Re: I'm stuck - Weird behaviour on multiple Server 2000 DC/member servers.
Further to this, Microsoft have advised:
"The issue you were seeing is caused when winsrv.dll goes into a state from
too much activity where it stops responding to csrss.exe. There are a
variety of different causes for this issue in Windows 2000, the good thing
is that all of the known causes are ressolved by updates included in SP4 and
the SP4 roll-up."
"Mike Bayly" <mbayly@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:ujhO2nhIGHA.648@xxxxxxxxxxxxxxxxxxxxxxx
> Hi all
>
> I have an interesting problem that occurred simultaneously on two domain
> controllers within my domain that I remotely manage with Terminal Services
> (admin mode). Both servers run Windows Server 2000 SP3 and have been
> running
> fine up until now. When attempting a remote desktop or terminal services
> client connection to either of these machines, an application popup
> appears
> on the server screen with title "csrss.exe - Unable to Locate DLL" and
> with
> the popup box showing "The dynamic link library winsrv could not be found
> in
> the specified path Default Load Path".
>
> I've checked the server environmant variables and "Path" includes
> "C:\WINNT\System32" and have also verified that
> C:\WINNT\System32\WINSRV.DLL
> exists.
>
> The only significant event for the domain was that a new Domain controller
> was installed 6 days ago - Windows Server 2000 SP4, with otherwise
> identical
> configuration to the other servers. In all there are 5 domain controllers
> in
> the domain, all separated by 16K CIR (128K access) frame relay links.
> There
> have been no other issues with the new server installed last week.
>
> I've exhausted support.microsoft.com and really have no idea what the
> problem could be, so any help or advice at all would be greatly
> appreciated.
>
> Thanks
>
> Mike
>
>
> Further to the above...
>
> I'm now getting all kinds of event log errors and warnings (see end of
> message).
> A third server (THLADL2) has started this behaviour - this server already
> has SP4 installed so Microsoft Support suggested I install Security Rollup
> 1
> for SP4 and some hotfixes, but when I attempt this, the server complains
> that "Setup cannot update a checked (debug) system with a free (retail)
> version of KB837585". This led the support guy to conclude that the wrong
> OS
> has been installed on this server - It's a Dell Poweredge 2550 with Server
> 2000 SP1 OEM from Dell. This happens on the one SP3 server I can access
> via
> VNC as well, which is a Dell Poweredge as well with Server 2000 OEM from
> Dell.
>
> Checking last night's backup (Veritas Backup Exec) I see these errors for
> THLADL2 with is an additional concern:
>
> Unable to attach to C:.
> Unable to attach to C:.
> Unable to attach to D:.
> Unable to attach to D:.
> Unable to attach to \\THLADL2\System?State.
> Unable to attach to \\THLADL2\System?State.
>
> On checking another remote domain controller (same setup, Server 2000 SP4,
> DC) I notice that there are the same Event Log messages: "The dynamic link
> library winsrv could not be found in the specified path Default Load
> Path".
> and "csrss.exe - Unable to Locate DLL" in 18th Jan. One of the other guys
> here had attempted to connect to that server and couldn't, so got a local
> user to perform a hard reboot on it. After that, the Application and
> System
> logs appear to have no reoccurences of these error messages.
>
> Another weird thing is that if I try to log in on the console with the
> administrator account, the box where you enter username, password and
> domain
> vanished for a split second, and then then "hit ctril alt delete" screen
> appears. I have to log in with a different account that has administrator
> rights which gives a "Path too long" error in a popup box. Also, if I
> check
> the Performance tab in Task Manager", the CPU activity is hovering around
> 50%, but on the Processes tab, all of the running processes show 0% CPU.
>
> I'm tempted to try and reboot one of the other servers to see if the
> problem
> just "goes away" given that I don't seem to be getting far with Microsoft
> Support, but because so far the users haven't really been impacted, I'd
> hate
> to reboot and have a server that wont boot back up. I'll see what MS have
> to
> say today (public holiday so might be lucky) and will check here for any
> further help here.
>
> Thanks
>
> Mike
>
>
> Event Type: Warning
> Event Source: SceCli
>
> Event Category: None
>
> Event ID: 1202
>
> Date: 25/01/2006
>
> Time: 7:51:52 PM
>
> User: N/A
>
> Computer: THLADL2
>
> Description:
>
> Security policies were propagated with warning. 0x4b8 : An extended error
> has occurred.
>
> For best results in resolving this event, log on with a non-administrative
> account and search http://support.microsoft.com for "Troubleshooting Event
> 1202s".
>
> -----
>
> Event Type: Warning
>
> Event Source: SpntLog
>
> Event Category: (4)
>
> Event ID: 222
>
> Date: 25/01/2006
>
> Time: 7:42:21 PM
>
> User: NT AUTHORITY\SYSTEM
>
> Computer: THLADL2
>
> Description:
>
> The description for Event ID ( 222 ) in Source ( SpntLog ) cannot be
> found.
> The local computer may not have the necessary registry information or
> message DLL files to display messages from a remote computer. You may be
> able to use the /AUXSOURCE= flag to retrieve this description; see Help
> and
> Support for details. The following information is part of the event:
> D:\Program Files\BackupExec\NT\ECM\bumodule.jar, 100.
>
> -----
>
> Event Type: Error
>
> Event Source: EventSystem
>
> Event Category: (3)
>
> Event ID: 4097
>
> Date: 25/01/2006
>
> Time: 7:36:33 PM
>
> User: N/A
>
> Computer: THLADL2
>
> Description:
>
> The description for Event ID ( 4097 ) in Source ( EventSystem ) cannot be
> found. The local computer may not have the necessary registry information
> or
> message DLL files to display messages from a remote computer. You may be
> able to use the /AUXSOURCE= flag to retrieve this description; see Help
> and
> Support for details. The following information is part of the event:
> .\eventsystem2.cpp, 329, 800705AA.
>
> -----
>
> Event Type: Error
>
> Event Source: Userenv
>
> Event Category: None
>
> Event ID: 1000
>
> Date: 25/01/2006
>
> Time: 7:36:32 PM
>
> User: NT AUTHORITY\SYSTEM
>
> Computer: THLADL2
>
> Description:
>
> Windows cannot create a temporary profile directory. Contact your network
> administrator.
>
> DETAIL - Insufficient system resources exist to complete the requested
> service.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> -----
>
> Event Type: Warning
>
> Event Source: SpntLog
>
> Event Category: (4)
>
> Event ID: 211
>
> Date: 25/01/2006
>
> Time: 7:26:07 PM
>
> User: NT AUTHORITY\SYSTEM
>
> Computer: THLADL2
>
> Description:
>
> The description for Event ID ( 211 ) in Source ( SpntLog ) cannot be
> found.
> The local computer may not have the necessary registry information or
> message DLL files to display messages from a remote computer. You may be
> able to use the /AUXSOURCE= flag to retrieve this description; see Help
> and
> Support for details. The following information is part of the event:
> F:\software\Symantec.Norton.Ghost.v9.0.Incl.Keygen-SSG.zip,
> nortonghost90p4.rar, 2.
>
> -----
>
> Event Type: Warning
>
> Event Source: MRxSmb
>
> Event Category: None
>
> Event ID: 3019
>
> Date: 25/01/2006
>
> Time: 7:19:51 PM
>
> User: N/A
>
> Computer: THLADL2
>
> Description:
>
> The redirector failed to determine the connection type.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> -----
>
> Event Type: Information
>
> Event Source: Application Popup
>
> Event Category: None
>
> Event ID: 26
>
> Date: 25/01/2006
>
> Time: 7:13:40 PM
>
> User: N/A
>
> Computer: THLADL2
>
> Description:
>
> Application popup: Explorer.EXE - Application Error : The instruction at
> "0x7831886a" referenced memory at "0x00000000". The memory could not be
> "read".
>
> Click on OK to terminate the program
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> -----
>
> Event Type: Information
>
> Event Source: Application Popup
>
> Event Category: None
>
> Event ID: 26
>
> Date: 25/01/2006
>
> Time: 7:13:03 PM
>
> User: N/A
>
> Computer: THLADL2
>
> Description:
>
> Application popup: File Error : Cannot find NETWORK.DRV
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> -----
>
> Event Type: Warning
>
> Event Source: Srv
>
> Event Category: None
>
> Event ID: 2022
>
> Date: 25/01/2006
>
> Time: 7:03:18 PM
>
> User: N/A
>
> Computer: THLADL2
>
> Description:
>
> The server was unable to find a free connection 9 times in the last 60
> seconds. This indicates a spike in network traffic. If this is happening
> frequently, you should consider increasing the minimum number of free
> connections to add headroom. To do that, modify the MinFreeConnections and
> MaxFreeConnections for the LanmanServer in the registry.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> -----
>
> Event Type: Information
>
> Event Source: Application Popup
>
> Event Category: None
>
> Event ID: 26
>
> Date: 25/01/2006
>
> Time: 6:57:34 PM
>
> User: N/A
>
> Computer: THLADL2
>
> Description:
>
> Application popup: csrss.exe - Unable To Locate DLL : The dynamic link
> library winsrv could not be found in the specified path Default Load Path.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
>
.
