SBS 2003 no users can login, passwords not accepted

SBS 2003, no recent changes, users working out yesterday. today no one can login, including administrator - just says password is incorrect. I am not on site but I'm thinking something corrupt or and issue with the logon service. May have to have them power down in the morning, I believe I had this happen several years ago at a different server and after powering down they seemed to be ok, possibly resource issue.
Owa gets 440 Login time out error.
RWW does not come up with the normal login screen, a popup window instead of the regular screen.
People in the office earlier could not login at their workstations, same thing as if the password had been changed.
I can get to the login screen via Teamviewer but nothing works. No troubleshooting I can do tonight but amwondering if anyone else has had this problem?
LVL 1
dpachecoAsked:
Who is Participating?
 
Gareth GudgerConnect With a Mentor Commented:
I am curious if you can log on via the console session. Possibly reboot the server. Could be the NETLOGON service stopped. I assume this is a single server environment?
0
 
dpachecoAuthor Commented:
Single server, yes. I am not physically at the site, and when I connect with Teamviewer I get the login screen but you can't shutdown/restart without logging in. Can't connect via VPN because it says the password is incorrect.
0
 
WORKS2011Austin Tech CompanyCommented:
By chance does anyone have the admin password other than you or an account with admin rights? Did they or could they have made any changes? This isn't much of a solution other than trying to determine if someone has made a change as apposed to trying to isolate a problem.
0
Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
dpachecoAuthor Commented:
No one has changed it. It's not just the administrator password, no users can log in.
0
 
Walter CurtisSharePoint AEDCommented:
The server should be restarted. The netlogon service is hung and should start working correctly after the restart. Of course, you may not be able to login to restart and a remote restart is probably not possible. You may have to do a hard restart, meaning have someone at the site push the on off switch just long enough for the server to shutdown. If it does not shutdown then hold in the power switch until the server is off. Wait at least two minutes and then power back on.

Hope that helps
0
 
dpachecoAuthor Commented:
Yes that's what we'll do in the morning. I'll let you know. Thanks.
0
 
Alan HardistyCo-OwnerCommented:
It could be that the server has been hacked!

Do you leave port 3389 open to it?

What other ports are open and forwarded to it?

Alan
0
 
dpachecoAuthor Commented:
3389 not open. 1723, 25, 4125, 443 open
0
 
dpachecoAuthor Commented:
After a hard boot everyone is able to login with current passwords. I'm still investigating but
there are multiple KDC errors, event ID 7 starting 8:30am yesterday morning.
I don't see any hardware errors on the drives or raid array/controller from open manage (this is a Dell PowerEdge),
0
 
Walter CurtisSharePoint AEDCommented:
Glad it is back and working for you -
Hate to say it, but it happens. I have seen it happen a handful of times over the last 15 years. You can troubleshoot the cause and spend a lot of time trying to make sure it doesn't happen again, but it will happen for sure. We just never know when it will happen, like an earthquake!

Hope I helped you a little!
0
 
dpachecoAuthor Commented:
Thanks, I'm not really seeing anything as the cause. I do need to update firmware and drivers for the perc controller but that is nothing new. At the time this happened, 8:30am sunday morning there was no one on the system but the SBS backup had started at 1am so it was still running but looks like it continued to run thru this problem until it tried to backup Exchange. I think you are right I'm not sure I'll be able to figure out why it happened.
0
 
Gareth GudgerCommented:
You may not have anything in the logs, but check if you have huge gaps of time in your Event Viewer around the time this server was unavailable.
0
 
dpachecoAuthor Commented:
No huge gaps in time, about 20 minutes between the last log entry (informational) and the KDC errors starting in both application and system log.
0
 
dpachecoAuthor Commented:
I don't know how to award points on this, restarting the server solved it. I don't know what cause the problem and it has not reoccurred, I do know they were not hacked.
0
 
Walter CurtisSharePoint AEDCommented:
Only a few people told you to reboot. What solved the problem? Rebooting the server. Split the points between them. Sounds good to me, especially since I was one that old you to reboot. :-)
0
 
Alan HardistyCo-OwnerCommented:
The first person to mention rebooting the server was diggisaur in the very first comment, so if anyone should be awarded points, they should be going in his direction.

"I  am curious if you can log on via the console session. Possibly reboot the server. Could be the NETLOGON service stopped. I assume this is a single server environment?"

Alan
0
 
dpachecoAuthor Commented:
I was actually not able to restart, we had to do a hard boot but this did solve the problem.
0
 
Walter CurtisSharePoint AEDCommented:
Going by that standard, I was the first one to mention a hard restart. (Power on and off.) but glad you got your problem fixed.
0
 
dpachecoAuthor Commented:
Thanks! I just brought up that it was a hard boot not a restart so that if anyone else has the issue they would know what I did.
0
 
Alan HardistyCo-OwnerCommented:
Noted and appreciated.

Alan
0
 
Walter CurtisSharePoint AEDCommented:
Just having fun and trying to help. Didn't know humor was something to avoid around here.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.