Guest Stephen Posted February 12, 2008 Posted February 12, 2008 Hi, I'm wondering if anyone can help me with a problem I'm having with our Windows 2003 server. Basically the problem we're having is that the IIS service and the www service intermittently crashes and then tries to restart. I have followed the instructions in KB885881 article and installed the patch, however this has not resolved the problem. Does anyone have any ideas as to how I can resolve this problem?
Guest Ace Fekay [MVP] Posted February 12, 2008 Posted February 12, 2008 Re: IIS Problems In news:71B98C4D-89AB-49F8-B581-FECBCA89DC82@microsoft.com, Stephen <Stephen@discussions.microsoft.com> typed: > Hi, I'm wondering if anyone can help me with a problem I'm having > with our Windows 2003 server. Basically the problem we're having is > that the IIS service and the www service intermittently crashes and > then tries to restart. I have followed the instructions in KB885881 > article and installed the patch, however this has not resolved the > problem. Does anyone have any ideas as to how I can resolve this > problem? Unfortunatley, based on the limited information you provided, it will be difficult to say without knowing more about what your server's function is and what apps are installed and services running, and whether they use IIS. Also, how did you come up with 885881? Did someone advise you based on symptoms other than what was posted? Anything indicating an attacker was attempting or succeeded with some sort of remote code execution (as the article indicates the update fixes)? Can you elaborate a little please, as well as what SP level, any other hotfixes and updates installed, is it a DC, or a standalone hosting multiple zones as a dedicated webserver, is Exchange installed, SQL, etc? I also cross-posted this to the IIS group for better sepecific exposure. Follow-ups (responses) are set to go to both groups so you can safely check here for both. Just remember to reply to both groups when replying. -- Regards, Ace This posting is provided "AS-IS" with no warranties or guarantees and confers no rights. Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP Microsoft MVP - Directory Services Microsoft Certified Trainer Infinite Diversities in Infinite Combinations
Guest Stephen Posted February 21, 2008 Posted February 21, 2008 Re: IIS Problems Sorry about the lack of info supplied earlier. A little background on the setup...it's a Windows 2003 SP1 member server running Exchange 2003 SP2. Sophos Endpoint 7.0 & Sophos Puremessage 3.0 is also running on the server. Basically what is happening is IIS we're getting messages saying that IIS has terminated unexpectedly and has done this x times. When this happens both IIS Admin service & www service stops. This then means that we can't access our OWA site. Restarting the services resolves the problem temporarily until it happens again which is usually a couple of hours later that same day. With regards to the article 885881 I thought this may be related as the symptoms were almost identical. There doesn't appear to be any evidence that there is an attack on the system. I wasn't able to install the patch from this article in the end anyway as it is part of SP2 for exchange. I have tried reinstalling Sophos products as I thought they may have something to do with the problem but have had no luck as yet. "Ace Fekay [MVP]" wrote: > In news:71B98C4D-89AB-49F8-B581-FECBCA89DC82@microsoft.com, > Stephen <Stephen@discussions.microsoft.com> typed: > > Hi, I'm wondering if anyone can help me with a problem I'm having > > with our Windows 2003 server. Basically the problem we're having is > > that the IIS service and the www service intermittently crashes and > > then tries to restart. I have followed the instructions in KB885881 > > article and installed the patch, however this has not resolved the > > problem. Does anyone have any ideas as to how I can resolve this > > problem? > > Unfortunatley, based on the limited information you provided, it will be > difficult to say without knowing more about what your server's function is > and what apps are installed and services running, and whether they use IIS. > > Also, how did you come up with 885881? Did someone advise you based on > symptoms other than what was posted? Anything indicating an attacker was > attempting or succeeded with some sort of remote code execution (as the > article indicates the update fixes)? > > Can you elaborate a little please, as well as what SP level, any other > hotfixes and updates installed, is it a DC, or a standalone hosting multiple > zones as a dedicated webserver, is Exchange installed, SQL, etc? > > I also cross-posted this to the IIS group for better sepecific exposure. > Follow-ups (responses) are set to go to both groups so you can safely check > here for both. Just remember to reply to both groups when replying. > > -- > Regards, > Ace > > This posting is provided "AS-IS" with no warranties or guarantees and > confers no rights. > > Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, > MVP Microsoft MVP - Directory Services > Microsoft Certified Trainer > > Infinite Diversities in Infinite Combinations > > >
Guest Ace Fekay [MVP] Posted February 22, 2008 Posted February 22, 2008 Re: IIS Problems In news:4D6C70A9-FBF2-4708-B532-EDAA6E408959@microsoft.com, Stephen <Stephen@discussions.microsoft.com> typed: > Sorry about the lack of info supplied earlier. A little background > on the setup...it's a Windows 2003 SP1 member server running Exchange > 2003 SP2. Sophos Endpoint 7.0 & Sophos Puremessage 3.0 is also > running on the server. Basically what is happening is IIS we're > getting messages saying that IIS has terminated unexpectedly and has > done this x times. When this happens both IIS Admin service & www > service stops. This then means that we can't access our OWA site. > Restarting the services resolves the problem temporarily until it > happens again which is usually a couple of hours later that same day. > > With regards to the article 885881 I thought this may be related as > the symptoms were almost identical. There doesn't appear to be any > evidence that there is an attack on the system. I wasn't able to > install the patch from this article in the end anyway as it is part > of SP2 for exchange. > > I have tried reinstalling Sophos products as I thought they may have > something to do with the problem but have had no luck as yet. Pretty loaded up machine. I haven't used Sophos, but being they are similar to other AVs, they do have IIS components. Exchange does too. Maybe there is a conflict in ports, especially that Exchange uses numerous ports. Maybe Sophos is trying to quarantine something incorrectly? Are all the Exchange installation, database & log files, \system32\inetsrv folders all excluded from scanning? - Excluding them is extremely important. I would have honestly separated the roles on different servers. It's also only on SP1. What SP is Exchange? I would highly suggest to get them up to date especially if the problem may be based on a known issue, the SP will fix that (no promises). There are many enhancements in SP2. Then of course get the hotfixes up to date after that. It may just take care of it. Ace
Guest Stephen Posted February 23, 2008 Posted February 23, 2008 Re: IIS Problems Yeah, it is pretty loaded up. I'm actually waiting on approval for another server to move Sophos to but won't know for another couple of weeks so in the meantime I really need to try and get it sorted. The server is running 2003 with SP1 and Exchange is version 2003 which has SP2 for Exchange installed. I do have the exchange directories excluded from scanning. I will do some more tests on the server and see if I can determine if there are any port conflicts. Will also load 2003 SP2 on the server and see if that sorts the problem. Will keep you posted. "Ace Fekay [MVP]" wrote: > In news:4D6C70A9-FBF2-4708-B532-EDAA6E408959@microsoft.com, > Stephen <Stephen@discussions.microsoft.com> typed: > > Sorry about the lack of info supplied earlier. A little background > > on the setup...it's a Windows 2003 SP1 member server running Exchange > > 2003 SP2. Sophos Endpoint 7.0 & Sophos Puremessage 3.0 is also > > running on the server. Basically what is happening is IIS we're > > getting messages saying that IIS has terminated unexpectedly and has > > done this x times. When this happens both IIS Admin service & www > > service stops. This then means that we can't access our OWA site. > > Restarting the services resolves the problem temporarily until it > > happens again which is usually a couple of hours later that same day. > > > > With regards to the article 885881 I thought this may be related as > > the symptoms were almost identical. There doesn't appear to be any > > evidence that there is an attack on the system. I wasn't able to > > install the patch from this article in the end anyway as it is part > > of SP2 for exchange. > > > > I have tried reinstalling Sophos products as I thought they may have > > something to do with the problem but have had no luck as yet. > > Pretty loaded up machine. I haven't used Sophos, but being they are similar > to other AVs, they do have IIS components. Exchange does too. Maybe there is > a conflict in ports, especially that Exchange uses numerous ports. Maybe > Sophos is trying to quarantine something incorrectly? Are all the Exchange > installation, database & log files, \system32\inetsrv folders all excluded > from scanning? - Excluding them is extremely important. I would have > honestly separated the roles on different servers. > > It's also only on SP1. What SP is Exchange? I would highly suggest to get > them up to date especially if the problem may be based on a known issue, the > SP will fix that (no promises). There are many enhancements in SP2. Then of > course get the hotfixes up to date after that. It may just take care of it. > > Ace > > >
Guest Ace Fekay [MVP] Posted February 24, 2008 Posted February 24, 2008 Re: IIS Problems In news:C853EBDF-BEB0-4803-B430-11C0B74D2846@microsoft.com, Stephen <Stephen@discussions.microsoft.com> typed: > Yeah, it is pretty loaded up. I'm actually waiting on approval for > another server to move Sophos to but won't know for another couple of > weeks so in the meantime I really need to try and get it sorted. > > The server is running 2003 with SP1 and Exchange is version 2003 > which has SP2 for Exchange installed. > > I do have the exchange directories excluded from scanning. > > I will do some more tests on the server and see if I can determine if > there are any port conflicts. Will also load 2003 SP2 on the server > and see if that sorts the problem. Will keep you posted. Ok, cool. Let me know how you make out with SP2. Also, don't forget to exclude system32\inetsrv folder too. Ace
Recommended Posts