Solved

File named program keeps appearing keeping services from starting.

Posted on 2014-09-03
6
151 Views
Last Modified: 2014-09-18
There was a similar issue in question titled "file named "Program" with no extension randomly created", but end result was finding related to DHCP and disabling it. We need to find resolution.

On Windows SBS 2008 server, I repeatedly have a file named Program with no extension appear at D:\ which prevents services installed to D:\Program Files from starting. I opened the file and the content is the same as result of running command "netsh dhcp show server" (server name changed):

1 Servers were found in the directory service:

      Server [server.domain.local] Address [10.0.0.100] Ds location: cn=server.domain.local

Command completed successfully.

What can I check to prevent file "D:\Program" from appearing?
0
Comment
Question by:ByteCafeSupport
  • 3
  • 2
6 Comments
 
LVL 22

Expert Comment

by:David Atkin
ID: 40301392
Very strange. Some questions:

How often are the files created?  Is there additional 'program' files that get created or does it just add to the existing file?

Any anti-virus on the server?

Which services is it stopping? Any events in the logs at the same time?

I'd consider using procmon to see which process is creating the file.
0
 

Author Comment

by:ByteCafeSupport
ID: 40302154
I haven't picked up on any particular pattern of when the file is generated. It appears to overwrite when there are changes. The only additional ones are the ones I renamed.

The contents do change. I just observed this content:

Invalid Syntax: Invalid option
Files\SAAZOD\zcmon\ApplicationLog\ZADMon\AdmonTemp_DcDiag_testConnectivity1.txt.
 Use dcdiag.exe /h for help.

I assume something was missing quotes that tried to write a text file.

Antivirus is GFI VIpre Business, with active protection currently disabled.

The service I was having trouble with when I noticed this was Cyberoam Transparent Authentication Suite for their Cyberoam firewall.

With the new contents, it may be an issue with the server monitoring agent we use.

I'll check with monitoring vendor and try procmon if that doesn't get me anywhere and report back.
0
 
LVL 22

Expert Comment

by:David Atkin
ID: 40302870
Yes I would check out your monitoring tool first, it looks like it could just be a log file.  Depending what agent you use it may run checks periodically.  Still very odd though.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 16

Accepted Solution

by:
vivigatt earned 500 total points
ID: 40303064
It seems to me that something tries to create a file (a log, a script?) in "D:\Program Files\SomePath", but the command lacked the quotation marks.
For instance, if you run the command:
netsh dhcp show server > d:\Program Files\WhatEverThePath\mylog.txt
instead of
netsh dhcp show server > "d:\Program Files\WhatEverThePath\mylog.txt"
the output of the command will be stored in a file named d:\program and not in d:\Program Files\WhatEverThePath\mylog.txt
This is because there is a white space in "d:\Program files" that is interpreted as a separator.
I would investigate that path...
0
 

Author Comment

by:ByteCafeSupport
ID: 40330652
I had the monitoring tool vendor check it out without me and they didn't find any problems. When I check it now, the files do not exist. I believe it was something trying to write out without quotes in a path, but never found what it was.
0
 

Author Closing Comment

by:ByteCafeSupport
ID: 40330660
Accepted as solution because I believe that was the issue and pointed me in a direction, even though we never found the process.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Windows Server and Folder Redirection mishap. 5 32
SBS 2003 RWW Login 3 36
DHCP scope restore question Server 2003 to 2012R2 6 59
how do i add admin console 4 26
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question