MS Critical Patches - Reboot - Did not reboot.

  • Thread starter Thread starter Neil
  • Start date Start date
N

Neil

Hi,

I applied couple of critical patches from April till now as the previous
admins did not install any of these patches. But, one of my domain controller
(which holds the Global Catalog) was rebooted after the patch install. Reboot
command got issued, but it did not time out when I tried pinging with a -t
for almost 30 minutes. So, I thought something is wrong. I tried RDP in again
and could not.

I have noticed this RDP problem cropping up from sometime in October of last
year, when I applied patches and after that I could not RDP onto the server.
I will have to reboot the server twice to get in through RDP again. Well this
is not my main concern, but my main concern is the above problem. I am not
physically at the site to look at the server what is going on with my Domain
Controller, which I might go in tomorrow to work or on Monday morning if
nobody calls in with login issues, I might reboot the server again.

If anybody could let me know why all the domain controllers rebooted and
this one did not. I have couple of event logs which I can throw it in here,
if needed.
 
Hi Neil,

Every bit of info helps, what are the event ids? Also have you already
looked them up at eventid.net?
Do you happen to remmember what patches they were back in october? Is this
Server 2003 Sp2? Are you also unable to connect to the server via computer
management?

Coraleigh Miller


"Neil" <Neil@discussions.microsoft.com> wrote in message
news:D57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...
> Hi,
>
> I applied couple of critical patches from April till now as the previous
> admins did not install any of these patches. But, one of my domain
> controller
> (which holds the Global Catalog) was rebooted after the patch install.
> Reboot
> command got issued, but it did not time out when I tried pinging with a -t
> for almost 30 minutes. So, I thought something is wrong. I tried RDP in
> again
> and could not.
>
> I have noticed this RDP problem cropping up from sometime in October of
> last
> year, when I applied patches and after that I could not RDP onto the
> server.
> I will have to reboot the server twice to get in through RDP again. Well
> this
> is not my main concern, but my main concern is the above problem. I am not
> physically at the site to look at the server what is going on with my
> Domain
> Controller, which I might go in tomorrow to work or on Monday morning if
> nobody calls in with login issues, I might reboot the server again.
>
> If anybody could let me know why all the domain controllers rebooted and
> this one did not. I have couple of event logs which I can throw it in
> here,
> if needed.
 
Hi Miller,

Thanks for your immediate reply. Well, I am not even worried about the RDP
issue I am facing. My problem was today (after around 8pm) I had scheduled
the install of critical patches. As many systems were not patched.

I patched several DCs and rebooted them and it came back. I had a DOS
window open when I rebooted one of my DC which holds the RID pool manager and
Infrastructure master. I had a DOS windows open wanted to see when it goes
down and it comes up using PING SERVER -t. I did not see REQUEST TIMED OUT
but was getting a REPLY all the time for more than 45 minutes.

So, I tried connecting through RDP and could not connect. If the server has
come back up it is fine for me and it is not a problem.

The EVENT IDs I see are:

The last even ID before it was supposed to go down was 1074 - USER32 and
after that I have 7036 Service Control Manager.

After this I have WARNING for the following EVENTIDs
40960 SPNGEO in System Events. There is no sign it shows that it started

Usually it will show Eventlog service started or lsass event ID 1000
database engine started.

But, I don't see any kind of events like this on this domain controller. I
infact pulled the event logs by connecting to another DC and from there
pulling the info of the DC which was supposed to reboot... I can check it on
Monday, but just want to make sure as it has both those FSMO roles.

In regard to the RDP not working properly, I have faced this in my previous
job where sometime in October or November I remember or before that I had no
problem in connecting via RDP through my VPN when I installed the patches and
rebooted the server. But, after sometime it stopped connecting via RDP after
the first reboot, so I had to go physically to the datacenter to do the
updates. Same issue I am seeing here on these servers. Not sure when this
started happening, but itused to work but it stops working. Not all behave
like t his, but some servers behave like this.

Hope this helps!

"Coraleigh Miller" wrote:

> Hi Neil,
>
> Every bit of info helps, what are the event ids? Also have you already
> looked them up at eventid.net?
> Do you happen to remmember what patches they were back in october? Is this
> Server 2003 Sp2? Are you also unable to connect to the server via computer
> management?
>
> Coraleigh Miller
>
>
> "Neil" <Neil@discussions.microsoft.com> wrote in message
> news:D57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...
> > Hi,
> >
> > I applied couple of critical patches from April till now as the previous
> > admins did not install any of these patches. But, one of my domain
> > controller
> > (which holds the Global Catalog) was rebooted after the patch install.
> > Reboot
> > command got issued, but it did not time out when I tried pinging with a -t
> > for almost 30 minutes. So, I thought something is wrong. I tried RDP in
> > again
> > and could not.
> >
> > I have noticed this RDP problem cropping up from sometime in October of
> > last
> > year, when I applied patches and after that I could not RDP onto the
> > server.
> > I will have to reboot the server twice to get in through RDP again. Well
> > this
> > is not my main concern, but my main concern is the above problem. I am not
> > physically at the site to look at the server what is going on with my
> > Domain
> > Controller, which I might go in tomorrow to work or on Monday morning if
> > nobody calls in with login issues, I might reboot the server again.
> >
> > If anybody could let me know why all the domain controllers rebooted and
> > this one did not. I have couple of event logs which I can throw it in
> > here,
> > if needed.
>
>
>
 
Hi Neil,

Have you taken a look at this article?
http://support.microsoft.com/kb/931192

Coraleigh


"Neil" <Neil@discussions.microsoft.com> wrote in message
news:53A958E6-679C-48BC-9080-2128EC1AC4B7@microsoft.com...
> Hi Miller,
>
> Thanks for your immediate reply. Well, I am not even worried about the RDP
> issue I am facing. My problem was today (after around 8pm) I had scheduled
> the install of critical patches. As many systems were not patched.
>
> I patched several DCs and rebooted them and it came back. I had a DOS
> window open when I rebooted one of my DC which holds the RID pool manager
> and
> Infrastructure master. I had a DOS windows open wanted to see when it goes
> down and it comes up using PING SERVER -t. I did not see REQUEST TIMED OUT
> but was getting a REPLY all the time for more than 45 minutes.
>
> So, I tried connecting through RDP and could not connect. If the server
> has
> come back up it is fine for me and it is not a problem.
>
> The EVENT IDs I see are:
>
> The last even ID before it was supposed to go down was 1074 - USER32 and
> after that I have 7036 Service Control Manager.
>
> After this I have WARNING for the following EVENTIDs
> 40960 SPNGEO in System Events. There is no sign it shows that it started
>
> Usually it will show Eventlog service started or lsass event ID 1000
> database engine started.
>
> But, I don't see any kind of events like this on this domain controller. I
> infact pulled the event logs by connecting to another DC and from there
> pulling the info of the DC which was supposed to reboot... I can check it
> on
> Monday, but just want to make sure as it has both those FSMO roles.
>
> In regard to the RDP not working properly, I have faced this in my
> previous
> job where sometime in October or November I remember or before that I had
> no
> problem in connecting via RDP through my VPN when I installed the patches
> and
> rebooted the server. But, after sometime it stopped connecting via RDP
> after
> the first reboot, so I had to go physically to the datacenter to do the
> updates. Same issue I am seeing here on these servers. Not sure when this
> started happening, but itused to work but it stops working. Not all
> behave
> like t his, but some servers behave like this.
>
> Hope this helps!
>
> "Coraleigh Miller" wrote:
>
>> Hi Neil,
>>
>> Every bit of info helps, what are the event ids? Also have you already
>> looked them up at eventid.net?
>> Do you happen to remmember what patches they were back in october? Is
>> this
>> Server 2003 Sp2? Are you also unable to connect to the server via
>> computer
>> management?
>>
>> Coraleigh Miller
>>
>>
>> "Neil" <Neil@discussions.microsoft.com> wrote in message
>> news:D57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...
>> > Hi,
>> >
>> > I applied couple of critical patches from April till now as the
>> > previous
>> > admins did not install any of these patches. But, one of my domain
>> > controller
>> > (which holds the Global Catalog) was rebooted after the patch install.
>> > Reboot
>> > command got issued, but it did not time out when I tried pinging with
>> > a -t
>> > for almost 30 minutes. So, I thought something is wrong. I tried RDP in
>> > again
>> > and could not.
>> >
>> > I have noticed this RDP problem cropping up from sometime in October of
>> > last
>> > year, when I applied patches and after that I could not RDP onto the
>> > server.
>> > I will have to reboot the server twice to get in through RDP again.
>> > Well
>> > this
>> > is not my main concern, but my main concern is the above problem. I am
>> > not
>> > physically at the site to look at the server what is going on with my
>> > Domain
>> > Controller, which I might go in tomorrow to work or on Monday morning
>> > if
>> > nobody calls in with login issues, I might reboot the server again.
>> >
>> > If anybody could let me know why all the domain controllers rebooted
>> > and
>> > this one did not. I have couple of event logs which I can throw it in
>> > here,
>> > if needed.
>>
>>
>>
 
Generally the 7036 event pops up after a reboot, reporting the succesfull
running states of various services. It sounds like your server possibly did
reboot but then got hung up on an authentication issue, although its odd
that you could have missed it while watching the 45min ping.
Give this article a read as well, it suggests resetting the trust
relationship between a parent and child domain,
There is also this doc.. http://support.microsoft.com/kb/938702

Coraleigh


"Neil" <Neil@discussions.microsoft.com> wrote in message
news:53A958E6-679C-48BC-9080-2128EC1AC4B7@microsoft.com...
> Hi Miller,
>
> Thanks for your immediate reply. Well, I am not even worried about the RDP
> issue I am facing. My problem was today (after around 8pm) I had scheduled
> the install of critical patches. As many systems were not patched.
>
> I patched several DCs and rebooted them and it came back. I had a DOS
> window open when I rebooted one of my DC which holds the RID pool manager
> and
> Infrastructure master. I had a DOS windows open wanted to see when it goes
> down and it comes up using PING SERVER -t. I did not see REQUEST TIMED OUT
> but was getting a REPLY all the time for more than 45 minutes.
>
> So, I tried connecting through RDP and could not connect. If the server
> has
> come back up it is fine for me and it is not a problem.
>
> The EVENT IDs I see are:
>
> The last even ID before it was supposed to go down was 1074 - USER32 and
> after that I have 7036 Service Control Manager.
>
> After this I have WARNING for the following EVENTIDs
> 40960 SPNGEO in System Events. There is no sign it shows that it started
>
> Usually it will show Eventlog service started or lsass event ID 1000
> database engine started.
>
> But, I don't see any kind of events like this on this domain controller. I
> infact pulled the event logs by connecting to another DC and from there
> pulling the info of the DC which was supposed to reboot... I can check it
> on
> Monday, but just want to make sure as it has both those FSMO roles.
>
> In regard to the RDP not working properly, I have faced this in my
> previous
> job where sometime in October or November I remember or before that I had
> no
> problem in connecting via RDP through my VPN when I installed the patches
> and
> rebooted the server. But, after sometime it stopped connecting via RDP
> after
> the first reboot, so I had to go physically to the datacenter to do the
> updates. Same issue I am seeing here on these servers. Not sure when this
> started happening, but itused to work but it stops working. Not all
> behave
> like t his, but some servers behave like this.
>
> Hope this helps!
>
> "Coraleigh Miller" wrote:
>
>> Hi Neil,
>>
>> Every bit of info helps, what are the event ids? Also have you already
>> looked them up at eventid.net?
>> Do you happen to remmember what patches they were back in october? Is
>> this
>> Server 2003 Sp2? Are you also unable to connect to the server via
>> computer
>> management?
>>
>> Coraleigh Miller
>>
>>
>> "Neil" <Neil@discussions.microsoft.com> wrote in message
>> news:D57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...
>> > Hi,
>> >
>> > I applied couple of critical patches from April till now as the
>> > previous
>> > admins did not install any of these patches. But, one of my domain
>> > controller
>> > (which holds the Global Catalog) was rebooted after the patch install.
>> > Reboot
>> > command got issued, but it did not time out when I tried pinging with
>> > a -t
>> > for almost 30 minutes. So, I thought something is wrong. I tried RDP in
>> > again
>> > and could not.
>> >
>> > I have noticed this RDP problem cropping up from sometime in October of
>> > last
>> > year, when I applied patches and after that I could not RDP onto the
>> > server.
>> > I will have to reboot the server twice to get in through RDP again.
>> > Well
>> > this
>> > is not my main concern, but my main concern is the above problem. I am
>> > not
>> > physically at the site to look at the server what is going on with my
>> > Domain
>> > Controller, which I might go in tomorrow to work or on Monday morning
>> > if
>> > nobody calls in with login issues, I might reboot the server again.
>> >
>> > If anybody could let me know why all the domain controllers rebooted
>> > and
>> > this one did not. I have couple of event logs which I can throw it in
>> > here,
>> > if needed.
>>
>>
>>
 
Hey ha, i just noticed that I have the 40960 SPNGEO on my GC as well, and
they are listed after my server went through a successful reboot. Very odd
though, that you seem to be missing a whole bunch of other event ids both
before and after that, as you mentioned such as the "6005 Event Log" etc.
So..I think looking at these event id's may have led me down a wrong path.
Perhaps since your last event was the 40960 SPNGEO, then at some point
during boot up after that, there is a service stuck in 'starting' which is
causing a slow down of this server hobbling it from receiving rdp requests
and writing anything more to the event log.

I will be interested to hear what you see on your screen on monday! :-)

Coraleigh


"Neil" <Neil@discussions.microsoft.com> wrote in message
news:53A958E6-679C-48BC-9080-2128EC1AC4B7@microsoft.com...
> Hi Miller,
>
> Thanks for your immediate reply. Well, I am not even worried about the RDP
> issue I am facing. My problem was today (after around 8pm) I had scheduled
> the install of critical patches. As many systems were not patched.
>
> I patched several DCs and rebooted them and it came back. I had a DOS
> window open when I rebooted one of my DC which holds the RID pool manager
> and
> Infrastructure master. I had a DOS windows open wanted to see when it goes
> down and it comes up using PING SERVER -t. I did not see REQUEST TIMED OUT
> but was getting a REPLY all the time for more than 45 minutes.
>
> So, I tried connecting through RDP and could not connect. If the server
> has
> come back up it is fine for me and it is not a problem.
>
> The EVENT IDs I see are:
>
> The last even ID before it was supposed to go down was 1074 - USER32 and
> after that I have 7036 Service Control Manager.
>
> After this I have WARNING for the following EVENTIDs
> 40960 SPNGEO in System Events. There is no sign it shows that it started
>
> Usually it will show Eventlog service started or lsass event ID 1000
> database engine started.
>
> But, I don't see any kind of events like this on this domain controller. I
> infact pulled the event logs by connecting to another DC and from there
> pulling the info of the DC which was supposed to reboot... I can check it
> on
> Monday, but just want to make sure as it has both those FSMO roles.
>
> In regard to the RDP not working properly, I have faced this in my
> previous
> job where sometime in October or November I remember or before that I had
> no
> problem in connecting via RDP through my VPN when I installed the patches
> and
> rebooted the server. But, after sometime it stopped connecting via RDP
> after
> the first reboot, so I had to go physically to the datacenter to do the
> updates. Same issue I am seeing here on these servers. Not sure when this
> started happening, but itused to work but it stops working. Not all
> behave
> like t his, but some servers behave like this.
>
> Hope this helps!
>
> "Coraleigh Miller" wrote:
>
>> Hi Neil,
>>
>> Every bit of info helps, what are the event ids? Also have you already
>> looked them up at eventid.net?
>> Do you happen to remmember what patches they were back in october? Is
>> this
>> Server 2003 Sp2? Are you also unable to connect to the server via
>> computer
>> management?
>>
>> Coraleigh Miller
>>
>>
>> "Neil" <Neil@discussions.microsoft.com> wrote in message
>> news:D57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...
>> > Hi,
>> >
>> > I applied couple of critical patches from April till now as the
>> > previous
>> > admins did not install any of these patches. But, one of my domain
>> > controller
>> > (which holds the Global Catalog) was rebooted after the patch install.
>> > Reboot
>> > command got issued, but it did not time out when I tried pinging with
>> > a -t
>> > for almost 30 minutes. So, I thought something is wrong. I tried RDP in
>> > again
>> > and could not.
>> >
>> > I have noticed this RDP problem cropping up from sometime in October of
>> > last
>> > year, when I applied patches and after that I could not RDP onto the
>> > server.
>> > I will have to reboot the server twice to get in through RDP again.
>> > Well
>> > this
>> > is not my main concern, but my main concern is the above problem. I am
>> > not
>> > physically at the site to look at the server what is going on with my
>> > Domain
>> > Controller, which I might go in tomorrow to work or on Monday morning
>> > if
>> > nobody calls in with login issues, I might reboot the server again.
>> >
>> > If anybody could let me know why all the domain controllers rebooted
>> > and
>> > this one did not. I have couple of event logs which I can throw it in
>> > here,
>> > if needed.
>>
>>
>>
 
Appologies for all the replys! I just noticed that the 40960 SPNGEO event is
quite sporadic on this server im looking at. Does your 7036 actually say
that such and such is entering a running state or a stopped state? If a
stopped state then, yeah it would seem your server hasnt rebooted. What is
the name of the service that is mentioned in this 7036?

Coraleigh


"Neil" <Neil@discussions.microsoft.com> wrote in message
news:53A958E6-679C-48BC-9080-2128EC1AC4B7@microsoft.com...
> Hi Miller,
>
> Thanks for your immediate reply. Well, I am not even worried about the RDP
> issue I am facing. My problem was today (after around 8pm) I had scheduled
> the install of critical patches. As many systems were not patched.
>
> I patched several DCs and rebooted them and it came back. I had a DOS
> window open when I rebooted one of my DC which holds the RID pool manager
> and
> Infrastructure master. I had a DOS windows open wanted to see when it goes
> down and it comes up using PING SERVER -t. I did not see REQUEST TIMED OUT
> but was getting a REPLY all the time for more than 45 minutes.
>
> So, I tried connecting through RDP and could not connect. If the server
> has
> come back up it is fine for me and it is not a problem.
>
> The EVENT IDs I see are:
>
> The last even ID before it was supposed to go down was 1074 - USER32 and
> after that I have 7036 Service Control Manager.
>
> After this I have WARNING for the following EVENTIDs
> 40960 SPNGEO in System Events. There is no sign it shows that it started
>
> Usually it will show Eventlog service started or lsass event ID 1000
> database engine started.
>
> But, I don't see any kind of events like this on this domain controller. I
> infact pulled the event logs by connecting to another DC and from there
> pulling the info of the DC which was supposed to reboot... I can check it
> on
> Monday, but just want to make sure as it has both those FSMO roles.
>
> In regard to the RDP not working properly, I have faced this in my
> previous
> job where sometime in October or November I remember or before that I had
> no
> problem in connecting via RDP through my VPN when I installed the patches
> and
> rebooted the server. But, after sometime it stopped connecting via RDP
> after
> the first reboot, so I had to go physically to the datacenter to do the
> updates. Same issue I am seeing here on these servers. Not sure when this
> started happening, but itused to work but it stops working. Not all
> behave
> like t his, but some servers behave like this.
>
> Hope this helps!
>
> "Coraleigh Miller" wrote:
>
>> Hi Neil,
>>
>> Every bit of info helps, what are the event ids? Also have you already
>> looked them up at eventid.net?
>> Do you happen to remmember what patches they were back in october? Is
>> this
>> Server 2003 Sp2? Are you also unable to connect to the server via
>> computer
>> management?
>>
>> Coraleigh Miller
>>
>>
>> "Neil" <Neil@discussions.microsoft.com> wrote in message
>> news:D57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...
>> > Hi,
>> >
>> > I applied couple of critical patches from April till now as the
>> > previous
>> > admins did not install any of these patches. But, one of my domain
>> > controller
>> > (which holds the Global Catalog) was rebooted after the patch install.
>> > Reboot
>> > command got issued, but it did not time out when I tried pinging with
>> > a -t
>> > for almost 30 minutes. So, I thought something is wrong. I tried RDP in
>> > again
>> > and could not.
>> >
>> > I have noticed this RDP problem cropping up from sometime in October of
>> > last
>> > year, when I applied patches and after that I could not RDP onto the
>> > server.
>> > I will have to reboot the server twice to get in through RDP again.
>> > Well
>> > this
>> > is not my main concern, but my main concern is the above problem. I am
>> > not
>> > physically at the site to look at the server what is going on with my
>> > Domain
>> > Controller, which I might go in tomorrow to work or on Monday morning
>> > if
>> > nobody calls in with login issues, I might reboot the server again.
>> >
>> > If anybody could let me know why all the domain controllers rebooted
>> > and
>> > this one did not. I have couple of event logs which I can throw it in
>> > here,
>> > if needed.
>>
>>
>>
 

Similar threads

P
Secure Windows Server 2012/R2 workloads with options from Azure
Replies
0
Views
25
Patrick Widjaja
P
A
Microsoft Security Exposure Management Graph: unveiling the power
Replies
0
Views
26
andreykarpovsky
A
AWS
Exploring Azure Firewall's Threat Protection
Replies
0
Views
108
AWS
AWS
AWS
Announcing the public preview of Azure Virtual Desktop Custom Image Templates
Replies
0
Views
132
AWS
AWS
AWS
Windows Admin Center version 2306 is now generally available!
Replies
0
Views
122
AWS
AWS
Back
Top