So customer calls up saying exchange isn't working, and when he remoted in he could see all the services disabled.
All the exchange services, IIS, update, plus a bunch of others were all set to disabled state.
Apon changing to automatic they started again fine and now email works, but how they got into this state is the worry.
I believe, from something similar years ago, that in msconfig there is diagnostic startup, which might result in said services being disabled. Again though, after another 'normal' reboot, why wouldn't they revert back to normal? And, how would it have gone into diag startup in the first place?
Anyway, a few other people on google seem to have had the same problem over the years but no one has really found a solution. At this stage we aren't ruling out a virus however it is a server with almost 0 access to the web so doubtful.
And exchange 2007 8.1 (some 0s missing) on server 2008 SBS (windows server standard FE 2007 SP2)
Best Answer
As Nixphoe alluded to in his comment, your situation sounds very similar to problems people have after installing an Exchange security rollup or cumulative update. My guess is that the update installer stops the Exchange services and sets their startup mode to "disabled" while it copies new versions of the Exchange files.
Why disable the services? It probably doesn't want someone to inadvertently starting one of these services while the installer was running and the files were in an inconsistant state.
The real issue is that the installer didn't change the startup mode back to the original values. This might be a bug, or the installer may have been interrupted somehow and didn't get to perform its cleanup.
MS TechNet Forum post discussing this (credit to Nixphoe)... http://social.technet.microsoft.com/Forums/en-US/exchangesvrdeploy/thread/6ecf8e9a-9e27-4f2e-9e28-a59639029df1/
That post also has a set of sc.exe commands that will fix the service startup modes. Keep in mind that for most Exchange environments, the correct startup mode would probably be "automatic", but in failover/MSCS clusters, the correct mode may actually be "manual" so the cluster manager can control startup. It's always a good idea to check before you install an update.