internet access.
• An e-mail client that does not recognize the global message size restrictions is used. This may include earlier versions of Microsoft Outlook such as Microsoft Outlook 2003 SP1 and earlier versions. In this scenario, an e-mail client that does not recognize the global message size restrictions could submit excessively large messages for processing.
• Exchange is installed on a domain controller.
• Exchange is installed on a computer that has a slow disk subsystem.
• An outdated version of an antivirus software is installed on the Exchange server.

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

"50 Users all using Outlook (2013 or 2016), none using it at the moment"

Does this mean the server is not in production?

Can you build a new server and move mailboxes? Maybe use this to upgrade to 2016/2019?