Solved

net logon and computer browser shutdown automatically

Posted on 2004-10-12
15
550 Views
Last Modified: 2008-01-09
Hi,

I'm trying to figure out this problem with services shutting down by themselves several times every day.  The primary services that are doing it are net logon and computer browser.  We used to have Exchange 2000 server running, and several exchange services would shutdown and require us to manually restart them as well, but we uninstalled exchange for other reasons..  What are some logical troubleshooting steps?  

Thanks - Trevor
0
Comment
Question by:trevorhartman
15 Comments
 
LVL 12

Assisted Solution

by:Mazaraat
Mazaraat earned 450 total points
ID: 12292805
Post the event log errors please =)
****
Check for a replication/time issue.  Check the time vs another server, preferably a domain controller.
If the time is off sync your time with the DC that is configured to keep time updated (usually the first DC):
-----Start->Run->CMD.exe
-----net time \\domaincontroller /set /y
This can also be run from clients PC's to sync with the time server.
*****
Also verify your DNS information for the server:
Start->Run->CMD.exe
ipconfig /all
Verify the information against any DHCP reservations, and DNS information
****
If your not running the exchange on it anymore, maybe a corrupt computer account in AD?  Might have to pull it out of domain and restart, then re-add it back in.
****

Anywho, post some event logs so we can see what kind of errors its bleeting about =)
0
 
LVL 8

Author Comment

by:trevorhartman
ID: 12292864
not sure what part of the error log you want to see, but here's an exported tab delimited list of the last few hours:

Type      Date      Time      Source      Category      Event      User      Computer
Error      10/12/2004      4:35:46 PM      Userenv      None      1000      SYSTEM      SERVER2
Error      10/12/2004      4:30:44 PM      Userenv      None      1000      SYSTEM      SERVER2
Error      10/12/2004      4:25:41 PM      Userenv      None      1000      SYSTEM      SERVER2
Error      10/12/2004      4:20:39 PM      Userenv      None      1000      SYSTEM      SERVER2
Error      10/12/2004      3:59:51 PM      Userenv      None      1000      SYSTEM      SERVER2
Error      10/12/2004      3:54:48 PM      Userenv      None      1000      SYSTEM      SERVER2
Information      10/12/2004      3:53:40 PM      Ci      CI Service       4103      N/A      SERVER2
Information      10/12/2004      3:53:24 PM      Ci      CI Service       4109      N/A      SERVER2
Error      10/12/2004      3:49:45 PM      Userenv      None      1000      SYSTEM      SERVER2
Information      10/12/2004      3:45:14 PM      Ci      CI Service       4103      N/A      SERVER2
Information      10/12/2004      3:44:53 PM      Ci      CI Service       4109      N/A      SERVER2
Error      10/12/2004      3:44:42 PM      Userenv      None      1000      SYSTEM      SERVER2
Information      10/12/2004      3:41:10 PM      Ci      CI Service       4103      N/A      SERVER2
Information      10/12/2004      3:41:05 PM      Ci      CI Service       4109      N/A      SERVER2
Error      10/12/2004      3:38:00 PM      Userenv      None      1000      SYSTEM      SERVER2
Information      10/12/2004      3:36:06 PM      Ci      CI Service       4103      N/A      SERVER2
Information      10/12/2004      3:35:57 PM      Ci      CI Service       4109      N/A      SERVER2
Error      10/12/2004      3:32:58 PM      Userenv      None      1000      SYSTEM      SERVER2
Information      10/12/2004      3:27:18 PM      Ci      CI Service       4103      N/A      SERVER2
Information      10/12/2004      3:27:06 PM      Ci      CI Service       4109      N/A      SERVER2
Error      10/12/2004      3:11:13 PM      Userenv      None      1000      SYSTEM      SERVER2
Information      10/12/2004      3:09:02 PM      DrWatson      None      4097      N/A      SERVER2
Information      10/12/2004      3:06:53 PM      Ci      CI Service       4103      N/A      SERVER2
Information      10/12/2004      3:06:20 PM      Ci      CI Service       4109      N/A      SERVER2
Error      10/12/2004      3:06:10 PM      Userenv      None      1000      SYSTEM      SERVER2
Error      10/12/2004      3:00:48 PM      Userenv      None      1000      SYSTEM      SERVER2
Information      10/12/2004      2:59:36 PM      Norton AntiVirus      None      2      N/A      SERVER2
Warning      10/12/2004      2:59:28 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:25 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:24 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:24 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:23 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:23 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:23 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:23 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:23 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:23 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:23 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:23 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:23 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:23 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:23 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:23 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:23 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:59:23 PM      Norton AntiVirus      None      6      N/A      SERVER2
Error      10/12/2004      2:55:46 PM      Userenv      None      1000      SYSTEM      SERVER2
Warning      10/12/2004      2:48:15 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:48:15 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:48:15 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:48:15 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:48:15 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:48:15 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:48:15 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:48:15 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:48:14 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:48:12 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:48:12 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:48:07 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:44:15 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:41:35 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:40:13 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:39:55 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:39:41 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:39:41 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:39:40 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:38:52 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:38:50 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:36:00 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:36:00 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:36:00 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:36:00 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:36:00 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:35:59 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:35:59 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:35:59 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:35:59 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:35:59 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:33:48 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:33:48 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:33:47 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:33:47 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:27:46 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:26:42 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:26:40 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:24:34 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:22:41 PM      VxSvc_Perc2Pro      None      579      N/A      SERVER2
Warning      10/12/2004      2:20:53 PM      Norton AntiVirus      None      6      N/A      SERVER2
Warning      10/12/2004      2:20:38 PM      Norton AntiVirus      None      6      N/A      SERVER2
Information      10/12/2004      2:19:06 PM      Ci      CI Service       4135      N/A      SERVER2
Information      10/12/2004      2:19:06 PM      Ci      CI Service       4135      N/A      SERVER2
Information      10/12/2004      2:19:06 PM      Ci      CI Service       4135      N/A      SERVER2
Information      10/12/2004      2:19:05 PM      Ci      CI Service       4137      N/A      SERVER2
Information      10/12/2004      2:19:02 PM      Ci      CI Service       4137      N/A      SERVER2
0
 
LVL 8

Author Comment

by:trevorhartman
ID: 12292919
DNS looks good... we've had these settings for about 10 months, and the problem with the services only came up about 2 months ago..   not exactly sure on the time thing.. the time on my workstation has always been incorrect.  it's about 15 minutes behind the server time.  my workstation doesn't even log into the domain though...  

do you need to see any other events?


thx - Trevor
0
 
LVL 8

Author Comment

by:trevorhartman
ID: 12292929
note: we've been clearing viruses off this server regularly the last few months...  finally killed exchange since that's how they were getting in.
0
 

Assisted Solution

by:gunite
gunite earned 50 total points
ID: 12294103
I found that this particular problem was fixed in SP4 for Windows 2000 Server. Do you have the latest service pack installed?
0
 
LVL 8

Author Comment

by:trevorhartman
ID: 12294318
No we don't, I'll have to try that tomorrow when I get in.  thanks for the suggestion

-Trevor
0
 
LVL 8

Author Comment

by:trevorhartman
ID: 12312414
ok i checked and it looks like we already had sp4 installed... services are still shutting down.. any other suggestions?

thx - Trevor
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 
LVL 12

Expert Comment

by:Mazaraat
ID: 12313775
Please open one of the errors for userenv 1000, and post =)


This error may enlighten us on what is causing your problems.

Also look through your system log like you did above, and then open any errors & copy and paste them(just a few not all =)
0
 
LVL 8

Author Comment

by:trevorhartman
ID: 12313953
Here's one of the userenv errors:

Event Type:      Error
Event Source:      Userenv
Event Category:      None
Event ID:      1000
Date:            10/14/2004
Time:            5:31:31 PM
User:            NT AUTHORITY\SYSTEM
Computer:      SERVER2
Description:
Windows cannot access the registry information at \\CCMTEES\sysvol\CCMTEES\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\registry.pol with (53).


Here's an error from the system log (had about 8 of these in a row at the same time):

Event Type:      Error
Event Source:      TermServDevices
Event Category:      None
Event ID:      1106
Date:            10/14/2004
Time:            5:35:08 PM
User:            N/A
Computer:      SERVER2
Description:
The printer could not be installed.
Data:
0000: 05 07 00 00 32 04 00 00   ....2...

here's another system error that showed up several times:

Event Type:      Error
Event Source:      smtpsvc
Event Category:      None
Event ID:      6003
Date:            10/14/2004
Time:            1:18:55 PM
User:            N/A
Computer:      SERVER2
Description:
SMTP was unable to connect to an LDAP server. Unable to categorize because there are no GC servers available
 

For more information, click http://www.microsoft.com/contentredirect.asp.
Data:
0000: 5e 05 04 c0               ^..À    


thx - Trevor
0
 
LVL 8

Author Comment

by:trevorhartman
ID: 12313960
found an error on Net logon:

Event Type:      Warning
Event Source:      NETLOGON
Event Category:      None
Event ID:      5781
Date:            10/14/2004
Time:            3:46:44 PM
User:            N/A
Computer:      SERVER2
Description:
Dynamic registration or deregistration of one or more DNS records failed because no DNS servers are available.
Data:
0000: 2a 23 00 00               *#..    


what does that mean?
0
 
LVL 12

Accepted Solution

by:
Mazaraat earned 450 total points
ID: 12314065
ok, is this server a domain controller? It looks like your having active directory issues.  Check to see where your master roles are located, you may have to move them:
http://is-it-true.org/nt/nt2000/atips/atips56.shtml

Go to a command prompt and type this:
netdom query fsmo

it will return a list of the 5 roles and who they belong to. that would help in finding out why your having ldap and global catalog issues
*****

Error messages=

This below can be ignored, its just telling you that when you remote in it doesn't have the drivers to map your printers
Event Type:     Error
Event Source:     TermServDevices
Event Category:     None
Event ID:     1106
*****

below Netlogon errors:
Event Type:     Warning
Event Source:     NETLOGON
Event Category:     None
Event ID:     5781

http://support.microsoft.com/default.aspx?scid=kb;EN-US;259277
Excerpt:
NOTE: A common cause for these errors is that a domain controller references itself as a primary DNS server in its TCP/IP properties. When the domain controller starts in this configuration, the Netlogon service may start before the DNS service starts. Because the Netlogon service must register records in DNS and the DNS service is not yet available, errors may occur. In this situation, you can safely ignore the errors because the Netlogon service will again try to register the records in approximately five minutes, at which time it will be successful. However, there are two ways to avoid the errors in this scenario: • Make sure that domain controllers do not reference themselves as a primary DNS server in their TCP/IP properties.
• Configure the Netlogon service to depend on the DNS service. This will cause the Netlogon service to start after the DNS service starts. To do this, run REGEDT32, and go to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon
In the right pane, double-click the value DependOnService and add DNS to the next available blank line. Click OK and exit Registry Editor. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:


Seems like a couple of different problems here, first thing first check out the DNS first, then check out your schema roles as the links show.
0
 
LVL 8

Author Comment

by:trevorhartman
ID: 12728816
sorry I haven't had time to implement the solution these experts provided.  I will close the question myself

-Trevor
0
 
LVL 36

Expert Comment

by:grblades
ID: 12753784
Could you please close the question.
0
 
LVL 8

Author Comment

by:trevorhartman
ID: 12757037
yes, sorry... i thought i already did, but it didn't take
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Let’s list some of the technologies that enable smooth teleworking. 
If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now