MS Critical Patches - Reboot - Did not reboot.

Coraleigh Miller

Hey ha, i just noticed that I have the 40960 SPNGEO on my GC as well, and
they are listed after my server went through a successful reboot. Very odd
though, that you seem to be missing a whole bunch of other event ids both
before and after that, as you mentioned such as the "6005 Event Log" etc.
So..I think looking at these event id's may have led me down a wrong path.
Perhaps since your last event was the 40960 SPNGEO, then at some point
during boot up after that, there is a service stuck in 'starting' which is
causing a slow down of this server hobbling it from receiving rdp requests
and writing anything more to the event log.

I will be interested to hear what you see on your screen on monday! :-)

Coraleigh


"Neil" <Neil@discussions.microsoft.com> wrote in message
news:53A958E6-679C-48BC-9080-2128EC1AC4B7@microsoft.com...
> Hi Miller,
>
> Thanks for your immediate reply. Well, I am not even worried about the RDP
> issue I am facing. My problem was today (after around 8pm) I had scheduled
> the install of critical patches. As many systems were not patched.
>
> I patched several DCs and rebooted them and it came back. I had a DOS
> window open when I rebooted one of my DC which holds the RID pool manager
> and
> Infrastructure master. I had a DOS windows open wanted to see when it goes
> down and it comes up using PING SERVER -t. I did not see REQUEST TIMED OUT
> but was getting a REPLY all the time for more than 45 minutes.
>
> So, I tried connecting through RDP and could not connect. If the server
> has
> come back up it is fine for me and it is not a problem.
>
> The EVENT IDs I see are:
>
> The last even ID before it was supposed to go down was 1074 - USER32 and
> after that I have 7036 Service Control Manager.
>
> After this I have WARNING for the following EVENTIDs
> 40960 SPNGEO in System Events. There is no sign it shows that it started
>
> Usually it will show Eventlog service started or lsass event ID 1000
> database engine started.
>
> But, I don't see any kind of events like this on this domain controller. I
> infact pulled the event logs by connecting to another DC and from there
> pulling the info of the DC which was supposed to reboot... I can check it
> on
> Monday, but just want to make sure as it has both those FSMO roles.
>
> In regard to the RDP not working properly, I have faced this in my
> previous
> job where sometime in October or November I remember or before that I had
> no
> problem in connecting via RDP through my VPN when I installed the patches
> and
> rebooted the server. But, after sometime it stopped connecting via RDP
> after
> the first reboot, so I had to go physically to the datacenter to do the
> updates. Same issue I am seeing here on these servers. Not sure when this
> started happening, but itused to work but it stops working. Not all
> behave
> like t his, but some servers behave like this.
>
> Hope this helps!
>
> "Coraleigh Miller" wrote:
>
>> Hi Neil,
>>
>> Every bit of info helps, what are the event ids? Also have you already
>> looked them up at eventid.net?
>> Do you happen to remmember what patches they were back in october? Is
>> this
>> Server 2003 Sp2? Are you also unable to connect to the server via
>> computer
>> management?
>>
>> Coraleigh Miller
>>
>>
>> "Neil" <Neil@discussions.microsoft.com> wrote in message
>> news57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...
>> > Hi,
>> >
>> > I applied couple of critical patches from April till now as the
>> > previous
>> > admins did not install any of these patches. But, one of my domain
>> > controller
>> > (which holds the Global Catalog) was rebooted after the patch install.
>> > Reboot
>> > command got issued, but it did not time out when I tried pinging with
>> > a -t
>> > for almost 30 minutes. So, I thought something is wrong. I tried RDP in
>> > again
>> > and could not.
>> >
>> > I have noticed this RDP problem cropping up from sometime in October of
>> > last
>> > year, when I applied patches and after that I could not RDP onto the
>> > server.
>> > I will have to reboot the server twice to get in through RDP again.
>> > Well
>> > this
>> > is not my main concern, but my main concern is the above problem. I am
>> > not
>> > physically at the site to look at the server what is going on with my
>> > Domain
>> > Controller, which I might go in tomorrow to work or on Monday morning
>> > if
>> > nobody calls in with login issues, I might reboot the server again.
>> >
>> > If anybody could let me know why all the domain controllers rebooted
>> > and
>> > this one did not. I have couple of event logs which I can throw it in
>> > here,
>> > if needed.
>>
>>
>>

Coraleigh Miller

Appologies for all the replys! I just noticed that the 40960 SPNGEO event is
quite sporadic on this server im looking at. Does your 7036 actually say
that such and such is entering a running state or a stopped state? If a
stopped state then, yeah it would seem your server hasnt rebooted. What is
the name of the service that is mentioned in this 7036?

Coraleigh


"Neil" <Neil@discussions.microsoft.com> wrote in message
news:53A958E6-679C-48BC-9080-2128EC1AC4B7@microsoft.com...
> Hi Miller,
>
> Thanks for your immediate reply. Well, I am not even worried about the RDP
> issue I am facing. My problem was today (after around 8pm) I had scheduled
> the install of critical patches. As many systems were not patched.
>
> I patched several DCs and rebooted them and it came back. I had a DOS
> window open when I rebooted one of my DC which holds the RID pool manager
> and
> Infrastructure master. I had a DOS windows open wanted to see when it goes
> down and it comes up using PING SERVER -t. I did not see REQUEST TIMED OUT
> but was getting a REPLY all the time for more than 45 minutes.
>
> So, I tried connecting through RDP and could not connect. If the server
> has
> come back up it is fine for me and it is not a problem.
>
> The EVENT IDs I see are:
>
> The last even ID before it was supposed to go down was 1074 - USER32 and
> after that I have 7036 Service Control Manager.
>
> After this I have WARNING for the following EVENTIDs
> 40960 SPNGEO in System Events. There is no sign it shows that it started
>
> Usually it will show Eventlog service started or lsass event ID 1000
> database engine started.
>
> But, I don't see any kind of events like this on this domain controller. I
> infact pulled the event logs by connecting to another DC and from there
> pulling the info of the DC which was supposed to reboot... I can check it
> on
> Monday, but just want to make sure as it has both those FSMO roles.
>
> In regard to the RDP not working properly, I have faced this in my
> previous
> job where sometime in October or November I remember or before that I had
> no
> problem in connecting via RDP through my VPN when I installed the patches
> and
> rebooted the server. But, after sometime it stopped connecting via RDP
> after
> the first reboot, so I had to go physically to the datacenter to do the
> updates. Same issue I am seeing here on these servers. Not sure when this
> started happening, but itused to work but it stops working. Not all
> behave
> like t his, but some servers behave like this.
>
> Hope this helps!
>
> "Coraleigh Miller" wrote:
>
>> Hi Neil,
>>
>> Every bit of info helps, what are the event ids? Also have you already
>> looked them up at eventid.net?
>> Do you happen to remmember what patches they were back in october? Is
>> this
>> Server 2003 Sp2? Are you also unable to connect to the server via
>> computer
>> management?
>>
>> Coraleigh Miller
>>
>>
>> "Neil" <Neil@discussions.microsoft.com> wrote in message
>> news57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...
>> > Hi,
>> >
>> > I applied couple of critical patches from April till now as the
>> > previous
>> > admins did not install any of these patches. But, one of my domain
>> > controller
>> > (which holds the Global Catalog) was rebooted after the patch install.
>> > Reboot
>> > command got issued, but it did not time out when I tried pinging with
>> > a -t
>> > for almost 30 minutes. So, I thought something is wrong. I tried RDP in
>> > again
>> > and could not.
>> >
>> > I have noticed this RDP problem cropping up from sometime in October of
>> > last
>> > year, when I applied patches and after that I could not RDP onto the
>> > server.
>> > I will have to reboot the server twice to get in through RDP again.
>> > Well
>> > this
>> > is not my main concern, but my main concern is the above problem. I am
>> > not
>> > physically at the site to look at the server what is going on with my
>> > Domain
>> > Controller, which I might go in tomorrow to work or on Monday morning
>> > if
>> > nobody calls in with login issues, I might reboot the server again.
>> >
>> > If anybody could let me know why all the domain controllers rebooted
>> > and
>> > this one did not. I have couple of event logs which I can throw it in
>> > here,
>> > if needed.
>>
>>
>>

Coraleigh Miller

Appologies for all the replys! I just noticed that the 40960 SPNGEO event is
quite sporadic on this server im looking at. Does your 7036 actually say
that such and such is entering a running state or a stopped state? If a
stopped state then, yeah it would seem your server hasnt rebooted. What is
the name of the service that is mentioned in this 7036?

Coraleigh


"Neil" <Neil@discussions.microsoft.com> wrote in message
news:53A958E6-679C-48BC-9080-2128EC1AC4B7@microsoft.com...
> Hi Miller,
>
> Thanks for your immediate reply. Well, I am not even worried about the RDP
> issue I am facing. My problem was today (after around 8pm) I had scheduled
> the install of critical patches. As many systems were not patched.
>
> I patched several DCs and rebooted them and it came back. I had a DOS
> window open when I rebooted one of my DC which holds the RID pool manager
> and
> Infrastructure master. I had a DOS windows open wanted to see when it goes
> down and it comes up using PING SERVER -t. I did not see REQUEST TIMED OUT
> but was getting a REPLY all the time for more than 45 minutes.
>
> So, I tried connecting through RDP and could not connect. If the server
> has
> come back up it is fine for me and it is not a problem.
>
> The EVENT IDs I see are:
>
> The last even ID before it was supposed to go down was 1074 - USER32 and
> after that I have 7036 Service Control Manager.
>
> After this I have WARNING for the following EVENTIDs
> 40960 SPNGEO in System Events. There is no sign it shows that it started
>
> Usually it will show Eventlog service started or lsass event ID 1000
> database engine started.
>
> But, I don't see any kind of events like this on this domain controller. I
> infact pulled the event logs by connecting to another DC and from there
> pulling the info of the DC which was supposed to reboot... I can check it
> on
> Monday, but just want to make sure as it has both those FSMO roles.
>
> In regard to the RDP not working properly, I have faced this in my
> previous
> job where sometime in October or November I remember or before that I had
> no
> problem in connecting via RDP through my VPN when I installed the patches
> and
> rebooted the server. But, after sometime it stopped connecting via RDP
> after
> the first reboot, so I had to go physically to the datacenter to do the
> updates. Same issue I am seeing here on these servers. Not sure when this
> started happening, but itused to work but it stops working. Not all
> behave
> like t his, but some servers behave like this.
>
> Hope this helps!
>
> "Coraleigh Miller" wrote:
>
>> Hi Neil,
>>
>> Every bit of info helps, what are the event ids? Also have you already
>> looked them up at eventid.net?
>> Do you happen to remmember what patches they were back in october? Is
>> this
>> Server 2003 Sp2? Are you also unable to connect to the server via
>> computer
>> management?
>>
>> Coraleigh Miller
>>
>>
>> "Neil" <Neil@discussions.microsoft.com> wrote in message
>> news57C43BA-CD78-4694-9614-70BD00239185@microsoft.com...
>> > Hi,
>> >
>> > I applied couple of critical patches from April till now as the
>> > previous
>> > admins did not install any of these patches. But, one of my domain
>> > controller
>> > (which holds the Global Catalog) was rebooted after the patch install.
>> > Reboot
>> > command got issued, but it did not time out when I tried pinging with
>> > a -t
>> > for almost 30 minutes. So, I thought something is wrong. I tried RDP in
>> > again
>> > and could not.
>> >
>> > I have noticed this RDP problem cropping up from sometime in October of
>> > last
>> > year, when I applied patches and after that I could not RDP onto the
>> > server.
>> > I will have to reboot the server twice to get in through RDP again.
>> > Well
>> > this
>> > is not my main concern, but my main concern is the above problem. I am
>> > not
>> > physically at the site to look at the server what is going on with my
>> > Domain
>> > Controller, which I might go in tomorrow to work or on Monday morning
>> > if
>> > nobody calls in with login issues, I might reboot the server again.
>> >
>> > If anybody could let me know why all the domain controllers rebooted
>> > and
>> > this one did not. I have couple of event logs which I can throw it in
>> > here,
>> > if needed.
>>
>>
>>