Hot fix issues
Hi
My windows 2003 server is rebooting on every wed and monday with the errors of lsass.exe I am trying ot install the hotfix of microsoft windows that is KB826819 but it doesnt seem to install gving the error "Setup has detected that version of the service pack installed on your system is lower than what is necessary to apply this hotifx. At minium, you must have service pack 1 instal". We currently running SP2.
What would be cause and how should i fix it
Regards
Arpit
My windows 2003 server is rebooting on every wed and monday with the errors of lsass.exe I am trying ot install the hotfix of microsoft windows that is KB826819 but it doesnt seem to install gving the error "Setup has detected that version of the service pack installed on your system is lower than what is necessary to apply this hotifx. At minium, you must have service pack 1 instal". We currently running SP2.
What would be cause and how should i fix it
Regards
Arpit
ASKER
Hi chris
I am in Uk and working with schools and so we are having RM network. And currently we are having CC3 Network in which we are having windows 2003 server and XP as client So windows is modified by the RM.
I am in Uk and working with schools and so we are having RM network. And currently we are having CC3 Network in which we are having windows 2003 server and XP as client So windows is modified by the RM.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Hi Chris
This the error which i am getting.
"As per previous closed call 1521217 - we are getting recurring instances of server1 rebooting at 23:30 at night
(happened on Mon and Wed this week.)
The system event log shows slightly different series of events on either day, but it seems that winlogon (see below)
crashes, then the auditor service starts & stops every second until the shutdown.
What might be causing the winlogon error?
****
Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 14/03/2005
Time: 23:30:45
User: NT AUTHORITY\SYSTEM
Computer: EPH-SR-001
Description:
The process winlogon.exe has initiated the restart of computer EPH-SR-001 on behalf of user for the following
reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\WINNT\system32\lsass.e
The system will now shut down and restart.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 06 00 05 00 43 00 3a 00 ....C.:.
0008: 5c 00 57 00 49 00 4e 00 \.W.I.N.
0010: 4e 00 54 00 5c 00 73 00 N.T.\.s.
0018: 79 00 73 00 74 00 65 00 y.s.t.e.
0020: 6d 00 33 00 32 00 5c 00 m.3.2.\.
0028: 4c 00 6f 00 67 00 46 00 L.o.g.F.
0030: 69 00 6c 00 65 00 73 00 i.l.e.s.
0038: 5c 00 53 00 68 00 75 00 \.S.h.u.
0040: 74 00 44 00 6f 00 77 00 t.D.o.w.
0048: 6e 00 5c 00 53 00 68 00 n.\.S.h.
0050: 75 00 74 00 44 00 6f 00 u.t.D.o.
0058: 77 00 6e 00 5f 00 32 00 w.n._.2.
0060: 30 00 30 00 35 00 30 00 0.0.5.0.
0068: 33 00 31 00 34 00 32 00 3.1.4.2.
0070: 33 00 33 00 30 00 33 00 3.3.0.3.
0078: 32 00 2e 00 78 00 6d 00 2...x.m.
0080: 6c 00 00 00 l...
****"
Thanks
Bye
This the error which i am getting.
"As per previous closed call 1521217 - we are getting recurring instances of server1 rebooting at 23:30 at night
(happened on Mon and Wed this week.)
The system event log shows slightly different series of events on either day, but it seems that winlogon (see below)
crashes, then the auditor service starts & stops every second until the shutdown.
What might be causing the winlogon error?
****
Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 14/03/2005
Time: 23:30:45
User: NT AUTHORITY\SYSTEM
Computer: EPH-SR-001
Description:
The process winlogon.exe has initiated the restart of computer EPH-SR-001 on behalf of user for the following
reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\WINNT\system32\lsass.e
The system will now shut down and restart.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 06 00 05 00 43 00 3a 00 ....C.:.
0008: 5c 00 57 00 49 00 4e 00 \.W.I.N.
0010: 4e 00 54 00 5c 00 73 00 N.T.\.s.
0018: 79 00 73 00 74 00 65 00 y.s.t.e.
0020: 6d 00 33 00 32 00 5c 00 m.3.2.\.
0028: 4c 00 6f 00 67 00 46 00 L.o.g.F.
0030: 69 00 6c 00 65 00 73 00 i.l.e.s.
0038: 5c 00 53 00 68 00 75 00 \.S.h.u.
0040: 74 00 44 00 6f 00 77 00 t.D.o.w.
0048: 6e 00 5c 00 53 00 68 00 n.\.S.h.
0050: 75 00 74 00 44 00 6f 00 u.t.D.o.
0058: 77 00 6e 00 5f 00 32 00 w.n._.2.
0060: 30 00 30 00 35 00 30 00 0.0.5.0.
0068: 33 00 31 00 34 00 32 00 3.1.4.2.
0070: 33 00 33 00 30 00 33 00 3.3.0.3.
0078: 32 00 2e 00 78 00 6d 00 2...x.m.
0080: 6c 00 00 00 l...
****"
Thanks
Bye
I take it you've checked the machine for viruses?
ASKER
Hi
Chris
We have installed the norton edition on it and it is running fine and dont think that there is any virus on it as the virus is updated every day and is schedule to scan daily and in reports as well that there is no virus on the server.
Thanks
Arpit
Chris
We have installed the norton edition on it and it is running fine and dont think that there is any virus on it as the virus is updated every day and is schedule to scan daily and in reports as well that there is no virus on the server.
Thanks
Arpit
There is also the possibilty that a virus attacking the operating system is causing the reboot - without actually causing infection.
A few versions / clones of MSBlast were known to cause this type of problem when attempting to connect to the target, instead of successfully connecting they would cause a reboot.
Does the server have a Firewall in front of it to protect it from the outside world?
And how are viruses monitored and controlled within the internal network?
ASKER
hi
yeah we are having firewall and that is managed through equinoxsolutions and as we have norton antivirus corporate edition, and all the computers are scanned, so it is done through this only.
yeah we are having firewall and that is managed through equinoxsolutions and as we have norton antivirus corporate edition, and all the computers are scanned, so it is done through this only.
Could you possibly confirm the Operating system and patch level?
ASKER
Operating system is 2003 server, SR 4
If that's really what it's reporting to be then you definately need to go back to RM Support.
You can have Windows 2003 SP1 or Windows 2000 SP4.
If it's 2000 SP4 then the patch you're attempting won't work because of a lack of Windows 2003.
Could you confirm the Operating system please. Windows 2003 doesn't have a Service Pack 2 yet, so you either have the wrong operating system or the wrong patch level.
If you already have SP1 installed you might want to try reinstalling it as a first step.
HTH
Chris