Solved

SBS 2003 no users can login, passwords not accepted

Posted on 2014-01-26
22
440 Views
Last Modified: 2014-03-14
SBS 2003, no recent changes, users working out yesterday. today no one can login, including administrator - just says password is incorrect. I am not on site but I'm thinking something corrupt or and issue with the logon service. May have to have them power down in the morning, I believe I had this happen several years ago at a different server and after powering down they seemed to be ok, possibly resource issue.
Owa gets 440 Login time out error.
RWW does not come up with the normal login screen, a popup window instead of the regular screen.
People in the office earlier could not login at their workstations, same thing as if the password had been changed.
I can get to the login screen via Teamviewer but nothing works. No troubleshooting I can do tonight but amwondering if anyone else has had this problem?
0
Comment
Question by:dpacheco
  • 10
  • 5
  • 3
  • +2
22 Comments
 
LVL 30

Accepted Solution

by:
Gareth Gudger earned 500 total points
Comment Utility
I am curious if you can log on via the console session. Possibly reboot the server. Could be the NETLOGON service stopped. I assume this is a single server environment?
0
 
LVL 1

Author Comment

by:dpacheco
Comment Utility
Single server, yes. I am not physically at the site, and when I connect with Teamviewer I get the login screen but you can't shutdown/restart without logging in. Can't connect via VPN because it says the password is incorrect.
0
 
LVL 17

Expert Comment

by:WORKS2011
Comment Utility
By chance does anyone have the admin password other than you or an account with admin rights? Did they or could they have made any changes? This isn't much of a solution other than trying to determine if someone has made a change as apposed to trying to isolate a problem.
0
 
LVL 1

Author Comment

by:dpacheco
Comment Utility
No one has changed it. It's not just the administrator password, no users can log in.
0
 
LVL 14

Expert Comment

by:SneekCo
Comment Utility
The server should be restarted. The netlogon service is hung and should start working correctly after the restart. Of course, you may not be able to login to restart and a remote restart is probably not possible. You may have to do a hard restart, meaning have someone at the site push the on off switch just long enough for the server to shutdown. If it does not shutdown then hold in the power switch until the server is off. Wait at least two minutes and then power back on.

Hope that helps
0
 
LVL 1

Author Comment

by:dpacheco
Comment Utility
Yes that's what we'll do in the morning. I'll let you know. Thanks.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
Comment Utility
It could be that the server has been hacked!

Do you leave port 3389 open to it?

What other ports are open and forwarded to it?

Alan
0
 
LVL 1

Author Comment

by:dpacheco
Comment Utility
3389 not open. 1723, 25, 4125, 443 open
0
 
LVL 1

Author Comment

by:dpacheco
Comment Utility
After a hard boot everyone is able to login with current passwords. I'm still investigating but
there are multiple KDC errors, event ID 7 starting 8:30am yesterday morning.
I don't see any hardware errors on the drives or raid array/controller from open manage (this is a Dell PowerEdge),
0
 
LVL 14

Expert Comment

by:SneekCo
Comment Utility
Glad it is back and working for you -
Hate to say it, but it happens. I have seen it happen a handful of times over the last 15 years. You can troubleshoot the cause and spend a lot of time trying to make sure it doesn't happen again, but it will happen for sure. We just never know when it will happen, like an earthquake!

Hope I helped you a little!
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 1

Author Comment

by:dpacheco
Comment Utility
Thanks, I'm not really seeing anything as the cause. I do need to update firmware and drivers for the perc controller but that is nothing new. At the time this happened, 8:30am sunday morning there was no one on the system but the SBS backup had started at 1am so it was still running but looks like it continued to run thru this problem until it tried to backup Exchange. I think you are right I'm not sure I'll be able to figure out why it happened.
0
 
LVL 30

Expert Comment

by:Gareth Gudger
Comment Utility
You may not have anything in the logs, but check if you have huge gaps of time in your Event Viewer around the time this server was unavailable.
0
 
LVL 1

Author Comment

by:dpacheco
Comment Utility
No huge gaps in time, about 20 minutes between the last log entry (informational) and the KDC errors starting in both application and system log.
0
 
LVL 1

Author Comment

by:dpacheco
Comment Utility
I don't know how to award points on this, restarting the server solved it. I don't know what cause the problem and it has not reoccurred, I do know they were not hacked.
0
 
LVL 14

Expert Comment

by:SneekCo
Comment Utility
Only a few people told you to reboot. What solved the problem? Rebooting the server. Split the points between them. Sounds good to me, especially since I was one that old you to reboot. :-)
0
 
LVL 76

Expert Comment

by:Alan Hardisty
Comment Utility
The first person to mention rebooting the server was diggisaur in the very first comment, so if anyone should be awarded points, they should be going in his direction.

"I  am curious if you can log on via the console session. Possibly reboot the server. Could be the NETLOGON service stopped. I assume this is a single server environment?"

Alan
0
 
LVL 1

Author Closing Comment

by:dpacheco
Comment Utility
I was actually not able to restart, we had to do a hard boot but this did solve the problem.
0
 
LVL 14

Expert Comment

by:SneekCo
Comment Utility
Going by that standard, I was the first one to mention a hard restart. (Power on and off.) but glad you got your problem fixed.
0
 
LVL 1

Author Comment

by:dpacheco
Comment Utility
Thanks! I just brought up that it was a hard boot not a restart so that if anyone else has the issue they would know what I did.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
Comment Utility
Noted and appreciated.

Alan
0
 
LVL 14

Expert Comment

by:SneekCo
Comment Utility
Just having fun and trying to help. Didn't know humor was something to avoid around here.
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

I've often see, or have been asked, the question about the difference between the Exchange 2010 SP1 version, available as part of Small Business Server (SBS) 2011, and the “normal” Exchange 2010 SP1 Standard. The answer to the question is relativ…
Because virtualization becomes more and more common, and, with Microsoft Hyper-V included in Windows Server at no additional costs, and, most server hardware nowadays is more than capable of running a physical Small Business Server (SBS) 2008 or 201…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now