SBS2008 server problem every monday 2am

I've SBS2008 server unresponsive every monday morning for the past 3 weeks: users can't logon to domain or Exchange store is offline etc. Server console appears to have crashed although mouse moves... Remote access software Logmein free shows server as online but unable to logon. Can't use RDP as well.The only option is to power down & restart which resolves.

I recently installed GFImax monitoring agent on this server. This refreshes server status every 15 minutes. Last monday it lost contact around 2am. I've checked windows event logs: server has continued to record events beyond 2am.

GFImax fault report shows following for period 1st April -15th April:
"CLIENT","Site","Server","Check","Error Count","From","To","Failed_hr","Failed_percent"
"ACME","Main","SERVER1","Windows Service Check - Group Policy Client","1","2010-04-04","2010-04-04","0.53","0.15"
"ACME","Main","SERVER1","Windows Service Check - Distributed Transaction Coordinator","3","2010-04-04","2010-04-12","0.75","0.21"
"ACME","Main","SERVER1","Windows Service Check - Microsoft Exchange Anti-spam Update","1","2010-04-04","2010-04-04","0.25","0.07"
"ACME","Main","SERVER1","Windows Service Check - Microsoft Exchange File Distribution","1","2010-04-04","2010-04-04","0.25","0.07"
"ACME","Main","SERVER1","Windows Service Check - Microsoft Exchange Search Indexer","1","2010-04-04","2010-04-04","0.25","0.07"
"ACME","Main","SERVER1","Windows Service Check - Routing and Remote Access","1","2010-04-04","2010-04-04","0.25","0.07"
"ACME","Main","SERVER1","Windows Service Check - World Wide Web Publishing Service","1","2010-04-04","2010-04-04","0.25","0.07"
"ACME","Main","SERVER1","Windows Service Check - Windows Management Instrumentation","1","2010-04-04","2010-04-04","0.25","0.07"
"ACME","Main","SERVER1","Windows Service Check - Update Services","3","2010-04-04","2010-04-12","0.75","0.21"
"ACME","Main","SERVER1","Windows Service Check - Windows Update","3","2010-04-04","2010-04-12","1.28","0.36"
"ACME","Main","SERVER1","Anti-virus Update Check - Grisoft AVG","2","2010-04-05","2010-04-09","41.89","11.64"
"ACME","Main","SERVER1","Backup Check - Microsoft Windows Backup (Vista/Server 2008)","1","2010-04-09","2010-04-10","24","6.67"

(I do see lots of events in the sbs2008 logs relating to Distributed Transaction Coordinator (DTC) for 3 workstations in the network.)

Any ideas/suggestions?

Jay_RatansiAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

shauncroucherCommented:
Is 2008 fully patched and up to date?

What do the event logs show?

Shaun
Cris HannaSr IT Support EngineerCommented:
How much RAM in the box?
How many nics enabled?
Is IPv6 disabled?
Have you run the SBS BPA and fixed everything there.
Jay_RatansiAuthor Commented:
The problem re-occurred yesterday (friday) 4am approx  ie. no longer only  a monday morning issue!

To answer both sets of questions: (a) Windows Updates : server shows updates applied last on 30th Dec. & there are 16 important updates pending. = I will apply these today; (b) RAM: 4GB = I am upgrading this to 8GB;  (c) NICs= one enabled/ only one seen under adapters; (d) IPV6 = enabled

I've run SBS BPA now & can see 1 critical error & 18 items under 'all issues'. The critical error: ,"DNS A resource record points to incorrect IP address","","","The host (A) resource record points to the incorrect IP address 192.168.0.2192.168.0.23. The record should point to 192.168.0.2.","http://invalidurlnamegiveninconfigen6". I'll correct this & go through rest.

System Event Log for issues around 4am friday include:

03.53am: error 7011: A timeout (90000 milliseconds) was reached while waiting for a transaction response from the SrvCtrl service.

04.02am: Group Policy: error 1058 : The processing of Group Policy failed. Windows attempted to read the file \\defensorfds.local\SysVol\defensorfds.local\Policies\{8D161517-D112-4371-927A-8BC9DC311321}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

shauncroucherCommented:
Yes, I'd look to update, and make sure Exchange is at SP2 Update Rollup 3.

For Exchange SP2 - use this tool: http://www.microsoft.com/downloads/details.aspx?FamilyID=FFD2FE61-9278-489E-9B96-3816394C9CB6&displaylang=de&displaylang=en

Then upgrade RAM to at least 8GB as identified.

Shaun

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Jay_RatansiAuthor Commented:
How do I resolve the sbsBPA critical error: ,"DNS A resource record points to incorrect IP address","","","The host (A) resource record points to the incorrect IP address 192.168.0.2192.168.0.23. The record should point to 192.168.0.2.","http://invalidurlnamegiveninconfigen6". I

I've opened DNS but can't see any entry with this. BTW 192.168.0.23 is used by the server for RAS
Cris HannaSr IT Support EngineerCommented:
Unfortunately that DNS record report is a false positive...a lot of folks get that as well
Regarding RAM.   Yes Microsoft says 4GB is the minimum but it's never even.  And depending on what all you have going on on the server 8 GB could be an issue as well.
Make sure you've resolved everything else in the BPA  
Windows Server 2008 SP2 is another critical.
And besides the Exchange SP and UR3
There is a SBS UR 3 that needs applying.
You most likely see a WSS 3 SP2   This one can be a problem.  There is a patch that needs to be installed before SP2...I'll try to find it
Jay_RatansiAuthor Commented:
I've upgraded RAM to 8Gb &  applied all available updates. On re-running sbsBPA the DNS critical error has vanished.

Before I work through sbsBPA, SP etc issues, I noticed that sqlservr.exe *32 is grabbing 1.4-1.5GB of RAM. The server has only the sbs2008 default installation incl. sharepoint ie. no other sql application at all. With this the physical memory usage shows at 75%. This seems excessive in comparison say with Exchange store.exe at under 0.6GB

Windows 2008 (Fujitsu-locked oem) is at SP1. I'm not offered windows sp2 via windows update. Is that normal?

Thanks
Jay
Cris HannaSr IT Support EngineerCommented:
There have been some instances where it doesn't get offered...you can go get the 64 bit from the Microsoft Download site
Jay_RatansiAuthor Commented:
Hi

where can I download SBS 2008 Update Rollup 3 from?

Thanks
Jay
shauncroucherCommented:
Here is SBS 2008 UR3: http://support.microsoft.com/kb/969121

Shaun
Jay_RatansiAuthor Commented:
After upgrading from 4GB to 8GB RAM, I'm noticing that the server is grabbing large amount of physical memory. During working hrs right now, the physical memory usage is 93% ie. 7.45GB in use. Of this sqlservr.exe *32 is grabbing 1.4-1.5GB of RAM. (The server has only the sbs2008 default installation incl. sharepoint).

sqlservr.exe *32 process appears to be the SBSMONITORING service.

I wonder if the problems encountered by the server are memory usage related ie. running out of memory & services start shutting down?
shauncroucherCommented:
It's normal. Exchange will use as much memory as you can throw at it. the memory will be released when other applications require it. It is a design change with Exchange 2007.

Shaun
Cris HannaSr IT Support EngineerCommented:
I agree with Shaun...this is normal.   I don't recall how many workstations you have, but it may be that you need to up the RAM to 12GB
Are your processors being maxed?
Jay_RatansiAuthor Commented:
using an excellent article  http://msmvps.com/blogs/bradley/archive/2005/02/04/34984.aspx  I reconfigured sqlservr.exe *33 ram from 15.GB to 400MB approx. This is working fine since Tuesday. Total server physical memory in use is  81-85% with about 1GB free.  Exchange store.exe is using 600MB approx

Server is noticeably responsive especially RWW & OWA websites.

Between 5.30am-6am, server carries out several Exchange maintenance tasks. During this time,  GFAmax monitoring issues alerts that server contact has been lost; During this time RWW & OWA & RDP can't be used. This happening for the past 3 days (I have checked that this is not due to simply losing internet connection)

Cris HannaSr IT Support EngineerCommented:
how much ram in the server now?  how many nics?  have you installed sp2 and UR3?
Jay_RatansiAuthor Commented:
Hi

The server RAM is 8GB (upgraded from 4GB) + 1NIC. The server isn't updated to UR3 or Exch.SP2.

Server is stable now. The changes that have been made (1) ram upgrade to 8GB; (2) reconfig sqlserver memory usage (see my 23rd April comment) & (3) change Exchange 2007  mailbox maintenance from daily 2-6am to weekly Sat/Sun midnight-6am, have resulted in physical memory usage of 70-75%, very responsive server, OWA & remote are fast, Group Policy: error 1058 have vanished, GFI max outages no longer reported.

I'll give it another week. If it crashes then I'll proceed to carry out all SBS BPA recommendations.

Thanks
Jay Ratansi
Cris HannaSr IT Support EngineerCommented:
There are 2 or 3 UR for Exchange SP2 and SBS 2008 is now up to UR 4
I strongly suggest getting up to speed on the rest of the updates ASAP as many issues are resolved.
Jay_RatansiAuthor Commented:
The server is stable now.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SBS

From novice to tech pro — start learning today.