Group Policy Client sbs 2011 stops access to shared folders

I have a customer with an SBS 2011 server and windows 7 Pro client machines.
Its been in place for a couple of years with no problems.
Now they suddenly cant access mapped drives to the server, NAS box on the network, email and browsing are OK so the network is OK.

When this happens I check the services on the server and Group Policy Client has stopped, whereas it would normally say "started" it shows nothing and the only option seems to be to reboot the server as there is no "Start" option.
After reboot GPC then says started and everyone is OK for a couple of hours until it happens again.

Where can I look for a cause or has anyone else had this
Thanks
InsideviewM.D.Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

David AtkinTechnical DirectorCommented:
Hello,

Are there any other services that are stopped when this problem occurs?

Any updates or software installed since the problem first started?

Your event logs are the best place to start here.
Larry Struckmeyer MVPCommented:
Hi:
First place to look is the event viewer.  The main logs will give you a 10K view, the detail logs may offer better info to enable a fix.  

Also, please tell us what other server level systems are in place on this network.

Run the SBS BPA and fix anything it finds, then the Fix My Network wizard.  Review the event logs before and after each for errors and warnings.
InsideviewM.D.Author Commented:
Hi David,
Normally the only two "Automatic" service that DONT start on a reboot are Microsoft .NET framework NGEN x86 and x64
right at this moment 11:52am they can still access there mapped drives but normally the GP Client fails at some point.

Interestingly Windows updates did fail the night before this first happened and the updates are not now working,
Security update for Server 2008 R2 KB3046269 wont install.

Several Updates failed the night before this all happened
.net framework 3.51 KB3048070 and several security updates after it, I can post the KB's if you want them
Python 3 Fundamentals

This course will teach participants about installing and configuring Python, syntax, importing, statements, types, strings, booleans, files, lists, tuples, comprehensions, functions, and classes.

David AtkinTechnical DirectorCommented:
The two .NET services are expected not to start so don't worry about those ones.

Where any updates successfully installed the night before this happened?

As per the original comments and Larrys comment.  Have a good check through your event logs.
InsideviewM.D.Author Commented:
There are many perfnet errors. kernel-event tracing and recently a GP error below


The processing of Group Policy failed. Windows attempted to read the file \\****.local\SysVol\****.local\Policies\{C263BBC2-F0EA-4BCE-9D30-1F85BF5E0D2A}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.
InsideviewM.D.Author Commented:
on the night before the problem the were the following successful updates

4x .net framework
1x cumulative security explorer 11
5x windows server 2008 R2 x64
InsideviewM.D.Author Commented:
It has just gone again and the following services automatic services went with it.

CP Client
IP Helper
server
system event notification
task scheduler
User profile service
network policy server
David AtkinTechnical DirectorCommented:
Your share access will be failing because the server service is stopping.
 
Now this has happened check the events prior to these services failing.

If you like you can export them and upload them onto here so that we can have a look as well.
Larry Struckmeyer MVPCommented:
Or just the event id and source would help.  You can research these yourself at www.eventid.net
InsideviewM.D.Author Commented:
a few mins before:

application error event 1000
Faulting application name: svchost.exe_wuauserv, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: wuaueng.dll, version: 7.6.7601.18804, time stamp: 0x551222b5
Exception code: 0xc0000005
Fault offset: 0x000000000008a0de
Faulting process id: 0x3b30
Faulting application start time: 0x01d092279fdbe29a
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: c:\windows\system32\wuaueng.dll
Report Id: ac69fe04-fe21-11e4-aa91-009c02a8216a


Also many Perfnet errors event 2004
Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.

and VSS warnings event 8230
Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376. Check connection to domain controller and VssAccessControl registry key.

Operation:
   Initializing Writer

Context:
   Writer Class Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
   Writer Name: COM+ REGDB Writer

Error-specific details:
   Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified local group does not exist.
InsideviewM.D.Author Commented:
with regard to BPA only warnings found see file
BPA.jpg
David AtkinTechnical DirectorCommented:
Are your backups working?  I suspect not your COM+ Writer isn't starting.

The top error is relating to your windows update services but I wouldn't expect it to affect other services unless it was taking away resources so I don't think this is the underline cause. Go further back.

Is there any pattern to the crashes?
InsideviewM.D.Author Commented:
the only pattern I can see each time is below, is it the windows update service??

Faulting application name: svchost.exe_wuauserv, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: wuaueng.dll, version: 7.6.7601.18804, time stamp: 0x551222b5
Exception code: 0xc0000005
Fault offset: 0x000000000008a0de
Faulting process id: 0x2c64
Faulting application start time: 0x01d0930acb8fd943
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: c:\windows\system32\wuaueng.dll
Report Id: 0538fb5c-ff06-11e4-a17f-009c02a8216a
David AtkinTechnical DirectorCommented:
How much free disk space do you have on the drives?

Change the Windows Update service to disabled for now.  I don't think this will resolve the error but it may help you see some other errors if they are there.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
InsideviewM.D.Author Commented:
Hi David 636Gb FREE of 931

I have stopped the windows updates using the command line now

getting multiple event 2 Kernel-Event Tracing errors
and a couple of 3688 schannel The following fatal alert was generated: 10. The internal error state is 1203.
acstecheeCommented:
Hi there,
we are getting exactly the same problem on an SBS 2011 server, happened just about the same time too.
Ours would not restart the GPClient service until we restored the wup.sys file from before this started.  Now it 'crashes' about every 4 hours or so but a reboot restarts everything.
The only thing I can see that updated immediately before was IE11.  Could this be a compatibility issue I wonder?
Updates seem sporadically to work so I think it is related in some way to WSUS or update services but can't seem to find out exactly what. V frustrating!
If I find anything more I will add to the post but would appreciate anyone elses updates as well!!
Thanks
InsideviewM.D.Author Commented:
Thanks David, disabling wsus did, I removed the role completely in the end
InsideviewM.D.Author Commented:
acstechee, yes you are correct, I removed the wsus role after narrowing it down a couple of days ago, the server has been fine since then
Michael DonkinCommented:
Hi Guys

I realise that this thread has been closed but it is the first thread I have found that describes our problem exactly. Ours also started after running Windows Updates a few days ago and I've been scratching around for an answer since. I have a Microsoft techie on the case too, but they're not as fast at responding as we need (although they are very thorough eventually!)

Can I ask what was specifically done to get a fix?

I understand:
* the wup.sys file was restored from a backup.
* The WSUS Service has been disabled

What I'm not clear about is removing the WSUS role. Does this stop Windows Updates from happening across the Domain?

Many thanks

Michael D
InsideviewM.D.Author Commented:
Hi Michael, I didn't restore the wup.sys file,
I noticed the failures coincided with the server trying to get updates.
My customers machine was an SBS2011 server and I removed the WSUS role which does stop updates to all client machines,
by making an additional change on the server the client machines will revert back to getting the updates themselves. I am travelling at the moment and cant remember the procedure but will try and post it in the morning
Michael DonkinCommented:
Great, I'd really appreciate it.

I'm back on the Server now and will disable the role,

Cheers,
Michael D
InsideviewM.D.Author Commented:
Michael, I'm sorry but I cant find the info I used, probably quickest to post as a new question, someone will know straight away
Michael DonkinCommented:
No problem. I'm just happy that the Server is now back up and running successfully.

I have a case open with Microsoft on the issue, so I shall report back to them later today that it does seem to be the WSUS role which has caused the issue.

It may prove difficult to persuade the client to allow us to work further on this case to determine the underlying cause and a permanent fix, as they won't wish to pay to fix Microsoft's problems.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SBS

From novice to tech pro — start learning today.