I have a nasty situation going on with a Citrix Presentation Server (v4.5). This server is hosted on a Dell PowerEdge 2900 running Windows Server 2003 R2 with all service packs and Windows updates (except for the last few days updates). One day earlier this week, I got a call that no users could get into published apps on the Citrix server. I immediately jumped online to check it out. I could get into the server via RDP and through a Program Neighborhood desktop session, but none of my published apps would run. It mentioned that the ICA browser could not be contacted and I was having network problems. The other symptoms were a missing TCP address on the Zone/Servers screen in the Access Management Console and an error with lmgrd.exe (memory read error) when shutting down and rebooting the server.
There was an update to Goldmine and an installation of Mappoint by another group the week before, and the server had not yet been rebooted until this problem occurred. An automatic Windows update (not the normal setting) caused an update, and the server was not able to service Published Apps after that. I tried my best to bring it back - scanned for virus/other activity (finding none), stopping and restarting services, cleaning up temp files, etc., but nothing worked. Finally, I restored an image of the volumes from Backup Exec System Recovery and I was back to square one, working again. However, I've had to do two more recoveries of the server, once due to an automatic update reboot (didn't turn it off after a restore) and once due to a strange mid-day reboot of the server, from what looked like a svchost process.
I know this is going to happen again, and I can't keep restoring the server's boot image every time. Has anyone ever seen this type of activity before? Any idea of where to go next for troubleshooting? Users of this server all use Application Set Settings from Program Neighborhood to launch the applications - and it's worked fine for almost 3 years now. In the mean time, I'm building another Citrix server - XenApp 5 FR3 - as a potential replacement. Thanks ahead for any help or advice!