MS Critical Patches - Reboot - Did not reboot.

[Guest Neil]

Hi,

 

I applied couple of critical patches from April till now as the previous

admins did not install any of these patches. But, one of my domain controller

(which holds the Global Catalog) was rebooted after the patch install. Reboot

command got issued, but it did not time out when I tried pinging with a -t

for almost 30 minutes. So, I thought something is wrong. I tried RDP in again

and could not.

 

I have noticed this RDP problem cropping up from sometime in October of last

year, when I applied patches and after that I could not RDP onto the server.

I will have to reboot the server twice to get in through RDP again. Well this

is not my main concern, but my main concern is the above problem. I am not

physically at the site to look at the server what is going on with my Domain

Controller, which I might go in tomorrow to work or on Monday morning if

nobody calls in with login issues, I might reboot the server again.

 

If anybody could let me know why all the domain controllers rebooted and

this one did not. I have couple of event logs which I can throw it in here,

if needed.

[Guest Coraleigh Miller]

Re: MS Critical Patches - Reboot - Did not reboot.

 

Hi Neil,

 

Every bit of info helps, what are the event ids? Also have you already

looked them up at eventid.net?

Do you happen to remmember what patches they were back in october? Is this

Server 2003 Sp2? Are you also unable to connect to the server via computer

management?

 

Coraleigh Miller

 

 

"Neil" <Neil@discussions.microsoft.com> wrote in message

news:D57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...

> Hi,

>

> I applied couple of critical patches from April till now as the previous

> admins did not install any of these patches. But, one of my domain

> controller

> (which holds the Global Catalog) was rebooted after the patch install.

> Reboot

> command got issued, but it did not time out when I tried pinging with a -t

> for almost 30 minutes. So, I thought something is wrong. I tried RDP in

> again

> and could not.

>

> I have noticed this RDP problem cropping up from sometime in October of

> last

> year, when I applied patches and after that I could not RDP onto the

> server.

> I will have to reboot the server twice to get in through RDP again. Well

> this

> is not my main concern, but my main concern is the above problem. I am not

> physically at the site to look at the server what is going on with my

> Domain

> Controller, which I might go in tomorrow to work or on Monday morning if

> nobody calls in with login issues, I might reboot the server again.

>

> If anybody could let me know why all the domain controllers rebooted and

> this one did not. I have couple of event logs which I can throw it in

> here,

> if needed.

[Guest Neil]

Re: MS Critical Patches - Reboot - Did not reboot.

 

Hi Miller,

 

Thanks for your immediate reply. Well, I am not even worried about the RDP

issue I am facing. My problem was today (after around 8pm) I had scheduled

the install of critical patches. As many systems were not patched.

 

I patched several DCs and rebooted them and it came back. I had a DOS

window open when I rebooted one of my DC which holds the RID pool manager and

Infrastructure master. I had a DOS windows open wanted to see when it goes

down and it comes up using PING SERVER -t. I did not see REQUEST TIMED OUT

but was getting a REPLY all the time for more than 45 minutes.

 

So, I tried connecting through RDP and could not connect. If the server has

come back up it is fine for me and it is not a problem.

 

The EVENT IDs I see are:

 

The last even ID before it was supposed to go down was 1074 - USER32 and

after that I have 7036 Service Control Manager.

 

After this I have WARNING for the following EVENTIDs

40960 SPNGEO in System Events. There is no sign it shows that it started

 

Usually it will show Eventlog service started or lsass event ID 1000

database engine started.

 

But, I don't see any kind of events like this on this domain controller. I

infact pulled the event logs by connecting to another DC and from there

pulling the info of the DC which was supposed to reboot... I can check it on

Monday, but just want to make sure as it has both those FSMO roles.

 

In regard to the RDP not working properly, I have faced this in my previous

job where sometime in October or November I remember or before that I had no

problem in connecting via RDP through my VPN when I installed the patches and

rebooted the server. But, after sometime it stopped connecting via RDP after

the first reboot, so I had to go physically to the datacenter to do the

updates. Same issue I am seeing here on these servers. Not sure when this

started happening, but itused to work but it stops working. Not all behave

like t his, but some servers behave like this.

 

Hope this helps!

 

"Coraleigh Miller" wrote:

> Hi Neil,

>

> Every bit of info helps, what are the event ids? Also have you already

> looked them up at eventid.net?

> Do you happen to remmember what patches they were back in october? Is this

> Server 2003 Sp2? Are you also unable to connect to the server via computer

> management?

>

> Coraleigh Miller

>

>

> "Neil" <Neil@discussions.microsoft.com> wrote in message

> news:D57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...

> > Hi,

> >

> > I applied couple of critical patches from April till now as the previous

> > admins did not install any of these patches. But, one of my domain

> > controller

> > (which holds the Global Catalog) was rebooted after the patch install.

> > Reboot

> > command got issued, but it did not time out when I tried pinging with a -t

> > for almost 30 minutes. So, I thought something is wrong. I tried RDP in

> > again

> > and could not.

> >

> > I have noticed this RDP problem cropping up from sometime in October of

> > last

> > year, when I applied patches and after that I could not RDP onto the

> > server.

> > I will have to reboot the server twice to get in through RDP again. Well

> > this

> > is not my main concern, but my main concern is the above problem. I am not

> > physically at the site to look at the server what is going on with my

> > Domain

> > Controller, which I might go in tomorrow to work or on Monday morning if

> > nobody calls in with login issues, I might reboot the server again.

> >

> > If anybody could let me know why all the domain controllers rebooted and

> > this one did not. I have couple of event logs which I can throw it in

> > here,

> > if needed.

>

>

>

[Guest Coraleigh Miller]

Re: MS Critical Patches - Reboot - Did not reboot.

 

 

Hi Neil,

 

Have you taken a look at this article?

http://support.microsoft.com/kb/931192

 

Coraleigh

 

 

"Neil" <Neil@discussions.microsoft.com> wrote in message

news:53A958E6-679C-48BC-9080-2128EC1AC4B7@microsoft.com...

> Hi Miller,

>

> Thanks for your immediate reply. Well, I am not even worried about the RDP

> issue I am facing. My problem was today (after around 8pm) I had scheduled

> the install of critical patches. As many systems were not patched.

>

> I patched several DCs and rebooted them and it came back. I had a DOS

> window open when I rebooted one of my DC which holds the RID pool manager

> and

> Infrastructure master. I had a DOS windows open wanted to see when it goes

> down and it comes up using PING SERVER -t. I did not see REQUEST TIMED OUT

> but was getting a REPLY all the time for more than 45 minutes.

>

> So, I tried connecting through RDP and could not connect. If the server

> has

> come back up it is fine for me and it is not a problem.

>

> The EVENT IDs I see are:

>

> The last even ID before it was supposed to go down was 1074 - USER32 and

> after that I have 7036 Service Control Manager.

>

> After this I have WARNING for the following EVENTIDs

> 40960 SPNGEO in System Events. There is no sign it shows that it started

>

> Usually it will show Eventlog service started or lsass event ID 1000

> database engine started.

>

> But, I don't see any kind of events like this on this domain controller. I

> infact pulled the event logs by connecting to another DC and from there

> pulling the info of the DC which was supposed to reboot... I can check it

> on

> Monday, but just want to make sure as it has both those FSMO roles.

>

> In regard to the RDP not working properly, I have faced this in my

> previous

> job where sometime in October or November I remember or before that I had

> no

> problem in connecting via RDP through my VPN when I installed the patches

> and

> rebooted the server. But, after sometime it stopped connecting via RDP

> after

> the first reboot, so I had to go physically to the datacenter to do the

> updates. Same issue I am seeing here on these servers. Not sure when this

> started happening, but itused to work but it stops working. Not all

> behave

> like t his, but some servers behave like this.

>

> Hope this helps!

>

> "Coraleigh Miller" wrote:

>

>> Hi Neil,

>>

>> Every bit of info helps, what are the event ids? Also have you already

>> looked them up at eventid.net?

>> Do you happen to remmember what patches they were back in october? Is

>> this

>> Server 2003 Sp2? Are you also unable to connect to the server via

>> computer

>> management?

>>

>> Coraleigh Miller

>>

>>

>> "Neil" <Neil@discussions.microsoft.com> wrote in message

>> news:D57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...

>> > Hi,

>> >

>> > I applied couple of critical patches from April till now as the

>> > previous

>> > admins did not install any of these patches. But, one of my domain

>> > controller

>> > (which holds the Global Catalog) was rebooted after the patch install.

>> > Reboot

>> > command got issued, but it did not time out when I tried pinging with

>> > a -t

>> > for almost 30 minutes. So, I thought something is wrong. I tried RDP in

>> > again

>> > and could not.

>> >

>> > I have noticed this RDP problem cropping up from sometime in October of

>> > last

>> > year, when I applied patches and after that I could not RDP onto the

>> > server.

>> > I will have to reboot the server twice to get in through RDP again.

>> > Well

>> > this

>> > is not my main concern, but my main concern is the above problem. I am

>> > not

>> > physically at the site to look at the server what is going on with my

>> > Domain

>> > Controller, which I might go in tomorrow to work or on Monday morning

>> > if

>> > nobody calls in with login issues, I might reboot the server again.

>> >

>> > If anybody could let me know why all the domain controllers rebooted

>> > and

>> > this one did not. I have couple of event logs which I can throw it in

>> > here,

>> > if needed.

>>

>>

>>

[Guest Coraleigh Miller]

Re: MS Critical Patches - Reboot - Did not reboot.

 

Generally the 7036 event pops up after a reboot, reporting the succesfull

running states of various services. It sounds like your server possibly did

reboot but then got hung up on an authentication issue, although its odd

that you could have missed it while watching the 45min ping.

Give this article a read as well, it suggests resetting the trust

relationship between a parent and child domain,

There is also this doc.. http://support.microsoft.com/kb/938702

 

Coraleigh

 

 

"Neil" <Neil@discussions.microsoft.com> wrote in message

news:53A958E6-679C-48BC-9080-2128EC1AC4B7@microsoft.com...

> Hi Miller,

>

> Thanks for your immediate reply. Well, I am not even worried about the RDP

> issue I am facing. My problem was today (after around 8pm) I had scheduled

> the install of critical patches. As many systems were not patched.

>

> I patched several DCs and rebooted them and it came back. I had a DOS

> window open when I rebooted one of my DC which holds the RID pool manager

> and

> Infrastructure master. I had a DOS windows open wanted to see when it goes

> down and it comes up using PING SERVER -t. I did not see REQUEST TIMED OUT

> but was getting a REPLY all the time for more than 45 minutes.

>

> So, I tried connecting through RDP and could not connect. If the server

> has

> come back up it is fine for me and it is not a problem.

>

> The EVENT IDs I see are:

>

> The last even ID before it was supposed to go down was 1074 - USER32 and

> after that I have 7036 Service Control Manager.

>

> After this I have WARNING for the following EVENTIDs

> 40960 SPNGEO in System Events. There is no sign it shows that it started

>

> Usually it will show Eventlog service started or lsass event ID 1000

> database engine started.

>

> But, I don't see any kind of events like this on this domain controller. I

> infact pulled the event logs by connecting to another DC and from there

> pulling the info of the DC which was supposed to reboot... I can check it

> on

> Monday, but just want to make sure as it has both those FSMO roles.

>

> In regard to the RDP not working properly, I have faced this in my

> previous

> job where sometime in October or November I remember or before that I had

> no

> problem in connecting via RDP through my VPN when I installed the patches

> and

> rebooted the server. But, after sometime it stopped connecting via RDP

> after

> the first reboot, so I had to go physically to the datacenter to do the

> updates. Same issue I am seeing here on these servers. Not sure when this

> started happening, but itused to work but it stops working. Not all

> behave

> like t his, but some servers behave like this.

>

> Hope this helps!

>

> "Coraleigh Miller" wrote:

>

>> Hi Neil,

>>

>> Every bit of info helps, what are the event ids? Also have you already

>> looked them up at eventid.net?

>> Do you happen to remmember what patches they were back in october? Is

>> this

>> Server 2003 Sp2? Are you also unable to connect to the server via

>> computer

>> management?

>>

>> Coraleigh Miller

>>

>>

>> "Neil" <Neil@discussions.microsoft.com> wrote in message

>> news:D57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...

>> > Hi,

>> >

>> > I applied couple of critical patches from April till now as the

>> > previous

>> > admins did not install any of these patches. But, one of my domain

>> > controller

>> > (which holds the Global Catalog) was rebooted after the patch install.

>> > Reboot

>> > command got issued, but it did not time out when I tried pinging with

>> > a -t

>> > for almost 30 minutes. So, I thought something is wrong. I tried RDP in

>> > again

>> > and could not.

>> >

>> > I have noticed this RDP problem cropping up from sometime in October of

>> > last

>> > year, when I applied patches and after that I could not RDP onto the

>> > server.

>> > I will have to reboot the server twice to get in through RDP again.

>> > Well

>> > this

>> > is not my main concern, but my main concern is the above problem. I am

>> > not

>> > physically at the site to look at the server what is going on with my

>> > Domain

>> > Controller, which I might go in tomorrow to work or on Monday morning

>> > if

>> > nobody calls in with login issues, I might reboot the server again.

>> >

>> > If anybody could let me know why all the domain controllers rebooted

>> > and

>> > this one did not. I have couple of event logs which I can throw it in

>> > here,

>> > if needed.

>>

>>

>>

[Guest Coraleigh Miller]

Re: MS Critical Patches - Reboot - Did not reboot.

 

Hey ha, i just noticed that I have the 40960 SPNGEO on my GC as well, and

they are listed after my server went through a successful reboot. Very odd

though, that you seem to be missing a whole bunch of other event ids both

before and after that, as you mentioned such as the "6005 Event Log" etc.

So..I think looking at these event id's may have led me down a wrong path.

Perhaps since your last event was the 40960 SPNGEO, then at some point

during boot up after that, there is a service stuck in 'starting' which is

causing a slow down of this server hobbling it from receiving rdp requests

and writing anything more to the event log.

 

I will be interested to hear what you see on your screen on monday! :-)

 

Coraleigh

 

 

"Neil" <Neil@discussions.microsoft.com> wrote in message

news:53A958E6-679C-48BC-9080-2128EC1AC4B7@microsoft.com...

> Hi Miller,

>

> Thanks for your immediate reply. Well, I am not even worried about the RDP

> issue I am facing. My problem was today (after around 8pm) I had scheduled

> the install of critical patches. As many systems were not patched.

>

> I patched several DCs and rebooted them and it came back. I had a DOS

> window open when I rebooted one of my DC which holds the RID pool manager

> and

> Infrastructure master. I had a DOS windows open wanted to see when it goes

> down and it comes up using PING SERVER -t. I did not see REQUEST TIMED OUT

> but was getting a REPLY all the time for more than 45 minutes.

>

> So, I tried connecting through RDP and could not connect. If the server

> has

> come back up it is fine for me and it is not a problem.

>

> The EVENT IDs I see are:

>

> The last even ID before it was supposed to go down was 1074 - USER32 and

> after that I have 7036 Service Control Manager.

>

> After this I have WARNING for the following EVENTIDs

> 40960 SPNGEO in System Events. There is no sign it shows that it started

>

> Usually it will show Eventlog service started or lsass event ID 1000

> database engine started.

>

> But, I don't see any kind of events like this on this domain controller. I

> infact pulled the event logs by connecting to another DC and from there

> pulling the info of the DC which was supposed to reboot... I can check it

> on

> Monday, but just want to make sure as it has both those FSMO roles.

>

> In regard to the RDP not working properly, I have faced this in my

> previous

> job where sometime in October or November I remember or before that I had

> no

> problem in connecting via RDP through my VPN when I installed the patches

> and

> rebooted the server. But, after sometime it stopped connecting via RDP

> after

> the first reboot, so I had to go physically to the datacenter to do the

> updates. Same issue I am seeing here on these servers. Not sure when this

> started happening, but itused to work but it stops working. Not all

> behave

> like t his, but some servers behave like this.

>

> Hope this helps!

>

> "Coraleigh Miller" wrote:

>

>> Hi Neil,

>>

>> Every bit of info helps, what are the event ids? Also have you already

>> looked them up at eventid.net?

>> Do you happen to remmember what patches they were back in october? Is

>> this

>> Server 2003 Sp2? Are you also unable to connect to the server via

>> computer

>> management?

>>

>> Coraleigh Miller

>>

>>

>> "Neil" <Neil@discussions.microsoft.com> wrote in message

>> news:D57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...

>> > Hi,

>> >

>> > I applied couple of critical patches from April till now as the

>> > previous

>> > admins did not install any of these patches. But, one of my domain

>> > controller

>> > (which holds the Global Catalog) was rebooted after the patch install.

>> > Reboot

>> > command got issued, but it did not time out when I tried pinging with

>> > a -t

>> > for almost 30 minutes. So, I thought something is wrong. I tried RDP in

>> > again

>> > and could not.

>> >

>> > I have noticed this RDP problem cropping up from sometime in October of

>> > last

>> > year, when I applied patches and after that I could not RDP onto the

>> > server.

>> > I will have to reboot the server twice to get in through RDP again.

>> > Well

>> > this

>> > is not my main concern, but my main concern is the above problem. I am

>> > not

>> > physically at the site to look at the server what is going on with my

>> > Domain

>> > Controller, which I might go in tomorrow to work or on Monday morning

>> > if

>> > nobody calls in with login issues, I might reboot the server again.

>> >

>> > If anybody could let me know why all the domain controllers rebooted

>> > and

>> > this one did not. I have couple of event logs which I can throw it in

>> > here,

>> > if needed.

>>

>>

>>

[Guest Coraleigh Miller]

Re: MS Critical Patches - Reboot - Did not reboot.

 

Appologies for all the replys! I just noticed that the 40960 SPNGEO event is

quite sporadic on this server im looking at. Does your 7036 actually say

that such and such is entering a running state or a stopped state? If a

stopped state then, yeah it would seem your server hasnt rebooted. What is

the name of the service that is mentioned in this 7036?

 

Coraleigh

 

 

"Neil" <Neil@discussions.microsoft.com> wrote in message

news:53A958E6-679C-48BC-9080-2128EC1AC4B7@microsoft.com...

> Hi Miller,

>

> Thanks for your immediate reply. Well, I am not even worried about the RDP

> issue I am facing. My problem was today (after around 8pm) I had scheduled

> the install of critical patches. As many systems were not patched.

>

> I patched several DCs and rebooted them and it came back. I had a DOS

> window open when I rebooted one of my DC which holds the RID pool manager

> and

> Infrastructure master. I had a DOS windows open wanted to see when it goes

> down and it comes up using PING SERVER -t. I did not see REQUEST TIMED OUT

> but was getting a REPLY all the time for more than 45 minutes.

>

> So, I tried connecting through RDP and could not connect. If the server

> has

> come back up it is fine for me and it is not a problem.

>

> The EVENT IDs I see are:

>

> The last even ID before it was supposed to go down was 1074 - USER32 and

> after that I have 7036 Service Control Manager.

>

> After this I have WARNING for the following EVENTIDs

> 40960 SPNGEO in System Events. There is no sign it shows that it started

>

> Usually it will show Eventlog service started or lsass event ID 1000

> database engine started.

>

> But, I don't see any kind of events like this on this domain controller. I

> infact pulled the event logs by connecting to another DC and from there

> pulling the info of the DC which was supposed to reboot... I can check it

> on

> Monday, but just want to make sure as it has both those FSMO roles.

>

> In regard to the RDP not working properly, I have faced this in my

> previous

> job where sometime in October or November I remember or before that I had

> no

> problem in connecting via RDP through my VPN when I installed the patches

> and

> rebooted the server. But, after sometime it stopped connecting via RDP

> after

> the first reboot, so I had to go physically to the datacenter to do the

> updates. Same issue I am seeing here on these servers. Not sure when this

> started happening, but itused to work but it stops working. Not all

> behave

> like t his, but some servers behave like this.

>

> Hope this helps!

>

> "Coraleigh Miller" wrote:

>

>> Hi Neil,

>>

>> Every bit of info helps, what are the event ids? Also have you already

>> looked them up at eventid.net?

>> Do you happen to remmember what patches they were back in october? Is

>> this

>> Server 2003 Sp2? Are you also unable to connect to the server via

>> computer

>> management?

>>

>> Coraleigh Miller

>>

>>

>> "Neil" <Neil@discussions.microsoft.com> wrote in message

>> news:D57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...

>> > Hi,

>> >

>> > I applied couple of critical patches from April till now as the

>> > previous

>> > admins did not install any of these patches. But, one of my domain

>> > controller

>> > (which holds the Global Catalog) was rebooted after the patch install.

>> > Reboot

>> > command got issued, but it did not time out when I tried pinging with

>> > a -t

>> > for almost 30 minutes. So, I thought something is wrong. I tried RDP in

>> > again

>> > and could not.

>> >

>> > I have noticed this RDP problem cropping up from sometime in October of

>> > last

>> > year, when I applied patches and after that I could not RDP onto the

>> > server.

>> > I will have to reboot the server twice to get in through RDP again.

>> > Well

>> > this

>> > is not my main concern, but my main concern is the above problem. I am

>> > not

>> > physically at the site to look at the server what is going on with my

>> > Domain

>> > Controller, which I might go in tomorrow to work or on Monday morning

>> > if

>> > nobody calls in with login issues, I might reboot the server again.

>> >

>> > If anybody could let me know why all the domain controllers rebooted

>> > and

>> > this one did not. I have couple of event logs which I can throw it in

>> > here,

>> > if needed.

>>

>>

>>