Installed SP4 on production server (IBM eServer 220). After installation of SP4 over SP2, I had two problems. First, workstations couldn't log on, but I could log on over VPN directly to Server. Second, many errors with NTFRS claiming that root moved.
Turned out that, for some reason, the share on SYSVOL was removed. Changing a registry setting from a 0 to a 1 corrected this issue. For NTFRS issue, I had to make the dummy text file named NTFRS_CMD_FILE_MOVE_ROOT in the folder identified in one of the event descriptions. NTFRS found the "new" location and restored itself successfully. No other issues observed at this time.
I am wondering about the sudden run of "bad" packet events coming from one of our PacificBell DNS servers though...seems like this event cropped up after the upgrade, but I can't find a clear analysis of the issue.