Solved

SBS 2011 Server keeps auto rebooting after RPC server error and exchange errors

Posted on 2013-10-31
10
2,218 Views
Last Modified: 2013-11-04
Hi Everyone,

Have a strange one here. We have a SBS2011 server that just keeps failing and eventually auto rebooting on it own, I have review the system logs and they are as follows:

1) It starts to fail with some DistributedCOM-Event ID 10009 errors

2) Then Service Control Manager error - event ID 7031 - The RPC Endpoint Mapper service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 120000 milliseconds: Restart the service.

3) That is when everything then goes haywire as we get as then we get another event ID 7031 when the service fails to restart

4) Then other dependent services start to crash with event ID's 7001, 7023, 7032

5) Then group policy errors with event ID 1007

6) Then schannel errors with event ID 36870 then eventually a kernel-power error and the server auto reboots

After the reboot system takes a while to come back online but eventually works again for a while but repeats these errors approximately every 1 hour

This is a VM server running on Esxi 5.0.1 and has all the latest VM drivers installed.

I am not sure what to do next as we are not getting any hardware issues on the unit (in heath status in VMWare) and it does not seem to be a resource or performance issue. Also have run chkdsk /f from safe mode and no issues found. All we have been able to determine is once the RPC service fails there is little we can do except reboot the server manually through a command prompt.

Any help you could provide with be great.

thanks,

Spencer
0
Comment
Question by:TheSonicGod
  • 4
  • 2
  • 2
  • +2
10 Comments
 
LVL 38

Assisted Solution

by:Adam Brown
Adam Brown earned 100 total points
ID: 39615498
Is your server up to date on updates? Make sure all of the latest Windows server 2008 R2, Exchange 2010, and SBS 2011 updates and service packs are installed on the server and see if that resolves the issue.
0
 

Author Comment

by:TheSonicGod
ID: 39615965
Thanks for the suggestion acbrown2010,

I have run all the updates that were available and SBS2011 SP1 was already installed for this server.

I rebooted the server after the updates and it would not even let me log in. I forced a reboot again and now that it is back up I reviewed the logs and there are about 1000 warnings in the system logs for the time I could not login - which all say about the same - they are as follows:

Source: WAS  Event ID: 5009  Desc 1:  A process serving application pool 'SBS Web Applications application pool' terminated unexpectedly. The process id was '7888'. The process exit code was '0xffffffff'.

Desc 2: A process serving application pool 'MSExchangeServicesAppPool' terminated unexpectedly. The process id was '9000'. The process exit code was '0xffffffff'.

Desc 3: A process serving application pool 'MSExchangeOWAAppPool' terminated unexpectedly. The process id was '1060'. The process exit code was '0xffffffff'.

The process id number changes on each entry. I reviewed the logs further going back to when the system locked up prior to the updates to see if these errors were also there and for some of the lockup there were and for the other reboots they were not there only the prior errors as listed in prior entry.

Ran Windows Server Solutions Best Practices Analyzer 1.0 and it advised that Exchange SP2 was not installed on this server so I tried to install it and it fails on the first part of the install 'Configuring Prerequisite'  - it fails with the error Service (WinMGMT) cannot be configured due to the following error: 'Access is Denied' - I was running it as the domain admin so it is not a security access issue,

Searched for this error online and there is nothing - not sure where to go next.

thanks in advance for your replies.

Spencer
0
 
LVL 12

Assisted Solution

by:Gary Coltharp
Gary Coltharp earned 50 total points
ID: 39616624
I have seen querky issues like this with a corrupt paging file. You can try removing the paging file through the performance settings, rebooting and readding a system managed paging file.



HTH

Gary
0
 

Author Comment

by:TheSonicGod
ID: 39617217
Thanks for your suggestion gcoltharp.

Prior to updating the pagefile, the server was rebooted and came up with a File Name Warning - "There is a program in your computer called "C:\Program" which could cause certain applications to not function correctly.  Renaming it to "C:\Program1" would solve this problem.  Would you like to rename it now?" - Rename OR Ignore

fie name warning error on startup
Checked the folder, nothing was in  it (0 bytes), clicked on rename.

The page file was removed and server rebooted - it ran for about 45 minutes and the server rebooted again.

Thanks in advance for any replies ...
0
 
LVL 12

Expert Comment

by:Gary Coltharp
ID: 39617330
suspicious... antivirus installed on this server?
0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 

Author Comment

by:TheSonicGod
ID: 39617654
blew away all pagefile settings and left it turned off - Exchange services as currently down again but server did not auto reboot this time - diagnosing further now
0
 
LVL 30

Expert Comment

by:Mike Lazarus
ID: 39618704
1. Dcom error - http://support.microsoft.com/kb/957713
2. SCM7031 is a password issue - http://support.microsoft.com/KB/241587
3. Can't login
4. Expected
5. GpPol1007 - http://technet.microsoft.com/en-us/library/dd392596%28v=ws.10%29.aspx
6. Schannel36870 - If the private key is not configured with the proper ACL for the network service, you usually see this. This is old, but might give an idea - http://blogs.technet.com/b/instan/archive/2009/01/05/schannel-36872-or-schannel-36870-on-a-domain-controller.aspx

I'd start with the link in #2 to sync the passwords
0
 
LVL 30

Accepted Solution

by:
Mike Lazarus earned 300 total points
ID: 39618712
You might also look at this for the RPC issue:
http://support.microsoft.com/default.aspx?scid=kb;en-US;2401588
0
 
LVL 19

Assisted Solution

by:compdigit44
compdigit44 earned 50 total points
ID: 39623003
1) Any setting changes to the server lately both at the OS and VM level?
2) Is a AV running on the server.
3) Is the a memorydump file generated?
4) Have you tried to vmotion the VM to another host?
5) Are you using a SAN? IF so, any error on the host HBA or CNA?
6) Does the VM & host have ample memory?
0
 

Author Comment

by:TheSonicGod
ID: 39623275
Hi Everyone,

Thanks for all your help - we were able to resolve the issues by disabling IPv6 and installing the hotfixes from the posting from GLComputing

Here is another article that describes what our issues were as well as how to fix it.

http://social.technet.microsoft.com/Forums/en-US/0919cef1-7980-4526-a007-0c3ddc3ab269/sbs-2011-pop3-connector-errors?forum=smallbusinessserver

The quick fix was to disable IPv6 the correct way for the SBS 2011 server using this article http://www.genisys.com.au/blog/?p=65

Apparently once the hotfixes are installed as well as SP1 (we already has this installed) you can re-enable IPv6 but we have just left it disabled at this point. We would like a few good backups and a few days of being stable before experimenting more.

Thanks again for everyone's help and assistance with this matter.

Spencer
0

Featured Post

Do email signature updates give you a headache?

Do you feel like you are constantly making changes to email signatures? Are the images not formatting how you want them to? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Intunes without company portal 3 39
Exchange 2013 dual delivery 1 8
Bounce Back Message From Specific Domain 13 38
MX Backup 4 37
Last article we focus in how to VMware: How to create and use VMs TAGs – Part 1 so before follow this article and perform the next tasks, you should read the first article how to create the TAG before using them in Veeam Backup Jobs.
Follow this checklist to learn more about the 15 things you should never include in an email signature from personal quotes, animated gifs and out-of-date marketing content.
Teach the user how to use create log bundles for vCenter Server or ESXi hosts Open vSphere Web Client: Generate vCenter Server and ESXi host log bundle:  Open vCenter Server Appliance Web Management interface and generate log bundle: Open vCenter Se…
This Micro Tutorial steps you through the configuration steps to configure your ESXi host Management Network settings and test the management network, ensure the host is recognized by the DNS Server, configure a new password, and the troubleshooting…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now