Re: Odd semi-crash or hang

More details after reboot. Cannot find anything specific in logs, but there
are some odd entries earlier this morning, including a critical application

(at 6 am a status report is sent to admin. No entries until...)
Information,7/29/2005,8:47:25 AM,ESENT,General ,100,N/A,(SERVERNAME)
lsass (900) The database engine 5.02.3790.1830 started.
Information,7/29/2005,8:47:36 AM,dsrestor,None,1000,N/A,(SERVERNAME)
The DSRestore filter started successfully.
Error,7/29/2005,8:47:36 AM,dsrestor,None,1005,N/A,(SERVERNAME)
The DSRestore Filter failed to connect to local SAM server. Error returned
is <id:997>.

Now this error is mentioned at "If
you change the Administrator password 'after' the application of SBS 2003
SP1 [which includes Windows 2003 SP1] the Administrator password will no
longer sync automagically with the DSRM password and we are now like 'normal'
Windows Server in this behavior."
However I did *not* change the Administrator password after the application
of SBS2003 SP1. SP1 was applied several weeks ago.

Why did that database engine, out of the blue, suddenly "start" after a
number of days? The subsequent log entries show things starting, but the
system was half crashed as shown in my original message (below).

"CO-DBA-SC-EL" <dx6490@xxxxxxxxx> wrote in message
> SBS 2003 Standard, SP1, TrendMicro suite.
> The server is at another location. It is on a VPN provided by another
> device, so I have access to that network. I can ping the SBS box. From a
> workstation on the domain, I can browse the shared folders. But some time
> during the night the SBS stopped responding to web remote access (OWA,
> RWW). Trying to reach it through remote desktop, my local remote desktop
> window opens but just sits there with a black client area and no error
> message. This is new--last time I had a remote control session via Remote
> Desktop was last night, looking at logs.
> I won't be able to get over there until tonight, and they need their
> email, so I will have someone at the site just hit reset on the box. The
> box is running without keyboard or monitor, so I can't ask them to look at
> the screen to tell me what's going on. Hopefully the system will reboot
> into a working state.
> Question: Without the remote desktop, is there any way to figure out what
> is going on before rebooting? Since the file system seems to be running
> fine, maybe by logging in as the domain admin at another workstation and
> looking at the logs files? Has anyone else experienced a similar
> situation?