With apologies to Alexander Pope, today I would like to cover in more specific detail a little gem from Microsoft that has been mentioned in several other articles on TheEmailAdmin.com, but never really detailed. The Microsoft Exchange Server Error Code Look-up tool is one of the most useful tools Microsoft has ever released, and that they did so with little to no fanfare is remarkable.
Some of you reading this may have been using it for years, but time and again I marvel at the stunned look on other admins’ faces when we find an error code, and instead of browsing to Google, I drop to a command prompt and type
err 0xc0ffee [enter]
or, something like that anyway.
You can download the tool from Microsoft by clicking here and if you look closely at the text on that page, you’ll be left with the impression that this is a legacy tool that is only good on older servers and for Exchange. While it is a fantastic tool for troubleshooting Exchange, and that is what we will focus on here, trust me on this one…copy it to every system you use; server or desktop, and anything from Windows 7 to 2008 R2. Seriously, it’s a great tool that I use on every system, either by installing Dropbox and putting the cmdlinetools folder into my path, keeping it in my homedir, or just copying it to %windir% on every server I build.
The blip on the Microsoft site tells you that you can use the Error Code Lookup tool to determine error values from decimal and hexadecimal error codes in Microsoft Windows® operating systems. It goes on to mention that what you enter will be looked up in Exchange’s internal tables and presented to you, which when combined with the name of the tool, leaves a lot of folks thinking this is only for Exchange. It’s not.
Err will look up the provided code number against the headers of every Microsoft program installed, which makes it very useful for looking up errors on any system. But be careful there, you have to have the program installed to look up its errors; you won’t be able to look up Exchange’s error codes on your Windows 7 workstation. Even so, the core Windows operating system errors are fairly consistent across all platforms, so if you are trying to run down an operating system error, you will find err.exe to be very useful.
As for how to use it; if you haven’t got a copy already, download it from here, and run it. It will extract to a directory with three files. The Err.exe file is the only one you really need, but the EULA is there (make sure you agree to the terms) and the Error Code Lookup Tool.doc gives you just enough information to get started. Of course, this post will give you more! It’s a 32bit binary, but runs just fine on 64bit systems. Once the err.exe is copied to a directory in your path, like %windir%, open a cmd prompt and run the command
By itself, it will list all the header files that it can reference, then list the total number of return codes registered and from how many sources. Figure you will have almost 20K codes available. To use it with a code, just type the error code after the err command, like this.
err 0xc0000005 [enter]
You can enter error codes in several ways, including
- Decorated hex (0x54f)
- Implicit hex (54f)
- Ambiguous (1359)
- Exact string (=ERROR_INTERNAL_ERROR)
- Substring (:INTERNAL_ERROR)
While the command may return several different, and sometimes unrelated results, you will generally find that the output will help you narrow down the possible issues to check, or what to enter in your favourite search engine. When confronted by an error in a log or popup message, I usually check the hex code in err before I run Event Viewer. It’s my go to tool, and I usually get better results using it, which means shorter delays returning to service. And that’s a good thing.
What about you? What is your go to tool for troubleshooting errors?