Windows XP SP2 Machine Locks Up

This is a wierd one.  Setting up 20 + IBM ThinkPad T42's, and after I get done with Security Patches, and installing Microsoft Office, about 1 of 4 machines locks up at a random point.  The catch is, it only locks up when plugged into our corporate domain.  If plugged in anywhere else or unconnected, it will not lock up.  I've tested this for about 3 weeks, and I'm 100 percent it has something to do with our network here.  I first thought it was 2 firewalls not liking each other, with SP2 and Zone Alarm Pro 5, however, Zone Alarm is not installed on some machines, and it still happens.  We have Microsoft Server 2003 on the domain server.  I've called IBM Tech Support, and they cannot seem to point me the right direction.  I've giving this 500 points for the solution, especially with the amount of time I've already been dealing with this problem.

Thanks for any help!
LVL 1
SGCAdminAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

eatmeimadanishCommented:
Make sure when you log into your domain, that your DNS entry for your TCP/IP settings do not include any other IP other then your DC.  You should get this from DHCP, but often overides can be left behind if the laptop was under a different configuration prior.
thepunish3rCommented:
When exactly does the machine lock up, at login or does it happen after you have been on the machine for a while?  Are they domain members or are they stand alone machines and you are just physically plugging them into the lan for internet access and such?

Do you have any group policies or login scripts being applied at the domain level that may be causing an issue with these particular machines?
zkriegerCommented:
anything get written to the event logs on the machines?  I've had computers "auto join" a AD network before, they may be trying to and failing.
Your Guide to Achieving IT Business Success

The IT Service Excellence Tool Kit has best practices to keep your clients happy and business booming. Inside, you’ll find everything you need to increase client satisfaction and retention, become more competitive, and increase your overall success.

thallerCommented:
I think it's related to solar flares....

Do the same laptops keep locking up?  Is there any difference between the laptops (NIC, processor, memory installed, size and brand of HDD)?  Can you use Ethereal in promiscious mode to capture the packets up to the point one locks up?  Does the event viewer show anything at all?
SGCAdminAuthor Commented:
I havnt tried to do anything yet, but to answer the questions from above, the machines will lock up at any point, for instance, i've seen it completely freeze at the log in screen, and also have seen it freeze after using it for about 30 minutes.  Also, when unconnected, Zone Alarm keeps saying Java is trying to act as a server, which is kind of wierd that it would ask for a connection when unconnected(wireless disabled).  

Thaller, the laptops are all similar, 26 IBM T42's, so the same exact hw in each one.  I'll attempt to ook at some logs and the event viewer.

Thanks for the quick responses...
SGCAdminAuthor Commented:
Another side question that could lead to the answer, I realized that with each one of these laptops, I've disabled and uninstalled Norton Anti-Virus, yet in the Start-up, there are 3 things listed under Synaptics that are still there.  What I think I may try is to disable everything in the start-up and kind of troubleshoot it like that.

Also, the Event Viewer, there is a warning, "DHCP", Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address xxxxxxxxxxx.  The following error occured:  The operation was cancelled by the user.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

However, I think this just comes up after I disconnect from the LAN.  
zkriegerCommented:
ok, 2 possibilities.

1. update java, and then edit your startup to exclude it running its autoupdate feature. its possible you have an older version and a java based virus thats preventing it from running the update service. Yes, even with norton on the machines I;ve seen this happen, norton sucks at catching these kinds of viruses.

2. boot off the network and run http://www.mlin.net/StartupCPL.shtml  the startup control panel by Mike Lin.  its a good tool that brings together everything that runs on startup in one interface.

go through that list and google what you see to find if anything is suspicious.  just something stupid like a CDDB (compact disk data base) program that is trying to find the right song names for a music file can cause the kind of behavior you describe.


oh, and does this happen at any time, even while the laptop is in use, or only when its "idle"?  if its happening on idle, go into the network card itself in device manager and disable the ability for windows to turn it off to save power.
SGCAdminAuthor Commented:
zkrieger,

I dont believe that this is being caused by a virus of any sort, these machines are right out of the box, only 3-4 weeks old.  I've seen one lock up 2 hours out of the box during initial setup.  But it never happens unless connected to our local network here.  It is possible that it is some update conflicting with these machines, so I've disabled everything in the start-up except for the bare essentials.  So far it hasnt locked up as I'm typing this message on the machine right now.  Just as long as I can get to the submit button before it.......       :-)
zkriegerCommented:
its entirely possible they are auto-enrolling to your AD domain and being killed by a policy trying to load.

you might boot one, then set a fixed ip, then connect it and see how long it takes to lock up.  also check what services your advertising on your network.. something like ethereal or a fluke meter can help with this greatly.

the point is find out what happens at the time of failure... it could just be a dab NIC revision of firmware or drivers.   I have 6 Dell Gx270 mini chassis that lockup and blue screen when i use a belkin usb wireless with them... no rime or reason to it until i found out these dells typiclly do not provide enough power on teh usb port to drive the cards, and the blue screen was caused by a voltage overload sensor.

its stuff like that you hope isnt the case... I'd rather find out its something stupid like the image they used on the laptops was out of date vs the NIC actually on the board.  If they are this new, get IBM on the phone. you have exhausted the obvious answers.
SGCAdminAuthor Commented:
Zkrieger,

Yeah, my first instinct was that it was either overheating or the video driver was wrong, but the fact it happens to 6 of 30 brand new laptops is a mystery.  I did try using a static IP, but it locked up right away.  Where do you find this fluke meter?  

I tried formatting and resetting up the factory IBM settings, and it locked up again about an hour into it.  I do uninstall some factory programs such as Outlook, MSN Messenger, Norton Anti-Virus 2004, and some Norton update software in add/remove, but I cant believe that the missing software could cause a problem like this.  I'm trying to think of everything now.  I'm thinking of installing XP from a regular install disk without the IBM image and see what happens.
zkriegerCommented:
www.fluke.com

btw, check the event logs on your servers... just a hunch, but if they are trying to eroll these machines, it might log that.

otherwise, i would defenantly call IBM.  6 of 30 is a mystery and maybe they can tell you why.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
SGCAdminAuthor Commented:
I was indeed the machine's themselves.  We replaced the system boards on the 'locked up' machines and sure enough, that fixed it.  We had on-site service, and IBM handled it very promptly as they were all fixed within a week.  Thanks for the help.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking

From novice to tech pro — start learning today.