workstation hangs but mouse still works and can ping

I have several workstations all built from the same image though not all are the same model of desktop. Usually what seems to happen is once the computer has been idle for a while and the screensaver kicks on the computer can lock up. When you return to move the mouse and wake it up the screensaver locks. You can still move the mouse though. You can ping the computer from anywhere on the network but you cannot access tasklist/event viewer/computer management/services remotely. The only thing to do is to power cycle the computer. We have tried waiting as long as an entire weekend and the computer never unfreezes on it's own.

Below is an image of the information that preceeds the freeze. I have tried removing the Search feature but that has not stopped the errors from coming, or stopped the freeze from happening
 Event Viewer
All the errors are variations of this message:
Log Name:      Application
Source:        Microsoft-Windows-Search
Date:          5/7/2011 12:57:53 AM
Event ID:      10023
Task Category: Gatherer
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      Workstation
Description:
The protocol host process 6068 did not respond and is being forcibly terminated {filter host process 0}.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="32768">10023</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-05-07T04:57:53.000000000Z" />
    <EventRecordID>9448</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>Workstation</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">
    </Data>
    <Data Name="ProtocolHostProcessID">6068</Data>
    <Data Name="FilterHostProcessID">0</Data>
  </EventData>
</Event>
jaytwillAsked:
Who is Participating?
 
Paul MacDonaldDirector, Information SystemsCommented:
I think the Search error is a red herring.  Try using the "blank screen" screen saver (if you're not already) and make sure your video driver is up to date.  Also, check the power settings to see if the hard drives spin down after a certain amount of idle time.
0
 
BillSystems AdministratorCommented:
>once the computer has been idle for a while and the screensaver kicks on the computer can lock up... built from the same image though not all are the same model of desktop...you cannot access tasklist/event viewer/computer management/services remotely

The computer doesn't seem to be waking up properly after power save features have kicked in.
It sounds like there might be a problem with the image.
And it sounds like it might possibly be a setting and/or driver issue.

-Check the power saving features in the control panel:  whether the hard disk goes to sleep, etc.  Perhaps you might consider changing those to be somewhat less power saving, like keeping the hard disk spinning for example.
-On the machine you took the image from, does it work properly or does it have this same issue?
-If so can you deploy the image to an identical machine (with identical firmware, cards, etc.)
-There's nothing in the event viewer log?
-Can you use a screen saver without a password? (workaround)
-You might also try updating all of the hardware drivers, BIOS, and apply any Microsoft patches/service packs.  That's a shotgun approach but does cover the bases.
0
 
jaytwillAuthor Commented:
paulmacd
have a bunch of policies in place to prevent changing so having to workaround that. video drivers are up to date and have check power settings

TSGITDept:
Power Options are all set to high performance and then under advanced settings the hard drive is set to Never Turn off Hard Disk.On the image standard and the images that are deployed.
Yes it does work fine on the pc the image was captured from.

There is nothing in the Event Viewer other than what I have already posted.
Cannot use screensaver without password. State mandates
Have updated everything without sucess
0
Cloud Class® Course: Python 3 Fundamentals

This course will teach participants about installing and configuring Python, syntax, importing, statements, types, strings, booleans, files, lists, tuples, comprehensions, functions, and classes.

 
Steven CarnahanNetwork ManagerCommented:
0
 
jaytwillAuthor Commented:
got around policies by simply deleting the scr file so have eliminated that potential issue.
power options have been checked computer are still locking up though now they are not always waiting for inactivity to lock up. This morning I had one that was clearly active but then ground to a halt, nothing responding, could not bring up task manager and no HDD LED on the desktop itself. I held the power button to shut it down and then brought it back up and again the only thing in the event viewer is these Gatherer errors Capture of gatherer errors
0
 
BillSystems AdministratorCommented:
Have you tried calling the manufacturer?
Perhaps there's a driver or firmware problem the can help with.
0
 
jaytwillAuthor Commented:
It is happening on Dell's and HP's so I have not called the manufacturer.
0
 
Steven CarnahanNetwork ManagerCommented:
Have you tried stopping the Indexing service?
0
 
jaytwillAuthor Commented:
sorry for the very late reply.... yes I have stopped the service, have also tried uninstalling it and windows search and all the different combinations I can think of. I still had the problems. I have since opened a ticket with Microsoft. They had me put in some reg settings so the next time it happens I can send them a ton of information. Of course it suddenly disappeared after putting these settings in.
0
 
Steven CarnahanNetwork ManagerCommented:
It seems to work that way.  Frustrating isn't it?  Well if it happens again and you get an answer from Microsoft, please let us know.
0
 
jaytwillAuthor Commented:
have been tied up with other issues but just to update this issue....
Microsoft dump analysis has indicated drivers from Novell and Trend Micro are causing the computer to enter an unresponsive state.
I had updated Novell and it still happened again.
Trend Micro has been uninstalled so I am now waiting to see if it happens again.
Also working on updating Trend Micro on all clients across the organization
0
 
Steven CarnahanNetwork ManagerCommented:
Thank you for getting back to us.  I would never have thought of Novell or Trend Micro.  We moved away from Novell several years ago and just recently (about 9 months) quit using Trend Micro. We never had this issue with either product though.
0
 
jaytwillAuthor Commented:
This may be a little bit early to call but it does seem that updating the Novell Client and Trend Micro has solved the problem. I am going to close this ticket
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.