Re: Odd semi-crash or hang

More details after reboot. Cannot find anything specific in logs, but there
are some odd entries earlier this morning, including a critical application

(at 6 am a status report is sent to admin. No entries until...)
Information,7/29/2005,8:47:25 AM,ESENT,General ,100,N/A,(SERVERNAME)
lsass (900) The database engine 5.02.3790.1830 started.
Information,7/29/2005,8:47:36 AM,dsrestor,None,1000,N/A,(SERVERNAME)
The DSRestore filter started successfully.
Error,7/29/2005,8:47:36 AM,dsrestor,None,1005,N/A,(SERVERNAME)
The DSRestore Filter failed to connect to local SAM server. Error returned
is <id:997>.

Now this error is mentioned at "If
you change the Administrator password 'after' the application of SBS 2003
SP1 [which includes Windows 2003 SP1] the Administrator password will no
longer sync automagically with the DSRM password and we are now like 'normal'
Windows Server in this behavior."
However I did *not* change the Administrator password after the application
of SBS2003 SP1. SP1 was applied several weeks ago.

Why did that database engine, out of the blue, suddenly "start" after a
number of days? The subsequent log entries show things starting, but the
system was half crashed as shown in my original message (below).

"CO-DBA-SC-EL" <dx6490@xxxxxxxxx> wrote in message
> SBS 2003 Standard, SP1, TrendMicro suite.
> The server is at another location. It is on a VPN provided by another
> device, so I have access to that network. I can ping the SBS box. From a
> workstation on the domain, I can browse the shared folders. But some time
> during the night the SBS stopped responding to web remote access (OWA,
> RWW). Trying to reach it through remote desktop, my local remote desktop
> window opens but just sits there with a black client area and no error
> message. This is new--last time I had a remote control session via Remote
> Desktop was last night, looking at logs.
> I won't be able to get over there until tonight, and they need their
> email, so I will have someone at the site just hit reset on the box. The
> box is running without keyboard or monitor, so I can't ask them to look at
> the screen to tell me what's going on. Hopefully the system will reboot
> into a working state.
> Question: Without the remote desktop, is there any way to figure out what
> is going on before rebooting? Since the file system seems to be running
> fine, maybe by logging in as the domain admin at another workstation and
> looking at the logs files? Has anyone else experienced a similar
> situation?


Relevant Pages

  • Remote desktop only works if someone is already logged in
    ... We have an XP SP2 machine that has remote desktop enabled from the MY PC ... We can remote into the box after someone logs in locally but ... if we reboot the box and no one is logged in, no one can remote desktop into ...
  • [SUMMARY] Sunfire v880 reboot
    ... are the responses to my post regarding: Sunfire v880 reboot ... I should have mentioned in my original post that this system has been ... take a look in the RSC buffer logs for whatever ... >if your ups has a glitch, you have a power event. ...
  • Re: Troubleshoot Failing Clients Internet Connection
    ... in the logs to indicate a problem. ... All services running except the DRAC card ... I just checked the CPU usage (3 hours after reboot). ... If you log into the server in the morning when there's no Internet access, ...
  • Re: Did i get hacked?
    ... You said you did not find anything in the logs, ... I have 3 other computers that did not reboot ... > I also have a cron job at 0:30 to move the apache logs to a tmp file ...
  • Re: Server Reboot
    ... Subject: Server Reboot ... >>-none of the standard logs show any intrusion or root log in attempt, ... I have owned this server since new, and this is the first time it has done this. ...