Terminal Server unkown ERROR messages!
We have a Server 2003 R2 that is setup as a Web Application Server as well as a Terminal Server. Lately we have been getting particular errors. When i get a phone call from the clients that they can no longer print or they are having other multiple issues then i know there is something wrong. Almost 100% of time here is what i find out. When I go to the Server Event Viewer, under the System, in chronological order, first I see the following error message: An internal communication error occurred. Redirected printing will no longer function for a single user session. Check the status of the Terminal Services Device Redirector in the System folder of Device Manager. After that I immediately see the following errors: An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in, or write out, or flush, one of the files that contain the system's image of the Registry.
The "source" for the first error is: reported as "TermServDevices" and the "Source" for the 2nd error is reported as: "Application Popup". It gets even more interesting - the second error appears 7 times per second, non-stop, and you see it flooding the event log!!
I have attached several imgaes of the errors.
Obviously this is causing to be a major problem and your solution will be greatly appreciated!
Server-Error-MSg-1.png
Server-Error-MSg-Error-No.-1.png
Server-Error-MSg-Error-No.-2.png
The "source" for the first error is: reported as "TermServDevices" and the "Source" for the 2nd error is reported as: "Application Popup". It gets even more interesting - the second error appears 7 times per second, non-stop, and you see it flooding the event log!!
I have attached several imgaes of the errors.
Obviously this is causing to be a major problem and your solution will be greatly appreciated!
Server-Error-MSg-1.png
Server-Error-MSg-Error-No.-1.png
Server-Error-MSg-Error-No.-2.png
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I just checked the Printer Folder and there was an "Auto HP Printer 2840" listed and I Just deleted it since we never use the server to print anything, only in Terminal Sessions we print. Unfortunately I was too hesitant and did not check the port before I deleted it.
The HP printer that was installed is a Network Printer and is attached to the Local Area Network.
The next thing I did was to go through the Printer ports. I have attached some screen captures for your review. The only particular port that caught my eye was a port named "BRN_8CC1AC". There is no printer associated with it and it is described as a "Standard TCP/IP Port". Do you think this could be a problem? Should I delete it?
Server-Installed-Printers.PNG
Server-Printer-Ports-1.PNG
Server-Printer-Ports-2.PNG
Server-Printer-Ports-3.PNG
Server-Printer-Ports-4.PNG
Server-Printer-Ports-5.PNG
The HP printer that was installed is a Network Printer and is attached to the Local Area Network.
The next thing I did was to go through the Printer ports. I have attached some screen captures for your review. The only particular port that caught my eye was a port named "BRN_8CC1AC". There is no printer associated with it and it is described as a "Standard TCP/IP Port". Do you think this could be a problem? Should I delete it?
Server-Installed-Printers.PNG
Server-Printer-Ports-1.PNG
Server-Printer-Ports-2.PNG
Server-Printer-Ports-3.PNG
Server-Printer-Ports-4.PNG
Server-Printer-Ports-5.PNG
Standard TCP/IP Port is not a problem. That is built in and is the suggested port type.
I would simply look for any devices using an HP TCP/IP Port type and have them use Standard instead.
You definitely have a kernel memory issue, and the printer thing I suggested is a cause I see often. However it could certainly be caused by something else.
Outdated AV software can cause this as well.
I would simply look for any devices using an HP TCP/IP Port type and have them use Standard instead.
You definitely have a kernel memory issue, and the printer thing I suggested is a cause I see often. However it could certainly be caused by something else.
Outdated AV software can cause this as well.
ASKER
We use McAfee VirusScan Enterprise v8.0 with Patch v13. I have attached a screen capture of the AV. Do you know if this is a problem? Is there a AV that you would recommend that we switch to?
Thanks.
Server-VS-Version.png
Thanks.
Server-VS-Version.png
Mcafee 8.0 is up to at least Patch 15. I would acquire that upgrade or the latest Patch you can find.
ASKER
I was looking arounf for the latest patch and I came across the new version of McAfee VirusScan v8.5i. Do you think I should upgrade to that version?
I have three more questions:
1) In the Driver TAB of the Printer Server, I see that there are many Printer drivers installed, many of whioh we do not use. Should I delete the unwanted drivers?
2) I also see that there are more than one driver installed for a given printer but with slightly different name, how can I find out which driver is usefull and which is not so that I do not delete the required driver?
3) Lastly, relating to tsmvp comment at the beging of the thread, yes i did install some drivers to support the various printers that the clients use. So What do I do next with that?
I have three more questions:
1) In the Driver TAB of the Printer Server, I see that there are many Printer drivers installed, many of whioh we do not use. Should I delete the unwanted drivers?
2) I also see that there are more than one driver installed for a given printer but with slightly different name, how can I find out which driver is usefull and which is not so that I do not delete the required driver?
3) Lastly, relating to tsmvp comment at the beging of the thread, yes i did install some drivers to support the various printers that the clients use. So What do I do next with that?
No reason to upgrade to 8.5 if you can download the latest patch from Mcafee to make 8.0 more stable. I'm not sure about the feature difference. So I would just look and see if 8.5 adds something you want that 8.0 doesn't already do for you. If you just need AV protection, I think you'll be ok with downloading patch 15 or whatever is current.
1) By all means. If you aren't using surplus drivers, uninstall them.
2) A lot of times the name may say pcl 5, or pcl 6, or ps so you know what type of driver it is and depending on what you are doing this will determine which one to keep. You can look at any installed printers and see which one your printers are actually using and delete the surplus.
3) What tsmvp was getting at is that some drivers aren't friendly with Terminal Servers. Some drivers install software or a service that will cause issue on a terminal server. My recommendation is to simply add the driver to a server and not run the full install process if you can avoid it. This way you don't add unecessary services or apps that run on the task bar which could cause issue across multiple sessions.
1) By all means. If you aren't using surplus drivers, uninstall them.
2) A lot of times the name may say pcl 5, or pcl 6, or ps so you know what type of driver it is and depending on what you are doing this will determine which one to keep. You can look at any installed printers and see which one your printers are actually using and delete the surplus.
3) What tsmvp was getting at is that some drivers aren't friendly with Terminal Servers. Some drivers install software or a service that will cause issue on a terminal server. My recommendation is to simply add the driver to a server and not run the full install process if you can avoid it. This way you don't add unecessary services or apps that run on the task bar which could cause issue across multiple sessions.
ASKER
Thank you Placebo for the help.
Just one more question. When some of my clients connect to the TS they have sevral Printer installed on their local machine and they use only one of them for TS session. THerefore i have only installed the Driver for the Printer that they will be using on TS. But this causes the Server to Log an "ERROR" event Event ID 1111. The Error simply points out that a Driver for XYZ Printer is unkown and a adriver should be installed. If this is not the printer that the Client intends to use, do i have to be worried about this Error Event? COUld this be crashing the system?
Just one more question. When some of my clients connect to the TS they have sevral Printer installed on their local machine and they use only one of them for TS session. THerefore i have only installed the Driver for the Printer that they will be using on TS. But this causes the Server to Log an "ERROR" event Event ID 1111. The Error simply points out that a Driver for XYZ Printer is unkown and a adriver should be installed. If this is not the printer that the Client intends to use, do i have to be worried about this Error Event? COUld this be crashing the system?
No worries. It is simply what you said. Letting you know you don't have the driver. You would have to install those extra drivers on the server to get rid of them or find a way to remap them (not worth the effort).
No those errors won't crash anything.
No those errors won't crash anything.
ASKER
Thanks.
I have applied the latest patch of the AV (Patch 16) but sometime in future i think i will upgrade to VirusScan 8.5i. I have also cleaned up the majority of the Unwanted Printer Drivers but still have to do some more. So for now I will keep my fingers crossed and hope that the problem is resolved. I wish I knew what triggers the event then i could fully test it out. For now it appears that the Error occurs randomly. I will keep you posted!
I do see some other Error event in the System Log but i think i will start a new thread since I don't think it is related to this issue and don't know if they are causing any harm.
Thank you for everything.
I have applied the latest patch of the AV (Patch 16) but sometime in future i think i will upgrade to VirusScan 8.5i. I have also cleaned up the majority of the Unwanted Printer Drivers but still have to do some more. So for now I will keep my fingers crossed and hope that the problem is resolved. I wish I knew what triggers the event then i could fully test it out. For now it appears that the Error occurs randomly. I will keep you posted!
I do see some other Error event in the System Log but i think i will start a new thread since I don't think it is related to this issue and don't know if they are causing any harm.
Thank you for everything.
ASKER
Hello again;
I thought the problem was solved but I think it is back again, but it is somewhat different.
As usuall i got a call that they are having problme with the Terminal Server and i decided to check the Event Log and there it was, but a little different this time. This time the first error that appears is Error Event ID 59. This is repeated several times. And then appears "Warning" Event ID 56 (which I assume relates to VIA Raid Driver) and after that appears Error Event ID 333, then Error EVent ID 1103 and then eventualy, after a few pages the Error Event iD 2019 aad then it is followed by more Error Event ID 333.
Any ideas now?
ServerError.EID59-1.PNG
ServerError.EID59-2.PNG
ServerError.EID56.PNG
ServerError.EID333.PNG
ServerError.EID1103.PNG
ServerError.EID2019.PNG
I thought the problem was solved but I think it is back again, but it is somewhat different.
As usuall i got a call that they are having problme with the Terminal Server and i decided to check the Event Log and there it was, but a little different this time. This time the first error that appears is Error Event ID 59. This is repeated several times. And then appears "Warning" Event ID 56 (which I assume relates to VIA Raid Driver) and after that appears Error Event ID 333, then Error EVent ID 1103 and then eventualy, after a few pages the Error Event iD 2019 aad then it is followed by more Error Event ID 333.
Any ideas now?
ServerError.EID59-1.PNG
ServerError.EID59-2.PNG
ServerError.EID56.PNG
ServerError.EID333.PNG
ServerError.EID1103.PNG
ServerError.EID2019.PNG
ASKER
I think I am going to create a new post for this.
ASKER
I have found three Event ID 2019 and NO 2020. The first Event ID 2019 occured on 12/26/2007. This Event occured after the first and the second error described in my original question and it is about two minutes after the first error had occured. From the look of the event log i can tell that this was one of the times that the system had to be restarted since the event is flooded by the second error. The second Event ID 2019 occured on 1/02/2008 and it is just like the first Event ID 2019. And the last EVENt ID 2019 occured on 1/16/2008 and once again simialr to the other two.
I have exported the Event Log and attached it to this message. Please feel free to browse it.
So where do i go from here?
System-Event-Log.txt