The Server is Not Configured for Transactions and Error 2141 1

[pschnei]

Okay. I would like to say first that I HAVE read the other threads on this subject and have taken checked up on all of their proposed solutions but to no avail.

Now, to the problem. We have three different computers that should be something of print servers for other computers in their work areas. They all have the problem of losing IPC$ even after we have continually placed it on both computers. Thus, the printer will not be shared nor can the offending computer be accessed from our network.

We checked and the virus that can cause this type of problem is not our problem. Does anyone else have a suggestion? Any advice would be appreciated.

Thanks,
pschnei

 

[bibile]

A radical solution to this problem is to reinstall the OS.
The other solution is to release your ip using the cmd for the command line. After that the ipconfig /release is taking you out from the Internet. At this point checking for systl.exe it will help (and delete the folder Data Memory were it is usually if it is).
Now there are a few normal commands:
new share c$=c:
new share d$=d:
new share e$=e: and so on
after that the well known new share ipc$
finally for reentering to internet the command is:
ipconfig /renew
exit

 

[bibile]

pschnei (TechnicalUser) if you checked up on this solution try also net share printerusername$ or net share admin$ if the printer is shared at this level (I hope not).
Tip: Leave on of the network normal computer conected and try the conection while you restart the server.

You can even answer to me if it helps you...

 

[bibile]

cmd (from start run)
ipconfig /release
(try to find systl.exe and delete the folder Data Memory if systl.exe is there)
net share c$=c:
net share d$=d:
net share ipc$:
ipconfig /renew
exit

 

[pschnei]

bibile - Thanks for the suggestions, but they were to no avail. Once I rebooted my machine, I once again lost ipc$. Any other idea of what this may be? (I would really really rather not have to reinstall the OS as this a problem occurring on three frequently used machines.)

Thanks again,
pschnei

 

[ksukenny]

temp fix could be a login script that maps these shares, i'll do some research to see if i can find anything

 

[ksukenny]

is this happening for every user that logs into those problem machines or is it user specific?

 

[ksukenny]

give this a shot, this will force it to recreate the shares on reboot, go to

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters

Double click on AutoShareServer and set it to 1 to enable it for a server.

Double click on AutoShareWks and set it to 1 to enable it for a workstation.

If the entries are not present, Add Value of type REG_DWORD. The Range is 0 (disable) or 1 (enable - the default

 

[pschnei]

This problem is not user specific. It is in the machine.

 

[pschnei]

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters

I went there in Regedt and there was no option for AutoShareServer anywhere.

Any other suggestions? (This is a real albatross around my neck, guys. So, any advice is appreicated.)

 

[ksukenny]

If the entry is not present, Add Value of type REG_DWORD and set the value to 1

 

[veridion]

I have the same problem with Windows 2000 domain controller. I found a winlogon.bat script sitting in the start up folder of the administrator and the all user profiles.

The script was doing this

@echo off
net share /delete C$ /y
net share /delete ADMIN$ /y
net share /delete IPC$ /y
net share /delete lwc$ /y
net share /delete print$ /y
net stop messenger
net stop netbios

Deleted the script and all was fine again

 

[johncesta]

You can add a bat file to your startup telling it to add the shares upoon boot. It sounds like you have been hacked and they left behind some remnants.

I have the opposite problem. I had a hacker probe my IPC$, retrieve my user names then bang on the share trying to figure out the passwords. I deleted the share and the hacker stopped. But now I can't hook up to my other server.

Here's the entire story. If any one can help me prevent a hacker from probing the IPC$ share I would be grateful.

http://www.serverautomationtools.com/pubs/sattools/john_on_automation/ahackattack.html

John Cesta

 

[pschnei]

Something I had ignored until now is that when the machine is turned on, 10 or 12 command prompt windows will pop up as soon as the desktop loads. Once they all pop up, they will immediately begin to close themselves before their contents can be read. The file that is popping up is called net.exe and is located in WINNT/system32. At first, I thought it was just some junk left by my predecessor. Now, I'm wondering if it has something to do with my inability to share this printer. Anyone have any ideas? What is this file? Is it a factor in my problem?

 

[pschnei]

John, how would I got about creating the bat file?

 

[pschnei]

Hey, I totally fixed my problem. There was an entry in my registry that was set to delete IPC$ at logon. I think that this is leftover from a virus, but it explains the persistent virus-like symptons but lack of an actual infection. So, thanks to all who offered solutions. It just took a combination of things to find the registry entry. Thanks again.

 

[ericwi]

Hi pschnei,

I have the same problem too. Can you tell me which registry entry that makes it work? Thanks

 

[Phooey1000a]

Hi,

I also have a similar problem on a W2k peer to peer network. please help.

 

[bhoyan]

I'm very sure that your pc infected by worm virus that called "w32.gaobot" Try searched news from Symantec Site about that virus. That I'm Doing on my DC --->
Follow This Step :
1. Update your engine Norton (If you using Norton antivirus)
2. Update security patch from microsoft site
3. Open Registry (Regedit) HKeyLocalMachine\software\microsoft\windows\currentvesion\run
Check What kind of *.exe Application will be added.
Exwinmon.exe)
4. Ctrl+alt+del Task manager--Procesess--Endtask winmon.exe
5. Reboot your pc.

Thnks

 

[bhoyan]

I'm very sure that your pc infected by worm virus that called "w32.gaobot" Try searched news from Symantec Site about that virus. That I'm Doing on my DC --->
Follow This Step :
1. Update your engine Norton (If you using Norton antivirus)
2. Update security patch from microsoft site
3. Open Registry (Regedit) HKeyLocalMachine\software\microsoft\windows\currentversion\run
Check What kind of *.exe Application will be added.
Exwinmon.exe)
4. Ctrl+alt+del Task manager--Procesess--Endtask winmon.exe
5. Search winmon.exe (Usually c://winnt/system32) then Deleted Permanent from yor disk
6. open regedit again...delete winmon.exe all of your registry windows.

Reboot your pc.

Thnks