Re: Automatic shutdowns every 1 1/2 hours.

Tech-Archive recommends: Fix windows errors by optimizing your registry

Thanks much for responding to this! System has been working without incident
for a couple years, and had been installed through the 3 dvds. Hardware all
seems OK...cool, fans working, reseated memory, checked drives and RAID.
Following are event messages following log clear: Note especially the one
just at the point the shutdown warning was sent -- which refers to License
Logging Service. There are several references to "Access denied" messages
directed to the Administrator.

New errors shown after restart:

Event Type: Error
Event Source: NtFrs
Event Category: None
Event ID: 13555
Date: 1/17/2008
Time: 11:50:37 AM
User: N/A
Computer: BFI-SERVER
Description:
The File Replication Service is in an error state. Files will not replicate
to or from one or all of the replica sets on this computer until the
following recovery steps are performed:

Recovery Steps:

[1] The error state may clear itself if you stop and restart the FRS
service. This can be done by performing the following in a command window:

net stop ntfrs
net start ntfrs

If this fails to clear up the problem then proceed as follows.

[2] For Active Directory Domain Controllers that DO NOT host any DFS
alternates or other replica sets with replication enabled:

If there is at least one other Domain Controller in this domain then restore
the "system state" of this DC from backup (using ntbackup or other
backup-restore utility) and make it non-authoritative.

If there are NO other Domain Controllers in this domain then restore the
"system state" of this DC from backup (using ntbackup or other backup-restore
utility) and choose the Advanced option which marks the sysvols as primary.

If there are other Domain Controllers in this domain but ALL of them have
this event log message then restore one of them as primary (data files from
primary will replicate everywhere) and the others as non-authoritative.


[3] For Active Directory Domain Controllers that host DFS alternates or
other replica sets with replication enabled:

(3-a) If the Dfs alternates on this DC do not have any other replication
partners then copy the data under that Dfs share to a safe location.
(3-b) If this server is the only Active Directory Domain Controller for
this domain then, before going to (3-c), make sure this server does not have
any inbound or outbound connections to other servers that were formerly
Domain Controllers for this domain but are now off the net (and will never be
coming back online) or have been fresh installed without being demoted. To
delete connections use the Sites and Services snapin and look for
Sites->NAME_OF_SITE->Servers->NAME_OF_SERVER->NTDS Settings->CONNECTIONS.
(3-c) Restore the "system state" of this DC from backup (using ntbackup or
other backup-restore utility) and make it non-authoritative.
(3-d) Copy the data from step (3-a) above to the original location after
the sysvol share is published.


[4] For other Windows servers:

(4-a) If any of the DFS alternates or other replica sets hosted by this
server do not have any other replication partners then copy the data under
its share or replica tree root to a safe location.
(4-b) net stop ntfrs
(4-c) rd /s /q c:\windows\ntfrs\jet
(4-d) net start ntfrs
(4-e) Copy the data from step (4-a) above to the original location after
the service has initialized (5 minutes is a safe waiting time).

Note: If this error message is in the eventlog of all the members of a
particular replica set then perform steps (4-a) and (4-e) above on only one
of the members.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: MSExchangeSA
Event Category: Monitoring
Event ID: 9099
Date: 1/17/2008
Time: 11:50:31 AM
User: N/A
Computer: BFI-SERVER
Description:
The MAD Monitoring thread was unable to read the state of the services,
error '0x80070005'.

For more information, click http://www.microsoft.com/contentredirect.asp.


Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1058
Date: 1/17/2008
Time: 12:00:29 PM
User: NT AUTHORITY\SYSTEM
Computer: BFI-SERVER
Description:
Windows cannot access the file gpt.ini for GPO
CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=BFI,DC=local.
The file must be present at the location
<\\BFI.local\sysvol\BFI.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>.
(The network path was not found. ). Group Policy processing aborted.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date: 1/17/2008
Time: 12:00:29 PM
User: NT AUTHORITY\SYSTEM
Computer: BFI-SERVER
Description:
Windows cannot query for the list of Group Policy objects. Check the event
log for possible messages previously logged by the policy engine that
describes the reason for this.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10000
Date: 1/17/2008
Time: 12:14:17 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: BFI-SERVER
Description:
Unable to start a DCOM Server: {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}. The
error:
"Access is denied. "
Happened while starting this command:
C:\WINDOWS\system32\wbem\wmiprvse.exe -Embedding

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: NtFrs
Event Category: None
Event ID: 13552
Date: 1/17/2008
Time: 11:50:37 AM
User: N/A
Computer: BFI-SERVER
Description:
The File Replication Service is unable to add this computer to the following
replica set:
"DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"

This could be caused by a number of problems such as:
-- an invalid root path,
-- a missing directory,
-- a missing disk volume,
-- a file system on the volume that does not support NTFS 5.0

The information below may help to resolve the problem:
Computer DNS name is "bfi-server.BFI.local"
Replica set member name is "BFI-SERVER"
Replica set root path is "c:\windows\sysvol\domain"
Replica staging directory path is "c:\windows\sysvol\staging\domain"
Replica working directory path is "c:\windows\ntfrs\jet"
Windows error status code is
FRS error status code is FrsErrorMismatchedJournalId

Other event log messages may also help determine the problem. Correct the
problem and the service will attempt to restart replication automatically at
a later time.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Errors just preceding latest shut-down warning:

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10000
Date: 1/17/2008
Time: 12:02:59 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: BFI-SERVER
Description:
Unable to start a DCOM Server: {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}. The
error:
"Access is denied. "
Happened while starting this command:
C:\WINDOWS\system32\wbem\wmiprvse.exe -Embedding

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: SBCore
Event Category: None
Event ID: 1006
Date: 1/17/2008
Time: 12:03:01 PM
User: N/A
Computer: BFI-SERVER
Description:
The License Logging service could not be restarted. The server will be shut
down in 60 minutes if the service is not restarted.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1500
Date: 1/17/2008
Time: 12:03:01 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: BFI-SERVER
Description:
Windows cannot log you on because your profile cannot be loaded. Check that
you are connected to the network, or that your network is functioning
correctly. If this problem persists, contact your network administrator.

DETAIL - Access is denied.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 1/17/2008
Time: 12:03:04 PM
User: N/A
Computer: BFI-SERVER
Description:
The Volume Shadow Copy service entered the stopped state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.




"Larry Struckmeyer" wrote:

I assume that this server was installed to finality, not stopped at the end
of the first CD?

Exactly on a schedule is atypical of a functioning Windows server. Can you
confirm that all the cooling fans are working? Do you have another UPS to
try, or a really good surge protector for a short test?

What are the event id number of the DCOM errors, and the context of the
attached message. You can click the little button under the arrows and
paste the message into your reply, even if you have to first save it to word
pad.

While the bulk of the errors may be DCOM, there may be others that are more
indicative. You can clear the logs and restart manually to see what errors
you get on restart, and you can clear the logs at 1:25 hours after the last
restart to see if there are any just before the next one.

If you get any, please post the event id and the source.

--
Larry


"Joannebc" <Joannebc@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:4C05C6CD-6549-4D2C-B0C1-C03C89404BD1@xxxxxxxxxxxxxxxx
For 4 days our SBS has been performing automatic shutdowns every 1 1/2
hours.
When rebooting, we are told that a service or driver failed at system
startup. The bulk of the errors on the error log (70000 of them) refer to
a
DCOM error. There are also a few Windows update agent and NT service pack
errors. This started when the machine was accicently turned off when the
power conditioner was beeping. The person who rebooted said that there
was a
message about changing some security settings, followed by a long list of
items whose settings were being changed, seemingly. We have seen no
similar
issues. Any ideas? Thank you so much



.

Quantcast