Solved

sbs 2003 hangs at applying computer settings

Posted on 2013-06-25
9
781 Views
Last Modified: 2016-11-23
the last two disks in a dell poweredge 2900 5-disk raid 5 configuration were accidentally removed and the server went down.  the controller lost its configuration and after re-inserting the disks, the perc 6/i showed the disks in a foreign status.  after removing all disks, clearing the controller configuration and importing the foreign disks, the server spent several minutes deleting corrupt attribute records, deleting orphaned file records, and correcting indexes.  

amazingly, it will boot into safe mode with networking, but during normal boot, it hangs at applying computer settings.

the event viewer has little information to work from.  i've tried disabling apcpbeagent, exchange information store, exchange system attendent and distributed transaction coordinator services.  none seem to help.

although the system is hanging at the console and disconnects remote desktop, i am able to authenticate at a client, access the filesystem shares and access exchange.

i'd appreciate any advice.
0
Comment
Question by:tj-a
  • 5
  • 2
  • 2
9 Comments
 
LVL 3

Expert Comment

by:dheiert
ID: 39274484
Try last known good on boot.  I see this often but it usually has to do with A/D.  Is this a DC as well?
0
 
LVL 24

Assisted Solution

by:Sandeshdubey
Sandeshdubey earned 500 total points
ID: 39274811
It seems that some windows/third party services are not starting correctly and hang at applying computer setting.Have you tried clean boot(Disable all third party service and reboot) and check.Also if this server is DC then check the inetegrity of AD database too.
0
 

Author Comment

by:tj-a
ID: 39276291
thanks dheirert. i haven't tried last know good because, as i understand it, that applies to hardware/driver configurations rather than OS specific configurations.  if that's the case, i don't want to roll back to a previous hardware/driver configuration.  if it applies to the OS as well, let me know and i'll give it a shot.

since this is a sbs 2003, it is the dc.
0
 

Author Comment

by:tj-a
ID: 39276297
thanks sandeshdubey.  i'll try disabling third party services.  what is the more reliable way to check ad integrity?
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 24

Expert Comment

by:Sandeshdubey
ID: 39277545
For integrity check this http://support.microsoft.com/kb/258062 also perform semantic database analysis
0
 
LVL 3

Expert Comment

by:dheiert
ID: 39277696
Last known good won't hurt anything and if it starts it may detect your driver issue and correct it.
0
 

Accepted Solution

by:
tj-a earned 0 total points
ID: 39280127
so i got further with the issue and can now boot.  i did a last known good, but the system would still hang.  i disabled backup exec, exchange, java, google and symantec.  it booted!

i restored the backup exec settings to kick off a backup, since they haven't had a good full recently!

after the backup, i restored the exchange services and it still booted, but had issues with the exchange routing engine.  that had an issue with the iis admin dependency.  iis admin was hanging because of a corrupt c:\windows\system32\inetsrv\metabase.xml.  i restored that file from the previous day (c:\windows\system32\inetsrv\history) and it booted.

i was able to start exchange, send and receive email ... until a remote device accessed the server, via https, which started 'server activesync' 3005 errors for 15 second every 15, or so,  seconds.  it's filling the event log.

i found the exchange mta server had stopped after this began and restarted, but still email wasn't going in OR out.

i restarted the server and now i have outgoing, but no incoming email.  there are no errors in the eventlog except for the following:

Event Type:      Information
Event Source:      MSDTC
Event Category:      SVC
Event ID:      4143
Date:            6/26/2013
Time:            7:12:35 PM
User:            N/A
Computer:      EM
Description:
MS DTC has detected that a DC Promotion has happened since the last time the MS DTC service was started.


Event Type:      Warning
Event Source:      MSDTC
Event Category:      SVC
Event ID:      53258
Date:            6/26/2013
Time:            7:12:35 PM
User:            N/A
Computer:      EM
Description:
MS DTC could not correctly process a DC Promotion/Demotion event. MS DTC will continue to function and will use the existing security settings. Error Specifics: d:\nt\com\complus\dtc\dtc\adme\uiname.cpp:9351, Pid: 1520
No Callstack,
 CmdLine: C:\WINDOWS\system32\msdtc.exe

Data:
0000: 05 00 07 80               ...¿    


Event Type:      Warning
Event Source:      MSDTC
Event Category:      SVC
Event ID:      53258
Date:            6/26/2013
Time:            7:12:35 PM
User:            N/A
Computer:      EM
Description:
MS DTC could not correctly process a DC Promotion/Demotion event. MS DTC will continue to function and will use the existing security settings. Error Specifics: %1


Event Type:      Warning
Event Source:      SQLBrowser
Event Category:      None
Event ID:      3
Date:            6/26/2013
Time:            7:12:38 PM
User:            N/A
Computer:      EM
Description:
The configuration of the AdminConnection\TCP protocol in the SQL instance BKUPEXEC is not valid.


Event Type:      Warning
Event Source:      SQLBrowser
Event Category:      None
Event ID:      3
Date:            6/26/2013
Time:            7:12:38 PM
User:            N/A
Computer:      EM
Description:
The configuration of the AdminConnection\TCP protocol in the SQL instance MICROSOFT##SSEE is not valid.


Event Type:      Error
Event Source:      Windows SharePoint Services 2.0
Event Category:      None
Event ID:      1000
Date:            6/26/2013
Time:            7:12:39 PM
User:            N/A
Computer:      EM
Description:
#50070: Unable to connect to the database STS_Config on em\SharePoint.  Check the database connection information and make sure that the database server is running.


Event Type:      Warning
Event Source:      WinMgmt
Event Category:      None
Event ID:      5603
Date:            6/26/2013
Time:            7:13:14 PM
User:            NT AUTHORITY\SYSTEM
Computer:      EM
Description:
A provider, PerfProv, has been registered in the WMI namespace, ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the HostingModel property.  This provider will be run using the LocalSystem account.  This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.  Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.  


Event Type:      Warning
Event Source:      WinMgmt
Event Category:      None
Event ID:      5603
Date:            6/26/2013
Time:            7:13:14 PM
User:            NT AUTHORITY\SYSTEM
Computer:      EM
Description:
A provider, PerfProv, has been registered in the WMI namespace, ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the HostingModel property.  This provider will be run using the LocalSystem account.  This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.  Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.  


Event Type:      Warning
Event Source:      Perflib
Event Category:      None
Event ID:      2003
Date:            6/26/2013
Time:            7:13:15 PM
User:            N/A
Computer:      EM
Description:
The configuration information of the performance library "C:\WINDOWS\system32\aspperf.dll" for the "ASP" service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.


Event Type:      Warning
Event Source:      Perflib
Event Category:      None
Event ID:      1016
Date:            6/26/2013
Time:            7:13:16 PM
User:            N/A
Computer:      EM
Description:
The data buffer created for the "EXOLEDB" service in the "C:\Program Files\Exchsrvr\bin\exodbpc.dll" library is not aligned on an 8-byte boundary. This may cause problems for applications that are trying to read the performance data buffer. Contact the manufacturer of this library or service to have this problem corrected or to get a newer version of this library.

Data:
0000: 84 0d c4 00 04 15 00 00   ¿.Ä.....


Event Type:      Warning
Event Source:      Perflib
Event Category:      None
Event ID:      1016
Date:            6/26/2013
Time:            7:13:17 PM
User:            N/A
Computer:      EM
Description:
The data buffer created for the "MSExchangeIS" service in the "C:\Program Files\Exchsrvr\bin\mdbperf.dll" library is not aligned on an 8-byte boundary. This may cause problems for applications that are trying to read the performance data buffer. Contact the manufacturer of this library or service to have this problem corrected or to get a newer version of this library.

Data:
0000: f8 39 ce 00 e4 2b 00 00   ø9Î.ä+..


Event Type:      Warning
Event Source:      Perflib
Event Category:      None
Event ID:      2003
Date:            6/26/2013
Time:            7:13:17 PM
User:            N/A
Computer:      EM
Description:
The configuration information of the performance library "C:\WINDOWS\system32\sqlctr90.dll" for the "MSSQL$BKUPEXEC" service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.


Event Type:      Information
Event Source:      Server ActiveSync
Event Category:      None
Event ID:      3025
Date:            6/26/2013
Time:            7:20:23 PM
User:            N/A
Computer:      EM
Description:
IP-based AUTD has been initialized.


Event Type:      Error
Event Source:      Server ActiveSync
Event Category:      None
Event ID:      3005
Date:            6/26/2013
Time:            7:20:24 PM
User:            
Computer:      EM
Description:
Unexpected Exchange mailbox Server error: Server: [] User: [] HTTP status code: [500]. Verify that the Exchange mailbox Server is working correctly.

(this one keeps repeating)

most of these appear to be unrelated or performance related, but wanted to share all in case there is a bigger picture i'm not seeing.
0
 

Assisted Solution

by:tj-a
tj-a earned 0 total points
ID: 39286028
i just finished a support call with microsoft.  after an hour of diagnosis and removing symantec endpoint protection, the issues were resolved.  case closed!
0
 

Author Closing Comment

by:tj-a
ID: 39296025
sandeshdubey put me on the right track for resolving the boot issues by disabling 3rd party services.

once email seemed to work, we found all email with attachments was being discarded when sent externally to internal mailboxes.  if attachments existed in mailboxes or internal was created with attachments, it was inaccessible via outlook and webmail.  

microsoft isolated the strange activesync and attachment issues as an issue with sep.
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

The problem of the system drive in SBS 2003 getting full continues to be an issue, even though SBS 2008 and SBS 2011 are both in the market place.  There are several solutions to this, including adding additional drive space or using third party uti…
Because virtualization becomes more and more common, and, with Microsoft Hyper-V included in Windows Server at no additional costs, and, most server hardware nowadays is more than capable of running a physical Small Business Server (SBS) 2008 or 201…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now