RE: Server shutdown and restart itself...
- From: v-robeli@xxxxxxxxxxxxxxxxxxxx (Robert Li [MSFT])
- Date: Wed, 28 Feb 2007 04:17:23 GMT
Hi Gureey,
Thanks for posting in our newsgroup.
From your description, I know that your SBS Server shut down and restartunexpectedly. If I am off-base, please don¡¯t hesitate to let me know.
Please take the following steps to narrow down this issue:
Step 1: The problem may be caused by the Sasser worm variants. Please
update your Anti Virus Software to the latest signature and scan the
system.
For more information, please refer to:
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.worm.html
NOTE: This response contains a reference to a Third party World Wide Web
site. You should know that Third party sites are not under the control of
Microsoft. Accordingly, Microsoft can make no representation concerning
the content of these sites. Microsoft is providing this information only
as a convenience to you. This is to inform you that Microsoft has not
tested any software or information found on these sites and therefore
cannot make any representations regarding the quality, safety, or
suitability of any software or information found there. There are inherent
dangers in the use of any software found on the Internet, and Microsoft
cautions you to make sure that you completely understand the risk before
retrieving any software on the Internet.
Step 2: On a Microsoft Windows Server 2003-based domain controller, the
memory usage may continue to increase, and therefore, you may have to
periodically restart the server (the server should also reboot on itself -
this is what you have encountered). If you use System Monitor to view the
Local Security Authority Service (Lsass.exe) process, you see that the
memory usage for the Lsass.exe process continues to grow. (To monitor this
process, see the Process\Private Bytes and the Process\Virtual Bytes
performance counters.)
To resolve the issue, please contact Microsoft CSS to request the 829993
hot fix .
For more information, please refer to:
829993 Memory Leak Occurs in the Lsass.exe Process on a Windows Server
http://support.microsoft.com/?id=829993
Step 3: The problem may be caused by Symantec Enterprise Security Manager.
The SESM client may kill the LSASS.EXE process and make the system restart.
To resolve the problem, please upgrade the SESM client to version 6.2.
For more information, please refer to
http://www.symantec.com
An access violation occurs in Lsass.exe and event IDs 1015 and 1000 are
logged in the application log on a Windows Server 2003 domain controller
http://support.microsoft.com/default.aspx?scid=kb;en-us;818080
Your domain controller restarts unexpectedly, and the Application log
reports event ID 1015 and event ID 1000 in Windows Server 2003
http://support.microsoft.com/kb/886174/en-us
If the problem still exists, please help me collect MPS Report for further
research:
1. Download MPS report tool from:
http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd9
15706/MPSRPT_SETUPPerf.EXE
2. Run the MPSRPT_SETUPPerf.exe on the server box.
3. Wait for 10~15 minutes.
4. Open Windows explorer, navigate to
%SYSTEMROOT%\MPSReports\Setup\Reports\cab\
5. Send the .cab file to v-robeli@xxxxxxxxxxxxx with subject: 38092045-
Server shutdown and restart itself.
If you need further assistance, please don¡¯t hesitate to let me know.
Best regards,
Robert Li(MSFT)
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
<Thread-Topic: Server shutdown and restart itself...
<thread-index: AcdamazoA7VS38INS0KwhY7B7bIlSA==
<X-WBNR-Posting-Host: 207.46.198.15
<From: =?Utf-8?B?R3VyZWV5?= <Gureey@xxxxxxxxxxxxxxxxxxxxxxxxx>
<Subject: Server shutdown and restart itself...
<Date: Tue, 27 Feb 2007 10:04:08 -0800
<Lines: 26
<Message-ID: <22FD9F1C-708A-4299-829E-9DEB35621A0B@xxxxxxxxxxxxx>
<MIME-Version: 1.0
<Content-Type: text/plain;
< charset="Utf-8"
<Content-Transfer-Encoding: 7bit
<X-Newsreader: Microsoft CDO for Windows 2000
<Content-Class: urn:content-classes:message
<Importance: normal
<Priority: normal
<X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757
<Newsgroups: microsoft.public.windows.server.sbs
<Path: TK2MSFTNGHUB02.phx.gbl
<Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:19900
<NNTP-Posting-Host: tk2msftsbfm01.phx.gbl 10.40.244.148
<X-Tomcat-NG: microsoft.public.windows.server.sbs
<
<Hello Friends,
<
<we have server 2003 sbs as a domain controller. This server shutdown and
<restart unexpectedly with following two error message in event logs.
<
<Application popup: System Shutdown : The system is shutting down. Please
<save all work in progress and log off. Any unsaved changes will be lost.
<This shutdown was initiated by NT AUTHORITY\SYSTEM. Shutdown will begin
in
<48 seconds. Shutdown message: The system process
<'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code
<-1073741819. The system will now shut down and restart..
<
<
<
<The process winlogon.exe has initiated the restart of computer BLACK01 on
<behalf of user for the following reason: No title for this reason could
be
<found
< Reason Code: 0x50006
< Shutdown Type: restart
< Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated
<unexpectedly with status code -1073741819. The system will now shut down
and
<restart.
< Do you have any idea why this happen. Kindly help me..
<
<Regards
<G.
<
.
- Prev by Date: RE: VSS Warning Event 12290
- Next by Date: RE: Question about SBS_LOGIN_SCRIPT.bat
- Previous by thread: Re: Editing Batch Files
- Next by thread: Re: No DHCP?
- Index(es):
Relevant Pages
|
