# Event ID 7031 - Service Terminated
Log Name:      System
Source:        Service Control Manager
Event ID:      7031
Level:         Error
Description:   The Microsoft Exchange RPC Client Access service
               terminated unexpectedly. It has done this 1 time(s).
               The following corrective action will be taken in
               5000 milliseconds: Restart the service.

# Event ID 7032 - Recovery Action Taken
Log Name:      System
Source:        Service Control Manager
Event ID:      7032
Level:         Information
Description:   The Service Control Manager tried to take a
               corrective action (Restart the service) after the
               unexpected termination of the Microsoft Exchange
               RPC Client Access service.

# Find recent service termination events
Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id = 7031,7032
    StartTime = (Get-Date).AddDays(-7)
} | Select-Object TimeCreated, Id, Message | Format-Table -Wrap

# Count crashes by service
Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id = 7031
    StartTime = (Get-Date).AddDays(-7)
} | Group-Object { ($_.Message -split "'")[1] } |
    Select-Object Count, Name | Sort-Object Count -Descending

# Get details of recent crashes
Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id = 7031
    StartTime = (Get-Date).AddDays(-1)
} | ForEach-Object {
    $serviceName = ($_.Message -split "'")[1]
    [PSCustomObject]@{
        Time = $_.TimeCreated
        Service = $serviceName
        Message = $_.Message.Substring(0, [Math]::Min(100, $_.Message.Length))
    }
} | Format-Table -Wrap

# Look for errors just before the crash
$crashTime = (Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id = 7031
} -MaxEvents 1).TimeCreated

Get-WinEvent -FilterHashtable @{
    LogName = 'Application'
    Level = 2  # Error
    StartTime = $crashTime.AddMinutes(-5)
    EndTime = $crashTime
} | Select-Object TimeCreated, ProviderName, Id, Message | Format-Table -Wrap

# Check current service status
Get-Service MSExchange* | Where-Object { $_.Status -ne 'Running' } |
    Select-Object Name, Status, StartType | Format-Table

# Check service recovery settings using sc.exe
$services = @("MSExchangeRPC", "MSExchangeIS", "MSExchangeServiceHost")
foreach ($svc in $services) {
    Write-Host "=== $svc ===" -ForegroundColor Cyan
    sc.exe qfailure $svc
}

# Restart the crashing service(s)
$crashingService = "MSExchangeRPC"  # Replace with actual service name

Write-Host "Stopping $crashingService..."
Stop-Service $crashingService -Force
Start-Sleep -Seconds 10

Write-Host "Starting $crashingService..."
Start-Service $crashingService
Start-Sleep -Seconds 5

# Verify service is running
$status = Get-Service $crashingService
Write-Host "$crashingService is now: $($status.Status)"$status.Status)"

# Configure service to restart on failure with delays
$services = @("MSExchangeRPC", "MSExchangeIS", "MSExchangeServiceHost")

foreach ($svc in $services) {
    # Set recovery: restart after 1min, 2min, 5min
    sc.exe failure $svc reset=86400 actions=restart/60000/restart/120000/restart/300000
    Write-Host "Configured recovery for $svc"
}

# Verify settings
foreach ($svc in $services) {
    Write-Host "=== $svc ===" -ForegroundColor Cyan
    sc.exe qfailure $svc
}

# Check Exchange process memory usage
Get-Process -Name "Microsoft.Exchange.*", "w3wp", "EdgeTransport" -ErrorAction SilentlyContinue |
    Select-Object ProcessName, Id, @{N='MemoryMB';E={[math]::Round($_.WorkingSet64/1MB)}} |
    Sort-Object MemoryMB -Descending | Format-Table -AutoSize

# Check system memory
$os = Get-WmiObject Win32_OperatingSystem
$freeMemGB = [math]::Round($os.FreePhysicalMemory/1MB,2)
$totalMemGB = [math]::Round($os.TotalVisibleMemorySize/1MB,2)
$usedPercent = [math]::Round((1 - $os.FreePhysicalMemory/$os.TotalVisibleMemorySize) * 100)
Write-Host "Memory: $freeMemGB GB free of $totalMemGB GB ($usedPercent% used)"$totalMemGB GB ($usedPercent% used)"

# If memory is critically low, consider:
# 1. Restarting high-memory services-memory services
# 2. Adding RAM to server
# 3. Reducing concurrent connections

# Check current Exchange version
Get-ExchangeServer | Select-Object Name, AdminDisplayVersion | Format-Table

# Check if latest CU is installed
$version = (Get-ExchangeServer).AdminDisplayVersion
Write-Host "Current version: $version"
Write-Host ""
Write-Host "Check for latest CU at:"
Write-Host "https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates"-features/build-numbers-and-release-dates"

# Check Windows Updates
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 |
    Select-Object HotFixID, Description, InstalledOn | Format-Table

# Paths that should be excluded from AV scanning
$exclusions = @(
    "$env:ExchangeInstallPath" + "Bin",
    "$env:ExchangeInstallPath" + "Mailbox",
    "$env:ExchangeInstallPath" + "TransportRoles",
    "$env:ExchangeInstallPath" + "Logging",
    "$env:ExchangeInstallPath" + "ClientAccess"
)

Write-Host "Ensure these paths are excluded from antivirus:" -ForegroundColor Yellow
$exclusions | ForEach-Object { Write-Host "  $_" }

Write-Host ""
Write-Host "Also exclude these processes:" -ForegroundColor Yellow
$processes = @("EdgeTransport.exe", "Microsoft.Exchange.*.exe", "w3wp.exe", "MSExchangeHMWorker.exe")
$processes | ForEach-Object { Write-Host "  $_" }

Write-Host ""
Write-Host "Refer to: https://docs.microsoft.com/en-us/exchange/antispam-and-antimalware/windows-antivirus-software"-and-antimalware/windows-antivirus-software"

# Check for crashes in last hour
$recentCrashes = Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id = 7031
    StartTime = (Get-Date).AddHours(-1)
} -ErrorAction SilentlyContinue

if ($recentCrashes) {
    Write-Host "WARNING: $($recentCrashes.Count) crashes in last hour" -ForegroundColor Red
} else {
    Write-Host "OK: No crashes in last hour" -ForegroundColor Green
}

# Verify all services running
Write-Host ""
Write-Host "=== Service Status ===" -ForegroundColor Cyan
Get-Service MSExchange* | Where-Object { $_.Status -ne 'Running' } |
    Select-Object Name, Status | Format-Table

$runningCount = (Get-Service MSExchange* | Where-Object { $_.Status -eq 'Running' }).Count
Write-Host "Running Exchange services: $runningCount"