Windows Server 2003 Hangs

[bsan2008]

Server 2003 hangs after every 15-20 minutes and the only solution is to restart it.

In event viewer it shows error events 1030 and 1054

The moment these events occur system hangs.

Kindly help to solve this problem.

 

[Lemon13]

and which source triggers the events?

have a look at

http://www.eventid.net/

insert id-nr and source, that gives u a glue where to start

 

[xmsre]

Ping another host. Look at the text of the response. Does it show a negative response time? Something like

Reply from 10.10.10.128: bytes=32 time=-2ms TTL=128

If so, put the /usepmtimer switch in your boot.ini and reboot.

 

[bsan2008]

Following is error-----1

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date: 14/11/2008
Time: 7:37:46 PM
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Following is error-----2
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1058
Date: 14/11/2008
Time: 7:37:46 PM
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=mate,DC=local. The file must be present at the location <\\mate.local\sysvol\mate.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (Configuration information could not be read from the domain controller, either because the machine is unavailable, or access has been denied. ). Group Policy processing aborted.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

I can ping to any other pc in lan.

 

[Lemon13]

so start here

http://www.eventid.net/display.asp?eventid=1030&eventno=1542&source=Userenv&phase=1

continue here

http://www.eventid.net/display.asp?eventid=1058&eventno=1752&source=Userenv&phase=1

 

[xmsre]

There is a processor bug for certain AMD dual core Opterons. This timer drift issue can cause all sorts of communications problems. One of them results in the event ID 1030/1054. In this case you can ping, but a telltale sign that you have the problem is that the ping has a response time with a NEGATIVE number as the value. If your ping results in a negative respone time and you see event 1030/1054, then you should tell the processor to use an alternative timer, the PM timer, to resolve the drift issue. You do this by adding the /usepmtimer switch to your boot.ini.

You currently do see the event 1030/1054. Are the response times in your ping a negative number?

 

[bsan2008]

Dear XMSRE
This processor is Intel Processor. While pinging to any host I haven't got any negative number response.

What is command to use pmtimer in boot.ini?

I'm also going through eventid.net as suggested by lemon13 but is very huge section to read.

 

[xmsre]

The problem with timer drift only impacts AMD processors.


In that this is not an AMD processor, have you tried

http://support.microsoft.com/?kbid=842804

 

[bsan2008]

Yes, tried everything as suggested by microsoft. SP2 is installed. When dfsutils command is applied, it works for next 1 hour instead of 10-15 mins.
After applying gpupdate /force it holds for 2-3 hours.

Is it possible that because any perticular pc or user is logging and this error occurs?
If so, how to find it out?

 

[bsan2008]

I've done following things -
1) DCGPOFIX
2) On every pc including server added a registry key HKLM\system\CurrentControlSet\Services\MUP\DisableDFS=0
3) netsh winsock reset
4) netsh interface ip reset
5) Reboot
6) gpupdate /force
After all this, I found SecCli event and now server is running for atleast 4-5 hours %-(

BUT STILL PROBLEM IS NOT SOLVED. Server needs reboot 1-3 times a day.

 

[people3]

HI,

When the server hangs - can you

Ping the server by IP address?

does the num lock light work if you plug a KB into the server?

Can you ctrl alt Del the server to get task manager?

What type of server is it? are the fans all ok?

Does the HDD have any faults \ bad sectors?

Lots of questions..

 

[people3]

also read a simular post here

http://www.tek-tips.com/viewthread.cfm?qid=1511125&page=1

 

[bsan2008]

Hi People3,

I can't Ping the server or any pc by IP address or by host name

Num lock light works.

After pressing ctrl alt Del it doesn't start task manager.

It is C2d with 2 GB RAM and 360 GB Sata HDD. All 3 fans are working.

I also have tried changing brand new HDD with new installation but still same problem is repeated.

Do you suspect any hardware fault?

 

[people3]

Hi bsan2008

Is this server a DC?

What are the primary and secondry servers set up on your DC.

Also what settings is your DHCP server giving out?

and lastly have your tryed running netdiag and dcdiag?

 

[technome]

I can't Ping the server or any pc by IP address or by host name"
"After pressing ctrl alt Del it doesn't start task manager."

Between the two symptoms above sounds like something is absorbing resources. Assume you checked for malware, used a free AV scan like Kasper or Trend Micro. Do you have any old database files on your server ? SMB signing can be a nasty issue.

Hardware issue, unlikely, as it remains alive consistantly for a period of time after a reboot.

What AV do you use? Sym Endpoint by any chance

Agree with people3, run NetDiag and DcDiag with the verbose switch.

"found SecCli event" elaborate please, assuming this is a raid event, never seen a raid cause the symptoms without file corruption. Generally if the card or driver is bad you get complete freeze or just an aary freeze, no mouse or keyb or bluescreens/rollover (very rare in any case,if driver/firmware are fairly recent).



........................................
Chernobyl disaster..a must see pictorial

http://www.kiddofspeed.com/default.htm

 

[bsan2008]

Hi, Sorry for delay as I was out somewhere.

Yes this is DC
NetDiag and DCdiag doesn't show any errors, all tests passed. Netdiag shows some tests as skipped (IP Security test, Trust relationship test etc.)

Antivirus is QuickHeal Total Security with its own firewall. Now I've disabled all firewalls for time being.

SceCli event is found after applying gpupdate /force command
Eventid=1704 Source=SceCli Category=Information and shows description as 'Security policy in the Group policy objects has been applied successfully.'

Today I've changed the Network Card with newone and also trying replacing RAM

DC runs for hours if not connected by any client pc. It doesn't show any error events from Friday night to Monday morning when nobody is connected.

Could this be DNS issue?
DC=192.168.0.10
all other clients =192.168.0.xx
Subnet=255.255.255.0
One Linksys internet router=192.168.0.1

Can you guide me to reinstall DNS Server role for this configuration?

 

[technome]

DC runs for hours if not connected by any client pc."
You did not answer about having an old DB, SMB signing issues would have this result. One of my last 2008 server installs worked fine until old DB files were accessed from it.

http://www.petri.co.il/forums/showthread.php?t=25791&highlight=smb+signing

I have never seen DNS cause this directly, but if your server is resource stretched, DNS will generally be one of the first services to stop or partial stop working, generally a symptom not a cause.




........................................
Chernobyl disaster..a must see pictorial

http://www.kiddofspeed.com/default.htm

 

[bsan2008]

Hi All,

Thanks a lot for your help.
I learned lot more things by this issue.

Finally it was a Hard Disk! (with bad sectors)

When I replaced it, now DC is working fine!

Bye