Re: Windows File Protection

Yes, I do have C:\windows\ServicePackFiles\ServicePackCache\I386..

So, This means that SFC cannot find what it needs at that location, so it
prompts me for the CD. Apperantly the CD has no SP's, thus alerting me that
the wrong CD is in the drive.

SFC should had been able to find what it is looking for in the I386 folder.

are you suggesting that i should reinstall SP2 ?

From the link you provided:

"you can copy this directory to
CD(C:\windows\ServicePackFiles\ServicePackCache\I386). Then edit the
registry to point
to the new location on CD. Edit this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup


Modify the value:
ServicePackSourcePath


to reflect the CD drive such as:
Z:\ServicePackFiles where Z is the drive letter for the CD drive."

I will need to acquire a non-corrupt or an updated I386 folder(perhaps from
sp2 or download it if possible) then perform the above...

Am I on the right track?

Thanks Merv, you are very helpful and I appreciate your prompt responses.

"Merv Porter [SBS-MVP]" wrote:

/3GB... yes, you should be able to disable it without any issues.

SFC... Do you have a folder: C:\windows\ServicePackFiles?

This should contain a 'ServicePackCache' folder with an 'i386' folder in it.
These should be used by SFC to preclude the need for prompting you for a CD
Z(unless they are missing or there is some corruption)

Safe to erase 'Service Pack Files' directory
http://groups.google.com/group/microsoft.public.windowsxp.general/browse_thread/thread/5cb8fb2e649775ca/3f601cfc76a0f67e?hl=en&lnk=st&q=move+service+pack+files#3f601cfc76a0f67e


--
Merv Porter [SBS-MVP]
============================


"Chris" <Chris@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:B3D31AD8-A089-4888-B054-9E02D5B038BC@xxxxxxxxxxxxxxxx
Merv,

I does not give me an option to select a location. In a nut shell, It only
asks me to insert the SBS 2003 cd. Then Hit ok, with a cancel option as
well.
Then when the server suggests i have the wrong CD, my only other options
are
to Cancel, Retry or more INFO.

Under more info, it says possible causes are the CD is wrong or the CD
drivers dont work.

The OS was installed using The original Install CD for SBS 2003 and
contained no SP's. Now each SP's (SP1 AND SP2) were downloaded via the
windows Update.


3GB SWITCH: Can i safely disable this without worrying my system will
crash
since it has been operating with the 3GB switch enabled all this time?

By the way, When we upgrade to SBS 2008, we will also be upgrading to new
hardware, that is a brand new System is being purchased, we are inclined
towards a Dell Poweredge T610. This also means we will probably salvage
the
old server hardware(not sure yet on this one).

Thank you,

Chris


"Merv Porter [SBS-MVP]" wrote:

You should 'very soon' address the issues presented in your SBS BPA
report.
It appears that the server has not be kept up-to-date with some of the
update packages. You need to get your server healthy and with the latest
SPs and security patches before you can attempt a migration to SBS 2008.

I'm curious why the "/3GB" switch was used as this may indicate that the
server was set up by someone who has a certain amount of knowledge of
Exchange and Windows Server but may not be up-to-date with the
intricacies
of SBS.

The problem with the "wrong CD' message may be because the original
install
of SBS was with non-Windows 2003 SP1 or SP2 media and your current
configuration is Win2003 SP1 or SP2. Therefore, when you insert the old
SBS
CD, Windows 2003 SP1 or SP2 cannot find the correct files to restore.

You may be able to download Windows 2003 SP1 or SP2, unzip it to a folder
on
your server (or to an external USB drive) and then direct Windows to that
location when it asks you about restoring the file.


--
Merv Porter [SBS-MVP]
============================

"Chris" <Chris@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:CF81C36F-2F97-4911-8CBE-BC0807AB4008@xxxxxxxxxxxxxxxx
Hi Merv...

As we go through this i am starting to feel more comfortable and
somewhat
relieved!!

Well, I just ran the BPA you suggested and here is the report:

All Issues

Error ClientApps share missing :
ClientApps shared folder is missing for Windows SBS 2003. You may have
stopped sharing of this folder. For instructions on sharing the
ClientApps
folder, see http://go.microsoft.com/fwlink/?LinkId=95294.

Error Task Offloading is enabled :
Task Offloading is enabled and should be disabled on Windows Small
Business
Server 2003. Change the value of the DisableTaskOffload registry key to
1.
For detailed instructions, see the Knowledge Base article "You
experience
intermittent communication failure between computers that are running
Windows
XP or Windows Server 2003" at
http://go.microsoft.com/fwlink/?LinkId=95149.
If the DisableTaskOffload registry key does not exist, then manually
create
this registry key and set its value to 1.

Error The /3GB switch is not supported on Windows SBS 2003 :
Windows SBS 2003 does not support the use of the /3GB boot.ini option.
For
more information, see "The Windows Server 2003 /3GB switch is not
supported
in Windows SharePoint Services 2.0 or in later versions or in
SharePoint
Portal Server 2003 SP2 or in later versions" at
http://go.microsoft.com/fwlink/?LinkId=95155.

Warning Free disk space is very low :
C: has 15% free space remaining (less than 20% of free space
available).
You
should consider adding more storage or removing unnecessary files. For
information on moving data folders, see "Moving Data Folders for
Windows
SBS
2003" at http://go.microsoft.com/fwlink/?linkid=49931.

Warning Network interface driver file is more than one year old :
Network Card Driver: E1000 Last Modifed Date: 20041008153444.000000-420

Warning Allocated Memory alert threshold :
The threshold for the Allocated Memory alert is set to the default
value.
However the server has more than 2 GB of RAM installed.

Warning Change the functional level of Exchange Server 2003 :
The functional level of your Exchange Server 2003 organization is:
Mixed
Mode (can support pre-Exchange 2000 servers). This must be changed to
native
mode before attempting to migrate to Windows Small Business Server
2008.
Go
to Start/All Programs/Microsoft Exchange/System Manager then right
click
on
the organization and select Properties

Warning EDNS is enabled :
EDNS is enabled on this server. Some of the routers or firewalls may
not
support EDNS. You should disable EDNS on this server. To do so, click
Start,
and then click Command Prompt. In the Command Prompt window, type
dnscmd
/Config /EnableEdnsProbes 0 and then restart the DNS Server service.

Warning Microsoft Outlook 2003 missing :
Outlook 2003 should exist in the ClientApps folder. To do so, from the
server, click Start, click Control Panel, click Change or Remove
Programs,
then click Windows Small Business Server 2003. On the component
selection
page, select Microsoft Outlook 2003.

Warning OWA update for Exchange Server is not installed :
You should install the Update for Exchange 2003 (KB911829). Doing so
will
ensure that your Outlook Web Access installation is compatible with
Windows
Vista. For more information, see the Knowledge Base article "You
receive
an
error message when you try to perform any editing tasks, or you must
click
to
enable the compose frame in Outlook Web Access" at
http://go.microsoft.com/fwlink/?LinkId=77013.

Warning POP3 Connector snap-in has not been updated :
POP3 Connector snap-in does not appear to be the version from knowledge
base
article "Error message when you use the POP3 Connector Manager with MMC
3.0:
"'MMC has detected an error in a snap-in" " at
http://go.microsoft.com/fwlink/?LinkId=95161.

Warning The server is in a journal wrap condition :
The server is in a journal wrap condition. For more information, see
the
Knowledge Base article "Troubleshooting journal_wrap errors on Sysvol
and
DFS
replica sets" at http://go.microsoft.com/fwlink/?LinkId=143372.

Warning Update for Daylight Savings Time 2007 not installed :
The update for Daylight Savings Time 2007 is not installed for
Microsoft
Exchange Server 2003 Service Pack 2. Without this update, calendar
items
in
CDO-based programs and in Microsoft Outlook Web Access will operate as
if
the
standard time is in effect during the extra weeks of daylight saving
time.
You can download this update at
http://go.microsoft.com/fwlink/?LinkId=95430.

Warning Windows SBS 2003 is not compatible with Vista/Outlook 2007 :
You should install the "Update for Windows Small Business Server 2003:
Windows Vista and Outlook 2007 compatibility" at the Microsoft Web site
(http://go.microsoft.com/fwlink/?linkid=78010).

I am unsure if any of these errors/warning are connected with my
issue..Very
Informative tool though, thank you!

Yes, all 14 events state that on 5/27/09 were returned to their
original
state. However, this is not the case for the later date on 6/5/09...The
events state that the action was canceled by me and they didnt return
to
their originl state. I had to cancel because it kept saying i entered
the
wrong CD...there were over 60 instances of these cancelations.

I believe i will have a chance to restart the server tonight, when all
employees are gone. They rely on internet connection and the server
acts
as a
DHCP for them. Hopefully a full retart will correct this!

Once again THANK YOU. :)

Chris
"Merv Porter [SBS-MVP]" wrote:

Hi Chris,

If all 14 events say that they were returned to their original files,
I
suspect if you reboot the server the WFP prompts may stop. It looks
like
the affected files were all DLLs which the system could restore using
its
hidden 'dllcache' folder. Clearly though, something or someone was
trying
to install new software on your server. I suppose it could be an
'autoupdate' from one of your 3rd party apps on the server (antivirus,
line-of-business, etc.). I would reboot, then run the Mawarebytes
scan
just
to be safe.

--
Merv Porter [SBS-MVP]
============================
"Chris" <Chris@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:7347736D-7583-45E1-957D-5E8F727C85EC@xxxxxxxxxxxxxxxx
Yes typo, it is SP2 and we will be going to SBS 2008!

I ran SFC yesterday without going into safe mode, we are having some
special
events right now and we need full availability to the Server and
cant
afford
to shut it down just yet!

SFC kept on prompting me every few minutes to pop in the CD as it
was
progressing. I can see this activity clealy in the System EVENT log.

The earliest WFP entry was made on 5/27/09:

"File replacement was attempted on the protected system file
msftedit.dll.
This file was restored to the original version to maintain system
stability.
The file version of the bad file is 5.41.21.2507, the version of the
system
file is 5.41.21.2506."

There are 14 entries on the same date(5/27/09) and all the dll files
are
different and all have been replaced to their originals, the above
is
just
the first entry only).

on 6/5/09 the System Events logged WFP again. This time:

.

Relevant Pages

  • SecurityFocus Microsoft Newsletter #154
    ... MICROSOFT VULNERABILITY SUMMARY ... ISS RealSecure Server Sensor SSL Denial Of Service Vulnerabi... ... Roger Wilco Remote Server Side Buffer Overrun Vulnerability ... available for Microsoft Windows operating systems. ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter #49
    ... Subject: SecurityFocus Microsoft Newsletter #49 ... Microsoft Windows NNTP Denial of Service Vulnerability ... Microsoft IIS SSI Buffer Overrun Privelege Elevation Vulnerability ... Microsoft ISA Server H.323 Memory Leak Denial of Service... ...
    (Focus-Microsoft)
  • [NT] Merak Webmail Server Multiple Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Webmail Server has been found to contain multiple vulnerabilities ranging ... Warning: reset: Passed variable is not an array or object in C:\Archivos ... Warning: mktime: Windows does not support negative values for this ...
    (Securiteam)
  • Re: Windows File Protection
    ... now i have to monitor the server to see how ... reinstalling Windows 2003 SP2 may be the answer if it asks for the CD ... Do you have a folder: C:\windows\ServicePackFiles? ... Warning Network interface driver file is more than one year old: ...
    (microsoft.public.windows.server.sbs)
  • Re: ftp problem
    ... takes me straight into the web server. ... Can I clear what Windows has remembered so I get the ... Have you tried logging in from a command prompt? ... May at least prove if the username/password are ok and you can connect, ...
    (uk.people.silversurfers)
Loading