Windows Server 2003 Restarting

[brock029]

Well our domain restarts every night at random times. This is what I'm getting in the event viewer

"A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted." Event ID : 1015.

4 seconds later I get this

"The process winlogon.exe has initiated the restart of computer EPS3 on behalf of user for the following reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code -1073741819. The system will now shut down and restart."

So far these are the only events that look like they are causing it. I have tried this hotfix and that did not change anything. I've also tried just about everything I have found on google and still have yet to get a solution. This has been happening since November and our network admin recently asked me to find a fix.

If any one has any suggestions Ill try them...thanks!

 

[YeOldeStonecat]

Server all up to date with Microsoft updates?
What other major servers does it run?
Protected behind a firewall, or on a public IP?
Antivirus?

 

[brock029]

Server all up to date with Microsoft updates?
What other major servers does it run?
Protected behind a firewall, or on a public IP?
Antivirus?

1. Up to date with service pack 2
2. This server is just for the Active Directory (But there are 15 different servers in the domain)
3. Behind a firewall
4. McAfee enterprise

 

[datagnostic]

Have you done a checkdisk on the system partition, tested RAM etc?

If you can ask for downtime, ofcourse

 

[brock029]

Have you done a checkdisk on the system partition, tested RAM etc?

If you can ask for downtime, ofcourse

Have not done any testing, just asked to see if I can get a few minutes of down time to run chkdsk. See what that finds.

 

[brock029]

And this is what I got running chkdsk /f /r

Cleaning up minor inconsistencies on the drive.
Cleaning up 6957 unused index entries from index $SII of file 0x9.
Cleaning up 6957 unused index entries from index $SDH of file 0x9.
Cleaning up 6957 unused security descriptors.

 

[angry_geek]

First thing, I NEVER run chkdsk with the fix or repair switches on a server drive. Especially, without an image first. You could absolutely hose the system. Since you've already done this, it looks like you have some potentially serious file system issues. This could be from a failing drive or controller or an OS issue. I would start with some hardware diagnostics, after a backup and/or image of course. If the hardware checks out, then there a few things we could do. Is this just a DC, or AD replicator, or what?

 

[YeOldeStonecat]

And this is what I got running chkdsk /f /r

Cleaning up minor inconsistencies on the drive.
Cleaning up 6957 unused index entries from index $SII of file 0x9.
Cleaning up 6957 unused index entries from index $SDH of file 0x9.
Cleaning up 6957 unused security descriptors.

There she is..rearing her ugly head....time to look at the disk/RAID system and get to replacing drives.

 

[tkrabec]

Get UBCD 4 win, use the registry repair software & rollback the registry to a older version , 1version at a it until it works
I had a xp box with a similar issue yesterday I had to go back 2 versions to have it work

oh yeah and BACKUP CRITICAL DATA !ST VIA UBCD or another tool

Well our domain restarts every night at random times. This is what I'm getting in the event viewer

"A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted." Event ID : 1015.

4 seconds later I get this

"The process winlogon.exe has initiated the restart of computer EPS3 on behalf of user for the following reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code -1073741819. The system will now shut down and restart."

So far these are the only events that look like they are causing it. I have tried this hotfix and that did not change anything. I've also tried just about everything I have found on google and still have yet to get a solution. This has been happening since November and our network admin recently asked me to find a fix.

If any one has any suggestions Ill try them...thanks!

 

[brock029]

First thing, I NEVER run chkdsk with the fix or repair switches on a server drive. Especially, without an image first. You could absolutely hose the system. Since you've already done this, it looks like you have some potentially serious file system issues. This could be from a failing drive or controller or an OS issue. I would start with some hardware diagnostics, after a backup and/or image of course. If the hardware checks out, then there a few things we could do. Is this just a DC, or AD replicator, or what?

Every server is always backed up so I decided to try it out. this one is the domain controller. Ill see what Im allowed to do with diagnostics.

There she is..rearing her ugly head....time to look at the disk/RAID system and get to replacing drives.

Luckily there is only 1 80gb drive

 

[YeOldeStonecat]

Luckily there is only 1 80gb drive

Ouch...a server without RAID? I'll cross my fingers for ya....snag a new drive and clone her.

Or..do they run any hyper-visors yet? Do a P2V and suck her in.

 

[angry_geek]

Ouch...a server without RAID? I'll cross my fingers for ya....snag a new drive and clone her.

Or..do they run any hyper-visors yet? Do a P2V and suck her in.

+1 on that

You might actually be able to save them money on electricity if you can virtualize it.

 

[brock029]

Ouch...a server without RAID? I'll cross my fingers for ya....snag a new drive and clone her.

Or..do they run any hyper-visors yet? Do a P2V and suck her in.

Yep we have all kinds of "cheap" ways of doing things around here. I'm pretty sure that server is an old lenovo or IBM desktop computer with 2 gigs of ram . They have maybe 60 old igel thin clients that they use as regular desktop computers in the training rooms running windows xp embedded. Of course there is at least 3 tickets a day involving problems with these computers (mainly profile errors because there is no more hard-drive space available they run off of 1gb compact flash cards). We went through a ton of stuff to get them to work with virtual machines (the server being 3 seperate new lenovo desktops with dual core processors and 4gb of ram each) then the VM server trial ran out and we have yet to been approved just to buy the software.

+1 on that

You might actually be able to save them money on electricity if you can virtualize it.

Like what I stated above they look at the how much I have to spend now vs. how much I spend in the long run. It really is a mess here. Probably why I never got a raise going from Tier 2 customer service rep to web developer and a tech in 3 months.

 

[angry_geek]

All I can say after all that is, good luck. I feel for you. You're between a rock and a board that doesn't put any value into it. They may get it once servers start failing.

 

[brock029]

All I can say after all that is, good luck. I feel for you. You're between a rock and a board that doesn't put any value into it. They may get it once servers start failing.

Lol thanks, and yep maybe one day or I just start making as much on my own as I do here and vamanos but ill see if I can run some diaogs and see what I come up with

 

[brock029]

Ouch...a server without RAID? I'll cross my fingers for ya....snag a new drive and clone her.

Or..do they run any hyper-visors yet? Do a P2V and suck her in.

+1 on that

You might actually be able to save them money on electricity if you can virtualize it.

I had no clue Hypervisor was free, we don't run it yet but I shot the idea to the network admin. I bet he says no but it would be fun if he let me set it up!