Computers Stop Responding 5

[rocmills]

We have had an extremely unusual problem with our office computers for many years now, and no one has been able to help us track down the problem. About half of our computers are logged in to our server, and the other half only map to server directories but the users log into their workstations locally.

The server is running Windows 2000 Server edition and the various workstations are running XP Pro SP2 (we have one Vista laptop). These machines are all less than 2 years old as we had to replace everything after a break-in early in 2005 (what makes this problem especially strange is that it was present on the old hardware, too). We have a mixture of Dell Dimension machines as well as home-built machines.

Each and every day, without fail, at roughly 4:00 p.m., the computers - or the programs on them - stop responding. The network does not show any activity, Task Manager does not show any tasks consuming huge amounts of memory or CPU. But if you try to launch Word by opening an existing document, it just hangs and hangs for upwards of 10 minutes at a time. When it finally does respond, you might have two minutes to work before it hangs again. The same is true of Outlook, Excel, PhotoShop, QuickBooks, AutoCAD, browsers, Explorer, and on.

I was certain that when we replaced EVERYTHING in 2005, that the problem would go away, but it didn't. Even our server was stolen, though all the data was on back up and we restored the data to our new machine.

What could be causing such a consistent and widespread problem? This has gone one for a good 5 years, if not more, so I'm willing to test out just about anything.

Thanks for listening!

--Roc

 

[normntwrk]

sounds like a network issue of some sort , perhaps a switch is overheating and resets itself.

The no DNS servers are available message may be a hint (DNS issues with AD can cause lots of trouble)

 

[rocmills]

Linney,

The event messages are different this time around. Previously, I was getting "warnings", now I am getting "error" message 15 followed by multiple instances of 1001 and 1002.

15 seems to be the important one, the one that is triggering the others:

Event Type: Error
Event Source: AutoEnrollment
Event Category: None
Event ID: 15
Date: 8/20/2008
Time: 3:49:53 PM
User: N/A
Computer: FRONTDESK
Description: Automatic certificate enrollment for local system failed to contact the active directory (0x8007054b). The specified domain either does not exist or could not be contacted.
Enrollment will not be performed.
then
Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 8/20/2008
Time: 5:14:54 PM
Description: Hanging application WINWORD.EXE, version 11.0.8227.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
then
Event Type: Error
Event Source: Application Hang
Event Category: None
Event ID: 1001
Date: 8/20/2008
Time: 5:15:09 PM
Description: Fault bucket 874870878.

Again/still it seems to be a matter of connecting with the server/domain. The applications hang because I am trying to access and/or use documents/files which reside on the server.

Why doesn't the stupid thing enroll in the morning and stay enrolled until I shut down? <rhetorical question>

I'll have a shot at process monitor and the other things you suggested when it starts happening this evening. The only thing that task manager shows is, for the applications, NOT RESPONDING, and under the Performance tab there is minimal CPU and Page File usage.

--Roc

 

[linney]

Is it a symptom, or the cause, or an outcome of the last round of attempted fixes, I wish I knew so I could be more helpful. Did you ever try the Server Forums?

HELP with 0x8007054b error Autoenrollment problem!
thread779-1372573

Problems occur when the Autoenrollment feature cannot reach an Active Directory domain controller

http://support.microsoft.com/kb/310461#appliesto

My link in post 15 Aug 08 17:11 talks about AutoEnrollment and general DNS problems.

How to force Kerberos to use TCP instead of UDP in Windows Server 2003, in Windows XP, and in Windows 2000

http://support.microsoft.com/kb/244474

The Auto-Enrollment Objects Do Not Work When a Certification Authority Certificate Is Renewed

http://support.microsoft.com/kb/270048

Clients Cannot Authenticate with a Server After You Obtain a New Certificate to Replace an Expired Certificate on the Server

http://support.microsoft.com/kb/822406

http://www.eventid.net/display.asp?eventid=15&eventno=1397&source=AutoEnrollment&phase=1

 

[rocmills]

Linney,

No, I haven't gotten around to trying the server forums, sorry. Should I repost everything or just the first message with a reference to this thread?

I tried running the process monitor (holy cow, talk about too much information!). What I think I see happening is this:

First a "buffer overflow" on our Gigabit adapter (ga311.exe), followed by "range not locked" also for ga311.exe and then "name not found" for winlogon.exe (the name not found seems to be referencing a registry entry, if i understand the process monitor correctly).

These three items keep repeating (with tons of other stuff in between). So could it be that our adapter is failing? Or does the buffer overflow indicate a memory issue?

Please don't think I am ignoring all the links you've posted, I'm not - it's just that much, if not most, of that stuff is over my head. I can geek a desktop, but servers make me cringe. I'm only in charge of our little network by default because no one else here knows even the tiniest thing about computers (except how to break them and run AutoCAD).

I'll go ahead and post to the server forum this weekend from home, but unless someone there has a miracle answer they can put in layman's terms, I think I am just going to tell the boss that we need to bring in a professional.

--Roc

 

[rocmills]

One more thing I want to add...

This is definitely a network connectivity issue. Yesterday, during the time when everything else was locked and not responding, I was able to start a locally installed program and access local documents without issue while Word, Excel, and AutoCAD were all locked while accessing/working on server-based documents/files.

--Roc

 

[linney]

If you post in the Server Forum, just link that thread to Computers Stop Responding
thread779-1494275

If you solve it elsewhere, let this forum know the result wont you?

I like your idea about the Gigabit adapter, do funds allow for a replacement of that, even if it is only a suspicion? But why does it cause your problem at the same time each day?

I read this about buffer overflows.

"A buffer is something used when programming to hold information. Say you set aside a buffer of 10 chars but the return value may return over 10 chars then this will cause a
buffer overflow"

If that comment can be attributed to anything to do with the Gigabit software, maybe all you need is a later updated driver for the Network Card?


Somethings to look at.

Connect to the network and computer slows down.
thread779-1481432

High rate of collisions on 100-megabit networks

http://support.microsoft.com/default.aspx?scid=kb;en-us;315237&FR=1&PA=1&SD=HSCH

High Rate of Collisions on 100-Megabit Networks

http://support.microsoft.com/default.aspx?scid=kb;en-us;169789&FR=1&PA=1&SD=HSCH

Network drive and large files (1+ Gig) won`t transfer
thread779-829641

WinXP Connectivity Issues
Slow Logon to Windows 2000 Domains
faq779-4017

WinXP Connectivity Issues
faq779-4625

 

[Trevoke]

Are you the only ones in the building? Is there a medical building with a poorly-secured MRI magnet in the area?
Is anyone running something that could be disturbing the whole building, like an airplane.. ? I'm only half-joking, of course.

Tao Te Ching Discussions : Chapter 9 (includes links to previous chapters)
What is the nature of conflict?

 

[mscallisto]

Good progress; I suggested you do that back on the 16th.

There were many good posts on this thread and if you keep eliminating all the things on each post one at a time you should find your solution.

I hope you are able to figure this out without bringing in a professional.

Good Luck

sam

 

[jujet84]

came across this suggestion
If this error occurs exactly every hour (not on top of the house but just repeats itself in 60 minutes interval) then here is what I found. I had DHCP server running on a member server in NT4 environment and the DHCP server had a check mark under the server properties that enables dynamic DNS registration. Since this was NT4 environment based on WINS the DHCP server will fail to register any dynamic DNS records derived from the IP leases that it assigns. Disabling the dynamic DNS updates in the DHCP server properties caused the error to no longer occur. The server is WIn2003, member of NT4 domain and the DNS address values were those of the ISP.

 

[rocmills]

Sam,

It's not a lack of reading the threads and clicking the links and reading the information there... I really don't understand a lot of it, I am just not a network knowledgeable person and most of the stuff I'm reading is over my head. I might understand 25-75% of what I read, but there is always a wee bit that just leaves me scratching my head. And while I'm willing to experiment, if I just don't know what an X is, or where the Y is set... I'm dead in the water.

--Roc

 

[OsakaWebbie]

I'm quite a server novice myself, and therefore probably shouldn't weigh in, but reading the thread and detecting patterns, I just want to say that it sounds like a straw-on-camel's-back sort of thing, perhaps a buffer overflow somewhere, as Linney mentioned. When you come in in the morning after a night of computer inactivity, it's fine, and then after several hours of activity it starts to fail. The time of failure was very consistent until recently, when you were working hard on troubleshooting, and perhaps in the process you were running less things (or more things), or restarting something more often, etc. To me that sounds like something that is building up, but only shows symptoms when it hits a certain level. Just a thought - sorry that I can't suggest any specific areas of the server operation where that might happen.

I sure hope you find your answer - I can't imagine how hard it must be for everyone to try to work in that environment; I suspect aspirin is very popular in the late afternoon!

 

[rocmills]

jujet84, I will look into that first thing on Monday.

Osaka, yes, I think you're right about that.

I think the autoenrollment call by the workstation is resulting in the winlogon error on the server, which then cascades into everything else. Maybe.

--Roc

 

[rocmills]

jujet84,

I've looked at my DHCP properties and do not find any check box for dynamic DNS. I accessed DHCP via Services, right-click properties. Is there somewhere else I should be checking for this?

--Roc

 

[linney]

From time to time we get strange posts like this that seem to be unsolvable. Businesses sometimes replace old and failing Servers with updated models. Is this something worth considering? What prompted me to ask this question is the fact that the Server at Tek-Tips has just been replaced after the old one started to die.

 

[rocmills]

Linney,

Oh, come on, that's the easy way out! LOL

If this server were a bit older, I'd go to the new boss with that suggestion. Maybe a compromise would be to upgrade to a newer OS. We are actually in transition at the moment... the company we have been for 15 years is shutting down (the owner moved to China) and a new company is being formed to take its place. Perhaps once the new company is on its feet, they might consider a new server.

Just this weekend, I was wondering... since all of our working files are on a separate hard drive from the OS, would dropping Windows and going to a Linux server be possible? I can't see why not, except that currently we all get our internet connection through the server, and I know even less about Linux than I do about server operations.

--Roc

 

[mscallisto]

The first rule of holes:

"Once you find yourself in one, stop digging"!

I would tough out this problem before maybe starting another with something you admit to knowing less about (linux).

But that's just my opinion.

Anyway I wish you luck.

sam

 

[rocmills]

Sam,

Thanks, that was just me wondering out loud - I wouldn't actually do that unless a professional was responsible for the whole thing. I can barely get Ubuntu to run for me at home, I'm certainly not ready to do anything so drastic to our office computer.

Back to the OP, however... I have come to realize that this problem is no longer happening each and every day (it did not happen yesterday, for example) and am keeping a log of when it does and doesn't occur. I am printing events logs and the process monitor information for server and workstation. I don't expect to be able to fix this myself, but maybe the information will help the technie who comes in to repair when the boss finally gets sick of the slow downs.

--Roc

 

[rocmills]

Say... if this is a serious consideration:

Is anyone running something that could be disturbing the whole building, like an airplane.. ?

Then maybe that is the issue... at both our old location and our new location, when we had the old computers and the new computers... we are near the flight path for McCarran International Airport, we are just a stone's throw from the Vegas Strip, we are directly across from active railroad tracks, and we are only a block or two away from a major medical/hospital complex. Could it be environmental after all, or am I just grasping at silly straws now?

(btw, i finally remembered to post to the server forum)

--Roc

 

[rocmills]

Strangely enough, the problem did not occur this past Monday or Tuesday and on both days the server was rebooted mid-day as were the workstations. Also, when I tried to update the driver for the Netgear Gigabit card (ga311.exe), the update closed half-way through - it uninstalled the old software without installing the update. (instructions indicated i would have to shut down the server and remove the card, then install updated driver and reinstall the card) So maybe the gigabit driver was partially responsible?

Copied above from new thread in server forum:

http://www.tek-tips.com/viewthread.cfm?qid=1496591&page=1

--Roc

 

[mscallisto]

Is anyone running something that could be disturbing the whole building, like an airplane.. ?

I've never heard of anything like that causing interference but who knows maybe Global Warming? lol

It seems that if anything like above were causing your problem then it would most likely do the same for nearby companies and someone would have caught it by now.

keep plugging!

sam