Event id 5783 on Win 2000 Terminal Servers
Every now and then we get the following message in the event logs on our Terminal servers:-
NETLOGON,Error,None,5783,N
Windows 2000 Domain Controller \\serverY.domainname for the domain domainname is not responsive. The current RPC call from Netlogon on \\SERVERX to \\serverY.domainname has been cancelled. (Actual server names/domain name not shown in text).
It happens on a random basis and users then start to notice that the server is non-responsive, until it seems to grind to a halt. We then have to hard reboot using the power button, the server won't even shut down.
We have two domain controllers that also act as wins servers and the error may point to either of the controllers.
I read MS article - http://technet.microsoft.com/en-us/library/bb727055.aspx and checked the dns. Both controllers are listed as wins lookup, name servers and both have host records.
I'm not sure where to look next with this one. The MS article suggests potential rpc call problems.
NETLOGON,Error,None,5783,N
Windows 2000 Domain Controller \\serverY.domainname for the domain domainname is not responsive. The current RPC call from Netlogon on \\SERVERX to \\serverY.domainname has been cancelled. (Actual server names/domain name not shown in text).
It happens on a random basis and users then start to notice that the server is non-responsive, until it seems to grind to a halt. We then have to hard reboot using the power button, the server won't even shut down.
We have two domain controllers that also act as wins servers and the error may point to either of the controllers.
I read MS article - http://technet.microsoft.com/en-us/library/bb727055.aspx and checked the dns. Both controllers are listed as wins lookup, name servers and both have host records.
I'm not sure where to look next with this one. The MS article suggests potential rpc call problems.
ASKER
Hi,
I read the articles and having just completed a rbuild of one of the Terminal servers, I have set all printers (all HP 4000 series) to use 4250 drivers - so far things seem ok. Will monitor for a few days more - thanks.
I read the articles and having just completed a rbuild of one of the Terminal servers, I have set all printers (all HP 4000 series) to use 4250 drivers - so far things seem ok. Will monitor for a few days more - thanks.
ASKER
Spoke too soon - the one of the Terminal Servers has had the same error again and locked up - only forcing reboot by poer off/on would work.
Did you just install the base drivers, or did you also install the printer management software? That often is the cause.
However, you may be having hardware issues, such as memory issues, or some app that's causing the problem. Any errors in the event logs on the terminal servers?
However, you may be having hardware issues, such as memory issues, or some app that's causing the problem. Any errors in the event logs on the terminal servers?
ASKER
Sorry for the delay, but I've been out of the office and there has only been one incident in the last couple of week. I updated only the HP driver. There's error msgs keep appearing in the logs on the DC that's reported as being non-responsive in the eventid 5783 errors on the Termnal Server. The errors in the DC log occur roughly every hour and one appeared just before the last lockup. The error is:
Source: MrxSmb
Type: Error
Event: Code 8003
Computer: ServerY
Description:
The master browser has received a server announcement from the computer XXXSERVER that believes that it is the master browser for the for the domain on transport NetBT_Tcpip_(36D5D40E-B09A
ServerY is the DC and XXXSERVER is a Unix machine on our network that provides Internet firewall services. I checked on the Unix machine, as it has a feature that allows it to be the Master Browser. The feature is turned off. I've contacted the firewall manufacturer about this proble, but so far no response.
Since the last crash, I've swapped the network card on the DC and so, no Terminal Server crashes, but still hourly Event ID 8003 msgs.
I'm keeping this incident open for a while longer and keeping an eye on the Terminal Servers.
Source: MrxSmb
Type: Error
Event: Code 8003
Computer: ServerY
Description:
The master browser has received a server announcement from the computer XXXSERVER that believes that it is the master browser for the for the domain on transport NetBT_Tcpip_(36D5D40E-B09A
ServerY is the DC and XXXSERVER is a Unix machine on our network that provides Internet firewall services. I checked on the Unix machine, as it has a feature that allows it to be the Master Browser. The feature is turned off. I've contacted the firewall manufacturer about this proble, but so far no response.
Since the last crash, I've swapped the network card on the DC and so, no Terminal Server crashes, but still hourly Event ID 8003 msgs.
I'm keeping this incident open for a while longer and keeping an eye on the Terminal Servers.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
The Terminal Server is a member of a domain. There are two domain controllers, both provide AD aware DNS services. One of the DNS servers (ServerY) has a forwarder, the other (ServerX) does not.
At present the TCP/IP DNS and WINS settings on the Terminal Server network card point to ServerX first, then ServerY - things seem to be more stable this way, with only two crashes in almost as many months.
On the two Domain controllers, the WINS setting on each server's network card points to itself and the DNS settings on the cards lists ServerY (the one with the forwarder) first, followed by ServerX.
When checking the DNS server properties for the domain on both DC servers, both the DNS and WINS servers are listed ServerY (the one with the forwarder) then ServerX. ServerY is not easy to check for network card settings, as the connection disappears from the Network and Dial Up Connections list (and the icon from the Windows Taskbar) when the server has been running for a couple of days after a reboot.
With the recession starting to ease, I've now got management approval to purchase new DCs and Terminal Servers over the next few monts. I'm hopeful that the guys who install the servers will be able put an end to these problems.
At present the TCP/IP DNS and WINS settings on the Terminal Server network card point to ServerX first, then ServerY - things seem to be more stable this way, with only two crashes in almost as many months.
On the two Domain controllers, the WINS setting on each server's network card points to itself and the DNS settings on the cards lists ServerY (the one with the forwarder) first, followed by ServerX.
When checking the DNS server properties for the domain on both DC servers, both the DNS and WINS servers are listed ServerY (the one with the forwarder) then ServerX. ServerY is not easy to check for network card settings, as the connection disappears from the Network and Dial Up Connections list (and the icon from the Windows Taskbar) when the server has been running for a couple of days after a reboot.
With the recession starting to ease, I've now got management approval to purchase new DCs and Terminal Servers over the next few monts. I'm hopeful that the guys who install the servers will be able put an end to these problems.
http://www.msterminalservices.org/articles/hunt-bad-printer-driver.html
http://www.msterminalservices.org/articles/Managing-Printer-Drivers.html