Yeah Dave, unfortunately it will be unless I can come up with something solid and viable to look at. That's why I posted to these lists, it's a last ditch effort to find something to look at before it gets rebuilt. I'm usually able to find answers & resolutions for pesky things like this that my co-workers would have already given up on & rebuilt the server. A couple of months ago a domain controller (not this one in question now) started getting the BSOD, it would reboot from a BSOD and do it again. It got rebuilt immediately., a few weeks later a clustered file & print server started doing the same thing, same stop codes etc, by the time everyone else had arrived for the day I had found a MS KB article with a registry hack to fix it. It did fix it and the server didn't have to be rebuilt.
I believe that fixing an issue by rebuilding the server isn't really the best way to proceed because the root issue wasn't found and fixed, and it could come up again. The reason this is going to get rebuilt is that the impact to the users is Outlook being down, which leads to the opinion that we have a flakey Exchange server, which of course is just as stable as it can be, as long as active directory is functioning the way it's supposed to. On Thu, Mar 26, 2009 at 7:55 AM, Eldridge, Dave <d...@parkviewmc.com> wrote: > Sherry > > you’re not going to decommish this before you find out what’s causing this? > > You have my curiosity. > > dave > > > > *From:* Sherry Abercrombie [mailto:saber...@gmail.com] > *Sent:* Thursday, March 26, 2009 6:45 AM > > *To:* NT System Admin Issues > *Subject:* Re: Replication Issue - Cross Posting > > > > Yes, on 3/21....this started happening on 2/25...... > > On Thu, Mar 26, 2009 at 7:35 AM, Kennedy, Jim < > kennedy...@elyriaschools.org> wrote: > > Did you apply the 3/10 DNS ‘fix’ for the vulnerability. I am seeing odd DNS > stuff since then. Most annoying to do a netstat –a and have to weed through > 2500 open dns connections. > > > > Maybe a clue……. > > > > > > *From:* Sherry Abercrombie [mailto:saber...@gmail.com] > *Sent:* Thursday, March 26, 2009 8:29 AM > > > *To:* NT System Admin Issues > > *Subject:* Re: Replication Issue - Cross Posting > > > > On the domain controller that we are having the issue with, I do see errors > of DNS time outs in the event log during that time-frame. > > On Wed, Mar 25, 2009 at 3:28 PM, John Cook <john.c...@pfsf.org> wrote: > > Anything going on with DNS replication when this happens? > > > > *John W. Cook* > > *Systems Administrator* > > *Partnership For Strong Families* > > *315 SE 2nd Ave* > > *Gainesville, Fl 32601* > > *Office (352) 393-2741 x320* > > *Cell (352) 215-6944* > > *Fax (352) 393-2746* > > *MCSE, MCTS, MCP+I,CompTIA A+, N+* > > > > *From:* Sherry Abercrombie [mailto:saber...@gmail.com] > *Sent:* Wednesday, March 25, 2009 4:19 PM > *To:* NT System Admin Issues > *Subject:* Replication Issue - Cross Posting > > > > I have an interesting issue that has been happening for almost 6 weeks > now. Every Wed. at approximately 1:40-1:45 PM, one of our domain > controllers basically becomes totally unresponsive, causing the other two > DC's to become effectively useless, AND causes the Exchange server to become > unresponsive to clients. (Outlook 2003) . > > > > The only clue that I have from the event logs is from the Directory Service > log, > Event ID: 1232 > Source: NTDS Replication > Category: DS RPC Client > Type: Warning > Description: Active Directory attempted to perform a remote procedure call > (RPC) to the following server. The call timed out and was cancelled. > > Server: > f9f58f44-e7e7-4ea5-92fe-aa38ff4cb646._msdcs.domain.com > > The server guid referenced here is one of the other domain controllers, > that at this point in time, is scheduled to be rebuilt. (FSMO roles have > been moved, etc etc) > > The Exchange server event log just shows that it cannot contact any global > catalog server and lists the 3 dc's that we have which are all global > catalog servers. > > During the duration of this "outage" this specific dc cannot be accessed > either remote desktop, or direct on the console, but the other dc's are > accessible as well as the Exchange server, albeit very slow response. > > I have Googled,looked at EventID.net and Microsoft on this, and have come > up with very little. Did find a MS KB article that recommended making a > registry change on the DC's to make the RPC call timeout at least 45 > minutes, this was done last week, and the DC's were rebooted over the > weekend to apply this registry change, but, today it happened again, so that > didn't work. Found some other MS KB articles that were not applicable but > did reference that event. > > Windows 2003 server, SP2. My question is, what the heck is replicating > once a week that could be causing RPC to time out like this and basically > bring the domain to a halt for 10 - 15 minutes? As I stated, this DC is > going to be rebuilt, it just annoys me that I cannot find the reason for it, > and a solution other than the rebuild. > > TIA, > -- > Sherry Abercrombie > > "Any sufficiently advanced technology is indistinguishable from magic." > Arthur C. Clarke > > > > > > > ------------------------------ > > CONFIDENTIALITY STATEMENT: The information transmitted, or contained or > attached to or with this Notice is intended only for the person or entity to > which it is addressed and may contain Protected Health Information (PHI), > confidential and/or privileged material. Any review, transmission, > dissemination, or other use of, and taking any action in reliance upon this > information by persons or entities other than the intended recipient without > the express written consent of the sender are prohibited. This information > may be protected by the Health Insurance Portability and Accountability Act > of 1996 (HIPAA), and other Federal and Florida laws. Improper or > unauthorized use or disclosure of this information could result in civil > and/or criminal penalties. > Consider the environment. Please don't print this e-mail unless you really > need to. > > > > > > > > > -- > > Sherry Abercrombie > > "Any sufficiently advanced technology is indistinguishable from magic." > Arthur C. Clarke > Sent from: Haslet TX United States. > > > > > > > > > > > > > > > -- > Sherry Abercrombie > > "Any sufficiently advanced technology is indistinguishable from magic." > Arthur C. Clarke > Sent from: Haslet TX United States. > > > > > > This e-mail contains the thoughts and opinions of the sender and does not > represent official Parkview Medical Center policy. > > This communication is intended only for the recipient(s) named above, may > be confidential and/or legally privileged: and, must be treated as such in > accordance with state and federal laws. If you are not the intended > recipient, you are hereby notified that any use of this communication, or > any of its contents, is prohibited. If you have received this communication > in error, please return to sender and delete the message from your computer > system. > > > > > > -- Sherry Abercrombie "Any sufficiently advanced technology is indistinguishable from magic." Arthur C. Clarke Sent from: Haslet TX United States. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
