RE: Server 2003 hangs

bthompson_at_AboundSolutions.com
Date: 12/01/04 

Date: Wed, 1 Dec 2004 10:41:08 -0800

Are you auditing both "Account logon events" and "logon events" for success
and failure? The default is success only!

In reference to rebooting, is the DC the DNS server?

If you reboot, the problem goes away. Your likely you're having an issue
with this server.

Is IPSec service running? Turn it off for a while and see what happens. You
can turn on extensive logging on IPSec if necessary. Sounds like network
performance is not an issue. RPC availability may play a factor. Every hear
of RPCping? Try stopping and restarting the netlogon service: "net stop
netlogon" then "net start netlogon".

I'm not surprised that TS sessions run as expected!

I tracked down this real odd one last week. It had all symptoms. It was
intermittent. If I didn't sniff the traffic to the server, I would not have
found it! In a nutshell, FrontPage 2003 was attempting to reconnect to the DC
so frequently that it caused a serious issue accessing the server. What made
it even stranger, is that the FrontPage 2003 session never had a connection
with the DC, rather a web server. The problem turned out to be a DNS issue.
FrontPage did behave oddly, however, DNS was dropping off the network causing
the very irregular behavior. This is why I prefer to sniff the network.

I'll check in later with you. I'm not suggesting that you have this issue!
We just need to keep an open mind when intermittent run a muck.

Bill

"Graham J" wrote:

> Sorry but Miha does seem to be asking about things that I have already
> explained.
>
> However:
> Can you provide the following information:
> * what are main roles of the server (e.g. domain controller, .)
> * what other services are running on this server (e.g. exchange server, .)
> * are there any errors in Event logs (System and Application logs)
>
> It is a domain controller.
>
> Do you want a complete list of services - there are many tens! Primarily,
> file & print sharing. Exchange Server is NOT running. IIS is NOT running.
> (The server is doing virtually nothing!)
>
> Event logs report nothing - as already stated.
>
> Both servers - when problem is present - run dcdiag and netdiag - nothing
> untoward reported. Will try netstat when I am next at the site.
>
> Sometimes problem occurs when 30 to 50 students try to log in simultaneously
> - but at other times this number of students can log in without problem.
>
> Network switches show no error and traffic is minimal. System is hidden
> from Internet by proxy and routers to a larger private network within the
> education authority - not likely there is a DoS attack.
>
> Problem occured this morning. Server1 can browse server2 no problem. But,
> Server2 very slow (serveral minutes) to browse file system on Server 1.
> However, active terminal service client sessions to both servers run at full
> speed.
>
> Rebooting Server1 cured problem - which I suspect will now not recur for
> several days. Is this a clue?
>
> Can you suggest any logging I can switch on to capture more details?
>
> -- Graham
>
> "bthompson@AboundSolutions.com" wrote:
>
> > Hi Graham,
> >
> > The information that Miha is requesting is vital. There are so many likely
> > possibilities that could be causing this temporary slow down.
> >
> > Here are a few items to mull over. When the server is network dead/ console
> > alive have you tried running netstat? If so, does it complete? Are there any
> > irregularities? If it doesn't complete you could be experiencing a
> > denial-of-service attack or possibly some network issue that may appear to be
> > a denial-of-service attack in nature. If you can login, there is hope!
> >
> > Does this problem occur when there is a lot of activity? It is possible that
> > some security changes may have been made to your system such as limiting the
> > number of RPC sessions and the port assignments (common practice, but not
> > necessarily recommended by Microsoft). Of course IPSEC miss configurations
> > could also be a factor. Have you sniffed the network to see if there is
> > traffic to the machine or repeated attempts to communicate with the server?
> >
> > When this slowdown occurs take a look at your DNS server and make sure name
> > resolution is properly functioning. Try connecting via IP address rather than
> > by name.
> >
> > If you don't like the setup, remember you are working with a member server,
> > you have a domain, rebuild.
> >
> > If you need help sniffing/ interpreting the packets coming in/ out of your
> > server I'll be glad to help.
> >
> > If you've checked the event logs and there is nothing obvious, then you have
> > some sort of network issue.
> >
> > Good luck and feel free to contact me directly
> > Bill
> > bthompson@AboundSolutions.com
> > MCSE
> >
> >
> >
> > "Graham J" wrote:
> >
> > > Windows Server 2003 standard, installed by somebody else that my customer has
> > > lost confidence in. Therefore no documentation on how or why it is
> > > configured as it is.
> > >
> > > Symptom: system hangs for several minutes. Users cannot logon - see
> > > egg-timer. Users already logged on cannot browse server and open
> > > applications hang or fail.
> > >
> > > Can always log on at server console while system is hung. Task manager
> > > shows about 1% activity. Nothing in event log at time when hang occurs.
> > > Client workstations can ping the server during hang. Network switches report
> > > no errors.
> > >
> > > System recovers spontaneously after between 5 and 30 minutes. Can reboot -
> > > system recovers - but reboot takes about 10 minutes. System is in a school,
> > > so this sort of recovery is unacceptable.
> > >
> > > Any ideas?
> > >
> > >
> > >
> > >

Relevant Pages

  • Re: computer browser service wont start
    ... I've noticed that dnsApi is sometimes one of the things that starts early before everything it needs is actually working, e.g. the TCP/IP and network stack. ... In the situations I've seen the Event Log entry from dnsApi that you report, the computer did successfully register itself later. ... This assumes that the targetted DNS server can accept Dynamic registrations and the computer doing the dynamic registration is permitted to do so. ...
    (microsoft.public.windows.server.general)
  • Re: Fully parallel Scheme-based language w/ evaluator
    ... Windows Server 2003 and networks in simple - and irreverent - terms. ... If networking really is a big deal, ... Concepts and Terminology in Part I, and The Design and Deployment of Network ...
    (comp.lang.misc)
  • Re: Cant find Server in Network Neighborhood
    ... > Preferred DNS server: 66.250.49.2 ... This isn't your lan connection, ... > Connection information for the network adapter used to> connect to your local network: ...
    (microsoft.public.windows.server.sbs)
  • Re: Cant find Server in Network Neighborhood
    ... DHCP dishes out the correct WINS server and IP Info to clients as ... > Preferred DNS server: 66.250.49.2 ... > Connection information for the network adapter used to ... > Local network connection name: ...
    (microsoft.public.windows.server.sbs)
  • Re: The PC name ends up with DNS name appended.
    ... but the router gets configured by the ISP to be the DNS server ... If the resulting DNS name does not resolve, ... Wins Proxy in the network card properties. ...
    (microsoft.public.windowsxp.network_web)