?
Solved

Slow reboot after upgrading from Windows 2000 server to Windows 2003 server

Posted on 2006-03-26
30
Medium Priority
?
1,074 Views
Last Modified: 2007-12-19
I just upgraded my Windows Server 2000 to Windows Server 2003. This machine is the one and only DC in the network. I have two other Windows XP Pro machines and a Macintosh that all still function normally after the upgrade. After the conversion it takes about 5 minutes for the computer to reboot. It stalls for a long time on the "Preparing Network Connection" prompt and then when the Login prompt appears a message comes up that says "One or more services or drivers failed to start". Once I log in to the computer all the required services seem to be running and the computer and network function normally. Below are all the Error messages from the Event Viewer after rebooting. I've checked all of the links to the Help and Support Center and either the fixes did not work because the error keeps coming back on each reboot or the Support Center had nothing to say about the problem. Help!!!!
---------------------------------
Event Type:      Error
Event Source:      NTDS Inter-site Messaging
Event Category:      Intersite Messaging
Event ID:      1824
Date:            3/26/2006
Time:            6:02:18 PM
User:            N/A
Computer:      ERIC
Description:
The Intersite Messaging Service requested to perform an LDAP bind operation.  The operation was unsuccessful.
 The error message is as follows:
 
The specified server cannot perform the requested operation.
 
Additional data
Error value:
58

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------
Event Type:      Error
Event Source:      Flpydisk
Event Category:      Disk
Event ID:      2
Date:            3/26/2006
Time:            5:56:55 PM
User:            N/A
Computer:      ERIC
Description:
The description for Event ID ( 2 ) in Source ( Flpydisk ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: \Device\Floppy0.
Data:
0000: 00 00 00 00 01 00 5a 00   ......Z.
0008: 02 00 00 00 02 00 07 c0   .......À
0010: 00 00 00 00 13 00 00 c0   .......À
0018: 00 00 00 00 00 00 00 00   ........
0020: 00 00 00 00 00 00 00 00   ........

---------------------------------
Event Type:      Error
Event Source:      W32Time
Event Category:      None
Event ID:      46
Date:            3/26/2006
Time:            6:02:10 PM
User:            N/A
Computer:      ERIC
Description:
The time service encountered an error and was forced to shut down.  The error was: 0x80070005: Access is denied.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------
Event Type:      Error
Event Source:      RemoteAccess
Event Category:      None
Event ID:      20106
Date:            3/26/2006
Time:            6:02:16 PM
User:            N/A
Computer:      ERIC
Description:
Unable to add the interface {4AAC5B6C-A1A2-4E19-82E8-4A1670378508} with the Router Manager for the IP protocol. The following error occurred: Cannot complete this function.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: eb 03 00 00               ë...    

---------------------------------
Event Type:      Error
Event Source:      Removable Storage Service
Event Category:      None
Event ID:      111
Date:            3/26/2006
Time:            6:02:21 PM
User:            N/A
Computer:      ERIC
Description:
The description for Event ID ( 111 ) in Source ( Removable Storage Service ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Drive 0, Apple Computer_ Inc. iPod IEEE 1394 SBP2 Device.
Data:
0000: 01 00 00 00               ....    

---------------------------------
Event Type:      Error
Event Source:      Removable Storage Service
Event Category:      None
Event ID:      111
Date:            3/26/2006
Time:            6:02:26 PM
User:            N/A
Computer:      ERIC
Description:
The description for Event ID ( 111 ) in Source ( Removable Storage Service ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Drive 0, Apple Computer_ Inc. iPod IEEE 1394 SBP2 Device.
Data:
0000: 01 00 00 00               ....    

---------------------------------
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7022
Date:            3/26/2006
Time:            6:03:22 PM
User:            N/A
Computer:      ERIC
Description:
The Net Logon service hung on starting.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7023
Date:            3/26/2006
Time:            6:03:22 PM
User:            N/A
Computer:      ERIC
Description:
The Windows Time service terminated with the following error:
Access is denied.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
---------------------------------
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7023
Date:            3/26/2006
Time:            6:03:22 PM
User:            N/A
Computer:      ERIC
Description:
The Intersite Messaging service terminated with the following error:
The specified server cannot perform the requested operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------
Event Type:      Error
Event Source:      Print
Event Category:      None
Event ID:      33
Date:            3/26/2006
Time:            6:04:41 PM
User:            NT AUTHORITY\SYSTEM
Computer:      ERIC
Description:
The PrintQueue Container could not be found because the DNS Domain name could not be retrieved.  Error: 54b

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7022
Date:            3/26/2006
Time:            6:06:06 PM
User:            N/A
Computer:      ERIC
Description:
The DNS Server service hung on starting.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------
Event Type:      Error
Event Source:      DCOM
Event Category:      None
Event ID:      10005
Date:            3/26/2006
Time:            7:07:37 PM
User:            N/A
Computer:      ERIC
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service StiSvc with arguments "" in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------
0
Comment
Question by:laimins
  • 15
  • 15
30 Comments
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16296990
Hi laimins,

nasty..... first just heck your dns settings for me - your primary dns setting should be pointing to the DC itself yes?

once we confirm that we can look at the other errors

Cheers!
0
 

Author Comment

by:laimins
ID: 16306461
Jay_Jay70

Thanks for taking the time to take a look at this problem. Now, to answer your question, I think the short answer is yes, the primary setting is pointing to the DC itself. Just so there are no mis-understandings there are four lines in the DNS forward lookup zone table that reference the domain controller machine eric. These four lines are:


Name                                Type                               Data
-----------------------------------------------------------------------------------------------------------------------
(same as parent folder)      Host (A)                          192.168.0.2
eric                                   Host (A)                          192.168.0.2
(same as parent folder)       Name Server (NS)           eric.laimins.com
(same as parent folder)       Start of Authority (SOA)   [678], eric.laimins.com., admin.laimins.com

I'm not sure what the rest of the information in the DNS tables is all about but the machine eric is also mention in the folder: _msdcs->dc->_sites->Default-First-Site-Name->_tcp. The entries here look like this

Name                        Type                             Data
-------------------------------------------------------------------------------------------
_kerberos          Service Location (SRV)    [0][100][88] eric.laimins.com
_ldap                Service Location (SSRV)  [0][100][389] eric.laimins.com

There is an identical entry in the folder _msdcs->dc->sites->_tcp and these entries are repeated in the folder
_sites->Default-First-Site-Name->_tcp. This last folder has an additional entry

Name                        Type                             Data
-------------------------------------------------------------------------------------------
_gc                   Service Location (SRV)     [0][100][3268] eric.laimins.com

The above there lines are repeated in the folder _tcp with the additional line

Name                        Type                             Data
-------------------------------------------------------------------------------------------
_kpasswd          Service Location (SRV)    [0][100][464] eric.laimins.com

The _kerberos and  _kpasswd entries are repeated in the _udp folder

The folder DomainDnsZones has the line

Name                                Type                               Data
-----------------------------------------------------------------------------------------------------------------------
(same as parent folder)      Host (A)                          192.168.0.2

The folders
DomainDnsZones->_sites->Default-First-Site-Name->_tcp
DomainDnsZones->_tcp
ForestDnsZones->_sites->Default-First-Site-Name->_tcp
ForestDnsZones->_tcp

all have the _ldap line mention above. And finally, just to be complete, the Reverse Lookup Zone->192.168.0.x Subnet has the entries

Name                                Type                               Data
-----------------------------------------------------------------------------------------------------------------------
192.168.0.2                        Host (A)                          eric.laimins.com
(same as parent folder)       Name Server (NS)           eric.laimins.com
(same as parent folder)       Start of Authority (SOA)   [176], eric.laimins.com., admin.laimins.com


Hope this answers your simple question. <grin>









0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16316496
havent forgotten you mate, just hectic with a couple of things, will get back to you this afternoon :)
0
Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 

Author Comment

by:laimins
ID: 16316935
Jay_jay70,

No problem. Take your time. Right now this problem is just vexing in that it takes soooo looonnggg for the machine to reboot, but then hopefully I don't need to reboot that often. <smile> Once the machine is up and running I can't find anything that doesn't work. My concern is that some where in the future when I add, remove or change something else a new problem will arise that is critical.
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16328501
hmm DNS doesnt look nasty so maybe we looking in the wrong place

if you run ipconfig /flushdns   any difference?

also can you run dcdiag for me and see if there are any errors? if no errors then dont bother pasting the log

let me know bro :)
0
 

Author Comment

by:laimins
ID: 16329498
Ran the ipconfig /flushdns command and got the response

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

Rebooted the computer and there was no difference. Ran dcdiag and here's the results
-------------------------------------------------------------------
C:\Program Files\Resource Kit>dcdiag

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\ERIC
      Starting test: Connectivity
         ......................... ERIC passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\ERIC
      Starting test: Replications
         ......................... ERIC passed test Replications
      Starting test: NCSecDesc
         ......................... ERIC passed test NCSecDesc
      Starting test: NetLogons
         ......................... ERIC passed test NetLogons
      Starting test: Advertising
         Warning: ERIC is not advertising as a time server.
         ......................... ERIC failed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... ERIC passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... ERIC passed test RidManager
      Starting test: MachineAccount
         ......................... ERIC passed test MachineAccount
      Starting test: Services
            IsmServ Service is stopped on [ERIC]
            w32time Service is stopped on [ERIC]
         ......................... ERIC failed test Services
      Starting test: ObjectsReplicated
         ......................... ERIC passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... ERIC passed test frssysvol
      Starting test: frsevent
         ......................... ERIC passed test frsevent
      Starting test: kccevent
         An Error Event occured.  EventID: 0xC0000720
            Time Generated: 03/29/2006   23:10:43
            Event String: The Intersite Messaging Service requested to
         An Warning Event occured.  EventID: 0x800005C1
            Time Generated: 03/29/2006   23:10:43
            Event String: The Intersite Messaging service could not read
         ......................... ERIC failed test kccevent
      Starting test: systemlog
         An Error Event occured.  EventID: 0xC0070002
            Time Generated: 03/29/2006   23:05:42
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC25A002E
            Time Generated: 03/29/2006   23:10:35
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x00004E8A
            Time Generated: 03/29/2006   23:10:40
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC004006F
            Time Generated: 03/29/2006   23:10:46
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC004006F
            Time Generated: 03/29/2006   23:10:50
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0001B6E
            Time Generated: 03/29/2006   23:11:44
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0001B6F
            Time Generated: 03/29/2006   23:11:44
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0001B6F
            Time Generated: 03/29/2006   23:11:44
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000021
            Time Generated: 03/29/2006   23:14:08
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0001B6E
            Time Generated: 03/29/2006   23:14:35
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0002715
            Time Generated: 03/29/2006   23:16:40
            (Event String could not be retrieved)
         ......................... ERIC failed test systemlog
      Starting test: VerifyReferences
         ......................... ERIC passed test VerifyReferences

   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom

   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : laimins
      Starting test: CrossRefValidation
         ......................... laimins passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... laimins passed test CheckSDRefDom

   Running enterprise tests on : laimins.com
      Starting test: Intersite
         ......................... laimins.com passed test Intersite
      Starting test: FsmoCheck
         Warning: DcGetDcName(TIME_SERVER) call failed, error 1355
         A Time Server could not be located.
         The server holding the PDC role is down.
         Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error 1355
         A Good Time Server could not be located.
         ......................... laimins.com failed test FsmoCheck

C:\Program Files\Resource Kit>
------------------------------------------------------------------------------------------------------------------------

I hope the failures mean something to you and they point you in the right direction.
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16329537
sure does my friend you issue is with time

if kerboros is more than 5 minutes out then everything goes to hell, replication, authentication etc

try this

start - run cmd

net time \\servername /setsntp:servername

hit enter
you should get a confirmation

reboot the server and run dcdiag again and see if you get different results
0
 

Author Comment

by:laimins
ID: 16336783
Here's the result of running the net time command

C:\Documents and Settings\peter>net time \\eric /setsntp:eric
The command completed successfully.

Below are the results of the dcdiag command after running the above command and then rebooting. (The reboot speed did not improve. Still very slow.) This time the machine passed the kccevent. WE'RE MAKING PROGRESS. <hurray> But, everything else is the same. <bummer> At the end I again include all of the Event Viewer errors and warnings after the reboot. I don't think all of them are relevent to the problem at hand but I'm no expert so I would rather overfeed you with data than omit something crucial. <smile>

=========================================

C:\Program Files\Resource Kit>dcdiag

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\ERIC
      Starting test: Connectivity
         ......................... ERIC passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\ERIC
      Starting test: Replications
         ......................... ERIC passed test Replications
      Starting test: NCSecDesc
         ......................... ERIC passed test NCSecDesc
      Starting test: NetLogons
         ......................... ERIC passed test NetLogons
      Starting test: Advertising
         Warning: ERIC is not advertising as a time server.
         ......................... ERIC failed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... ERIC passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... ERIC passed test RidManager
      Starting test: MachineAccount
         ......................... ERIC passed test MachineAccount
      Starting test: Services
            IsmServ Service is stopped on [ERIC]
            w32time Service is stopped on [ERIC]
         ......................... ERIC failed test Services
      Starting test: ObjectsReplicated
         ......................... ERIC passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... ERIC passed test frssysvol
      Starting test: frsevent
         ......................... ERIC passed test frsevent
      Starting test: kccevent
         ......................... ERIC passed test kccevent
      Starting test: systemlog
         An Error Event occured.  EventID: 0xC0070002
            Time Generated: 03/30/2006   14:14:46
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC25A002E
            Time Generated: 03/30/2006   14:19:38
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x00004E8A
            Time Generated: 03/30/2006   14:19:44
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC004006F
            Time Generated: 03/30/2006   14:19:49
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC004006F
            Time Generated: 03/30/2006   14:19:52
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0001B6E
            Time Generated: 03/30/2006   14:20:48
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0001B6F
            Time Generated: 03/30/2006   14:20:48
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0001B6F
            Time Generated: 03/30/2006   14:20:48
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000021
            Time Generated: 03/30/2006   14:23:20
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0001B6E
            Time Generated: 03/30/2006   14:23:48
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0002715
            Time Generated: 03/30/2006   14:26:31
            (Event String could not be retrieved)
         ......................... ERIC failed test systemlog
      Starting test: VerifyReferences
         ......................... ERIC passed test VerifyReferences

   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom

   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : laimins
      Starting test: CrossRefValidation
         ......................... laimins passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... laimins passed test CheckSDRefDom

   Running enterprise tests on : laimins.com
      Starting test: Intersite
         ......................... laimins.com passed test Intersite
      Starting test: FsmoCheck
         Warning: DcGetDcName(TIME_SERVER) call failed, error 1355
         A Time Server could not be located.
         The server holding the PDC role is down.
         Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error 1355
         A Good Time Server could not be located.
         ......................... laimins.com failed test FsmoCheck

---------------------------------------
error messages and warnings after reboot

From Directory Services

Event Type:      Error
Event Source:      NTDS Inter-site Messaging
Event Category:      Intersite Messaging
Event ID:      1824
Date:            3/30/2006
Time:            2:19:46 PM
User:            N/A
Computer:      ERIC
Description:
The Intersite Messaging Service requested to perform an LDAP bind operation.  The operation was unsuccessful.
 The error message is as follows:
 
The specified server cannot perform the requested operation.
 
Additional data
Error value:
58

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
=======
Event Type:      Warning
Event Source:      NTDS Inter-site Messaging
Event Category:      Intersite Messaging
Event ID:      1473
Date:            3/30/2006
Time:            2:19:46 PM
User:            N/A
Computer:      ERIC
Description:
The Intersite Messaging service could not read the intersite transport objects from Active Directory.
 
As a result, the Intersite Messaging service has stopped. The Knowledge Consistency Checker (KCC) will be unable to calculate intersite topology without this service.
 
User Action
Verify that LDAP queries function properly on this machine.
 
Restart the Intersite Messaging service to continue intersite communication.
 
Additional Data
Error value:
58 The specified server cannot perform the requested operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------------------------------------------
From System

Event Type:      Error
Event Source:      Flpydisk
Event Category:      Disk
Event ID:      2
Date:            3/30/2006
Time:            2:14:46 PM
User:            N/A
Computer:      ERIC
Description:
The description for Event ID ( 2 ) in Source ( Flpydisk ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: \Device\Floppy0.
Data:
0000: 00 00 00 00 01 00 5a 00   ......Z.
0008: 02 00 00 00 02 00 07 c0   .......À
0010: 00 00 00 00 13 00 00 c0   .......À
0018: 00 00 00 00 00 00 00 00   ........
0020: 00 00 00 00 00 00 00 00   ........

=====
Event Type:      Error
Event Source:      W32Time
Event Category:      None
Event ID:      46
Date:            3/30/2006
Time:            2:19:38 PM
User:            N/A
Computer:      ERIC
Description:
The time service encountered an error and was forced to shut down.  The error was: 0x80070005: Access is denied.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
=====
Event Type:      Error
Event Source:      RemoteAccess
Event Category:      None
Event ID:      20106
Date:            3/30/2006
Time:            2:19:44 PM
User:            N/A
Computer:      ERIC
Description:
Unable to add the interface {4AAC5B6C-A1A2-4E19-82E8-4A1670378508} with the Router Manager for the IP protocol. The following error occurred: Cannot complete this function.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: eb 03 00 00               ë...    
=====
Event Type:      Error
Event Source:      Removable Storage Service
Event Category:      None
Event ID:      111
Date:            3/30/2006
Time:            2:19:49 PM
User:            N/A
Computer:      ERIC
Description:
The description for Event ID ( 111 ) in Source ( Removable Storage Service ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Drive 0, Apple Computer_ Inc. iPod IEEE 1394 SBP2 Device.
Data:
0000: 01 00 00 00               ....    
=====
Event Type:      Error
Event Source:      Removable Storage Service
Event Category:      None
Event ID:      111
Date:            3/30/2006
Time:            2:19:52 PM
User:            N/A
Computer:      ERIC
Description:
The description for Event ID ( 111 ) in Source ( Removable Storage Service ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Drive 0, Apple Computer_ Inc. iPod IEEE 1394 SBP2 Device.
Data:
0000: 01 00 00 00               ....    
=====
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7022
Date:            3/30/2006
Time:            2:20:48 PM
User:            N/A
Computer:      ERIC
Description:
The Net Logon service hung on starting.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
=====
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7023
Date:            3/30/2006
Time:            2:20:48 PM
User:            N/A
Computer:      ERIC
Description:
The Windows Time service terminated with the following error:
Access is denied.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
=====
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7023
Date:            3/30/2006
Time:            2:20:48 PM
User:            N/A
Computer:      ERIC
Description:
The Intersite Messaging service terminated with the following error:
The specified server cannot perform the requested operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
=====
Event Type:      Error
Event Source:      Print
Event Category:      None
Event ID:      33
Date:            3/30/2006
Time:            2:23:20 PM
User:            NT AUTHORITY\SYSTEM
Computer:      ERIC
Description:
The PrintQueue Container could not be found because the DNS Domain name could not be retrieved.  Error: 54b

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
=====
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7022
Date:            3/30/2006
Time:            2:23:48 PM
User:            N/A
Computer:      ERIC
Description:
The DNS Server service hung on starting.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
=====
Event Type:      Error
Event Source:      DCOM
Event Category:      None
Event ID:      10005
Date:            3/30/2006
Time:            2:26:31 PM
User:            N/A
Computer:      ERIC
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service StiSvc with arguments "" in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
======

0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16337358
Starting test: Services
            IsmServ Service is stopped on [ERIC]
            w32time Service is stopped on [ERIC]
         ......................... ERIC failed test Services

can you just double check the windows time service is started? just before i start looking at the other logs?
0
 

Author Comment

by:laimins
ID: 16338576
Maybe I don't know what I should be looking for but I can't find any process called w32time. Here's what I did

1. Started the Task Manager and looked for a process called w32time. Did not see it
2. Went to Start->Settings->Control Panel->Administrative Tools->Services
3. Found an entry for Windows Time with Startup Type of Automatic and Log on As Local System.
4. The status for the service was blank, so I right clicked on the service and selected Start
5. After a short while the Status changed to Started
6. I looked in Event Viewer and it had the following two entries
Event Type:      Information
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7035
Date:            3/30/2006
Time:            7:14:26 PM
User:            LAIMINS\peter
Computer:      ERIC
Description:
The Windows Time service was successfully sent a start control.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:      Information
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7036
Date:            3/30/2006
Time:            7:14:26 PM
User:            N/A
Computer:      ERIC
Description:
The Windows Time service entered the running state.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


7. I went back to the Task Manager but I still do not see any process called w32time

Hope this is the information you are looking for.
0
 

Author Comment

by:laimins
ID: 16338602
TIME OUT ON THE FIELD.

I just went back to the Event Viewer and it had 3 new entries, all related to the time service. Here they are:
--------------------------
Event Type:      Information
Event Source:      W32Time
Event Category:      None
Event ID:      38
Date:            3/30/2006
Time:            7:15:30 PM
User:            N/A
Computer:      ERIC
Description:
The time provider NtpClient cannot reach or is currently receiving invalid time data from eric (ntp.m|0x0|192.168.0.2:123->192.168.0.2:123).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------
Event Type:      Warning
Event Source:      W32Time
Event Category:      None
Event ID:      47
Date:            3/30/2006
Time:            7:17:06 PM
User:            N/A
Computer:      ERIC
Description:
Time Provider NtpClient: No valid response has been received from  manually configured peer eric after 8 attempts to contact it. This peer will be discarded as a time source and NtpClient will attempt to discover a new peer  with this DNS name.  

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------
Event Type:      Error
Event Source:      W32Time
Event Category:      None
Event ID:      29
Date:            3/30/2006
Time:            7:17:06 PM
User:            N/A
Computer:      ERIC
Description:
The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible.  No attempt to contact a source will be made for 15 minutes. NtpClient has no source of accurate time.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16338610
that time service was the one i was talking about, make sure it set to auto and then reboot your server

then run the diags again
0
 

Author Comment

by:laimins
ID: 16348231
The time service is set to run auto. I rebooted and the time service was NOT started. I ran dcdiag and it showed that the services test failed and one of the failures was the time service. I ran the command

net start w32time

and the time service started. I reran dcdiag and this time the time service did not fail. The first time I ran dcdiag there was another service that also was not running, Intersite Messageing. This service is also supposed to auto start but it was not listed as started. I ran the command

net start ismserv

and the service was now running. I again re-ran dcdiag and this time the services test passed. After I cleared the Event Viewer ALL tests passed.

I then thought to try a little experiment of my own. I made the Windows Time service and the Intersite Messaging service Manual starts and I rebooted. Nothing different. The reboot was still slow, I still got the message that one of the services did not start. After I logged in I ran dcdiag and it had the same failures as all other times. I ran the two above net start commands and re-ran dcdiag and all was well.
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16353108
clear your event viewers completely

set those two services back to automatically and on each of the services properties select the recovery TAB

make sure the options under that TAB are to restart the service on failure.

restart your servers and check that the service has started   if not, check your even viewers as to why the service has started
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16353110
hasnt* started :)
0
 

Author Comment

by:laimins
ID: 16367587
Okay. Here's what I did. I cleared all the event viewers. I set all three recovery (first, second and subsequent) properties to "Restart the service" for the Intersite Messageing service and the Windows time service. I made sure that both services were automatic start. I rebooted. No change. Reboot still slow and I got the "Could not start some services..." message. The bootup process hung on the Starting Network services window. When I logged in I checked services and neither the Intersite Messaging service nor the Windows time service had started. I started them both by hand and they started without a problem. I then checked the event viewer. The Windows time service had generated the following two error messages in the System Event Viewer

================================
Event Type:      Error
Event Source:      W32Time
Event Category:      None
Event ID:      46
Date:            4/3/2006
Time:            10:49:58 PM
User:            N/A
Computer:      ERIC
Description:
The time service encountered an error and was forced to shut down.  The error was: 0x80070005: Access is denied.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
===============================
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7023
Date:            4/3/2006
Time:            10:51:26 PM
User:            N/A
Computer:      ERIC
Description:
The Windows Time service terminated with the following error:
Access is denied.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

===============================

The intersite messageing service message was in the Directory Service Event Viewer and it said
================================
Event Type:      Error
Event Source:      NTDS Inter-site Messaging
Event Category:      Intersite Messaging
Event ID:      1824
Date:            4/3/2006
Time:            10:50:06 PM
User:            N/A
Computer:      ERIC
Description:
The Intersite Messaging Service requested to perform an LDAP bind operation.  The operation was unsuccessful.
 The error message is as follows:
 
The specified server cannot perform the requested operation.
 
Additional data
Error value:
58

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
================================

Right after the above error message was this warning message
================================
Event Type:      Warning
Event Source:      NTDS Inter-site Messaging
Event Category:      Intersite Messaging
Event ID:      1473
Date:            4/3/2006
Time:            10:50:06 PM
User:            N/A
Computer:      ERIC
Description:
The Intersite Messaging service could not read the intersite transport objects from Active Directory.
 
As a result, the Intersite Messaging service has stopped. The Knowledge Consistency Checker (KCC) will be unable to calculate intersite topology without this service.
 
User Action
Verify that LDAP queries function properly on this machine.
 
Restart the Intersite Messaging service to continue intersite communication.
 
Additional Data
Error value:
58 The specified server cannot perform the requested operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

===========================================

Then later on in the System Event Viewer the intersite messaging service generated the following error entry

============================================
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7023
Date:            4/3/2006
Time:            10:51:26 PM
User:            N/A
Computer:      ERIC
Description:
The Intersite Messaging service terminated with the following error:
The specified server cannot perform the requested operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16367598
new test for you

under the logon TAB of the time service change the logon user to administrator      do this for both services and see how you go
0
 

Author Comment

by:laimins
ID: 16377376
I was able to change the logon user for the intersite messaging service. This process was set to logon as a Local System account. After changing the logon account I stopped and started the service. No problem here. But there was a problem with the time service. The time process was running with the logon of NT AUTHORITY\LocalService. When I tried to change the logon for the time service I got the following error

Error 1079
The account specified for this service is different from the account specified for other services running in the same process.

When I looked at my services the time process was running as a LocalService.  There were two other processes running and using the NT AUTHORITY\LocalService account. One of the processes, Remote Registry, was running the executable c:\\WINNT\system32\svchost.exe -k regsvc. The other process running as the LocalService was TCP/IP Netbios Helper and it was running the executable c:\\WINNT\system32\svchost.exe -k LocalService. This is the very same executable that the time service runs. This confuses me a little bit. What tells these two commands to run differently? How can the executable be changed? It is grayed out and cannot be edited. Maybe this information is relevent. Maybe it is not. The bottom line as far as your request goes is that I put the intersite messageing service back to run as a LocalSystem account and I did not reboot. I wait to see if you can tell me how to resolve the error 1079 from above and then I'll follow through on the test.
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16377459
the two services do pull the same eecutable - this is normal behaviour   im staring at one right now and its fine

the only thing i can think of with that error is that their are service dependencies on another service with different credentials   can you check that dependencies TAB for me


0
 

Author Comment

by:laimins
ID: 16387374
The intersite messaging service depends on Security Accounts Manager -> Remote Procedure Call

The time service has no dependencies.

I have access to another running Windows 2003 server and I did some poking around. On the working server the command to run the time service is

c:\\WINNT\system32\svchost.exe -k netsvc

I'm thinking about using regedit and going to \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSe\Services\W32Time\ImagePath and ObjectName and changing the values of those keys to let netsvc start the process. There are three things stopping me. One, the service can be started by hand once the machine is up so the account shouldn't be the problem, two, I don't know if there are other keys that should be changed as well and three, lack of nerve because I don't know enough about the registry to know if these changes will make it impossible to boot. I'm REAL dangerous: I know enough to get into trouble but not enough to get out of trouble. <grin> Thoughts?
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16387405
just backup your registry first

that change should be fine :)
0
 

Author Comment

by:laimins
ID: 16388822
That's all I needed. Just a little bit of encouragement. However, I'll put it off until Friday or Saturday just in case something goes wrong and I have to rebuild the server from scratch. In the meantime if you can think of anything else to try I'm all ears.
0
 

Author Comment

by:laimins
ID: 16450811
Sorry to be so long in getting on with this but I've been busy with some other matters. Anyway, I've kind of chickened out of making the registry fixes. This is the only DC in my home network and if it goes belly up I've got to deal with "She who must be obeyed". If you've got any other suggestions I would be happy to try those. Right now I think I want to take some time and pre-test my recovery path in case I goof something up. The only problem I have right now is that the machine takes about 5 minutes to boot-up. Also, I need to hit the okay button once it tells me that one of the services did not start up. I ran into a little bit of problem earlier this week with this because we had a minor power glitch and the computer re-booted. The wife got home before I did and she could not check her email until I got home and clicked the okay button to finish the DC's reboot. Think maybe I'll get a UPS for this machine.
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16451775
UPS is all good

check event logs to see what that error is
0
 

Author Comment

by:laimins
ID: 16478527
Here are the messages in the event log. They really don't tell me much and clicking on the supplied links doesn't help much either. It tells me either there is no more information for that combination of services and error number or the fixes it does give are not for Windows 2003 server. The other funny thing is that even though there is an error message that NetLogon could not start when I log in after rebooting and check the services NetLogon is running. All services designated to automatically start are running EXCEPT the intersite messageing and the time service. The failure of these two services does not affect operation of the system. I think that because I only have one DC in the network the intersite messaging services is not important and the time service is not crucial to operation either. Once I log in I can start the services by hand with no problem. Curiouser and curiouser and curiouser.

=====
Event Type:     Error
Event Source:     Service Control Manager
Event Category:     None
Event ID:     7022
Date:          3/30/2006
Time:          2:20:48 PM
User:          N/A
Computer:     ERIC
Description:
The Net Logon service hung on starting.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
=====
Event Type:     Error
Event Source:     Service Control Manager
Event Category:     None
Event ID:     7023
Date:          3/30/2006
Time:          2:20:48 PM
User:          N/A
Computer:     ERIC
Description:
The Windows Time service terminated with the following error:
Access is denied.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
=====
Event Type:     Error
Event Source:     Service Control Manager
Event Category:     None
Event ID:     7023
Date:          3/30/2006
Time:          2:20:48 PM
User:          N/A
Computer:     ERIC
Description:
The Intersite Messaging service terminated with the following error:
The specified server cannot perform the requested operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
=====



0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16483654
far out, your event messages are constantly changing!

without being in front of the machine it is kind of hard to be able to troubleshoot this, only thing i can think of that may be worth trying is a demotion
0
 

Author Comment

by:laimins
ID: 16493778
Jay_jay70,

No can do. Too many other machines rely on this one being up. Tell you what I'm going to do. Since the machine runs perfectly well and only suffers from severe, slow reboot, I'm going to forget about it. You've tried your best and your hints and suggestions have led me to learn more about these machines than I maybe wanted to know. <grin> How do I go about closing this problem and giving you the points? Do I just click the accept button?
0
 
LVL 48

Accepted Solution

by:
Jay_Jay70 earned 750 total points
ID: 16493984
hmm what a position to be stuck in!

you dont have to accept my friend, if my answers didnt solve your problem then i havent earnt the points :)

but if you want to accept one then yup, just hit the accept button,

you can get your points refunded though if you would prefer and i wont object
0
 

Author Comment

by:laimins
ID: 16497510
You get the points if for no other reason than you had to wade through the TONS of error messages that I posted. <grin> Thanks for at least taking the time to look.
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16497523
thats a pleasure mate

and thankyou :)
0

Featured Post

Prep for the ITIL® Foundation Certification Exam

December’s Course of the Month is now available! Enroll to learn ITIL® Foundation best practices for delivering IT services effectively and efficiently.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many of us need to configure DHCP server(s) in their environment. We can do that simply via DHCP console on server or using MMC snap-in on each computer with Administrative Tools installed in a network. But what if we have to configure many DHCP ser…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
Loops Section Overview
Screencast - Getting to Know the Pipeline

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question