can not connect via remote desktop after a restart

[loki]

Hello,

We just restart one windows 2008 server, and now we can not connect
anymore via remote desktop to it and also the http service is not working
anymore. but we can ping the server !

do you have some idea of what could have happen to the server ?

Thanks you by advance


--
stephane

Http://www.arkadia.com/fra/
Http://www.arkadia.com/usa/
Http://www.arkadia.com/rus/

 

[Lanwench [MVP - Exchange]]

loki wrote:
> Hello,
>
> We just restart one windows 2008 server, and now we can not connect
> anymore via remote desktop to it and also the http service is not
> working anymore. but we can ping the server !
>
> do you have some idea of what could have happen to the server ?
>
> Thanks you by advance

Log in at the console and check the event logs for errors/clues.

 

[Pegasus [MVP]]

"loki" wrote in message
news:B8879FDF-1579-4E66-804C-3545F4864D4D@microsoft.com...
> Hello,
>
> We just restart one windows 2008 server, and now we can not connect
> anymore via remote desktop to it and also the http service is not working
> anymore. but we can ping the server !
>
> do you have some idea of what could have happen to the server ?
>
> Thanks you by advance
>
>
> --
> stephane

Same comment as for the post headed "Trouble with Remote Desktop", posted 30
minutes before your post.

 

[loki]

Hello Lanwench,

1. yesterday we restart the computer but we absolutely do nothing on it (no
install or no update, just a normal reboot)
2. after the reboot it's was impossible to login via rdp to the computer !
the HTTP service was also not working. But the ping was
working !
3. we try to manually reboot the server (switch off/on the power) nothing
change! can still ping the server but can not access
it via remote desktop and http service still not answer.
4. we try to login localy (not remotely), but impossible to login, because
for long time we see : 'Apply user settings' without any harddrive activity
no other choice to reboot the computer
5. we retart the computer un safe mode and this time we can log in it. i
copy all the event log but anazing their is absolutely
nothing wrong in it ! no error ! no clues about what can forbid us to
connecte via remote desktop or the IIS to answer.

in the log, their is no error but i notice that normally i see this entry
after a reboot :

MSDTC started with the following settings: ...
The Terminal Services Configuration service entered the running state.
The Server service entered the running state.
The World Wide Web Publishing Service service entered the running state.
etc..

but from the reboot of yesterday i don't see this entry

also i notice all the missing line are after this event :
File System Filter 'luafv' (6.0, 2008-01-19T05:59:06.000Z) has successfully
loaded and registered with Filter Manager.
the next line is normally :
The Plug and Play service entered the running state.

What do you thing the probleme can be ? what to do ?
Remembered, we don't install anything on the computer, just restart it...

many thanks by advance
stephane



"Lanwench [MVP - Exchange]"
wrote in message
news:%23bAd1SuQKHA.4244@TK2MSFTNGP06.phx.gbl...
> loki wrote:
>> Hello,
>>
>> We just restart one windows 2008 server, and now we can not connect
>> anymore via remote desktop to it and also the http service is not
>> working anymore. but we can ping the server !
>>
>> do you have some idea of what could have happen to the server ?
>>
>> Thanks you by advance
>
> Log in at the console and check the event logs for errors/clues.
>

 

[Ace Fekay [MCT]]

"loki" wrote in message
news:A67A6C89-49B2-424E-ACB4-D22F54EFDC3E@microsoft.com...
> Hello Lanwench,
>
> 1. yesterday we restart the computer but we absolutely do nothing on it
> (no install or no update, just a normal reboot)
> 2. after the reboot it's was impossible to login via rdp to the computer !
> the HTTP service was also not working. But the ping was
> working !
> 3. we try to manually reboot the server (switch off/on the power) nothing
> change! can still ping the server but can not access
> it via remote desktop and http service still not answer.
> 4. we try to login localy (not remotely), but impossible to login, because
> for long time we see : 'Apply user settings' without any harddrive
> activity
> no other choice to reboot the computer
> 5. we retart the computer un safe mode and this time we can log in it. i
> copy all the event log but anazing their is absolutely
> nothing wrong in it ! no error ! no clues about what can forbid us to
> connecte via remote desktop or the IIS to answer.
>
> in the log, their is no error but i notice that normally i see this entry
> after a reboot :
>
> MSDTC started with the following settings: ...
> The Terminal Services Configuration service entered the running state.
> The Server service entered the running state.
> The World Wide Web Publishing Service service entered the running state.
> etc..
>
> but from the reboot of yesterday i don't see this entry
>
> also i notice all the missing line are after this event :
> File System Filter 'luafv' (6.0, 2008-01-19T05:59:06.000Z) has
> successfully loaded and registered with Filter Manager.
> the next line is normally :
> The Plug and Play service entered the running state.
>
> What do you thing the probleme can be ? what to do ?
> Remembered, we don't install anything on the computer, just restart it...
>
> many thanks by advance
> stephane
>
>

If they're stopped, have you trid to manually start the IISAdmin service,
and the web publishing service?

Ace

 

[loki]

Yes of course... nothing work

also some strange bug in
IIS (i can not see the web site configuration details for
exemple)

i not understand why nothing work just after a simple
restart ! Is this is already happen to someone ?

thanks you by advance
stephane


"Ace Fekay [MCT]" wrote in message
news:%23XOra12QKHA.5032@TK2MSFTNGP05.phx.gbl...
> "loki" wrote in message
> news:A67A6C89-49B2-424E-ACB4-D22F54EFDC3E@microsoft.com...
>> Hello Lanwench,
>>
>> 1. yesterday we restart the computer but we absolutely do nothing on it
>> (no install or no update, just a normal reboot)
>> 2. after the reboot it's was impossible to login via rdp to the computer
>> ! the HTTP service was also not working. But the ping was
>> working !
>> 3. we try to manually reboot the server (switch off/on the power) nothing
>> change! can still ping the server but can not access
>> it via remote desktop and http service still not answer.
>> 4. we try to login localy (not remotely), but impossible to login,
>> because for long time we see : 'Apply user settings' without any
>> harddrive activity
>> no other choice to reboot the computer
>> 5. we retart the computer un safe mode and this time we can log in it. i
>> copy all the event log but anazing their is absolutely
>> nothing wrong in it ! no error ! no clues about what can forbid us to
>> connecte via remote desktop or the IIS to answer.
>>
>> in the log, their is no error but i notice that normally i see this entry
>> after a reboot :
>>
>> MSDTC started with the following settings: ...
>> The Terminal Services Configuration service entered the running state.
>> The Server service entered the running state.
>> The World Wide Web Publishing Service service entered the running state.
>> etc..
>>
>> but from the reboot of yesterday i don't see this entry
>>
>> also i notice all the missing line are after this event :
>> File System Filter 'luafv' (6.0, 2008-01-19T05:59:06.000Z) has
>> successfully loaded and registered with Filter Manager.
>> the next line is normally :
>> The Plug and Play service entered the running state.
>>
>> What do you thing the probleme can be ? what to do ?
>> Remembered, we don't install anything on the computer, just restart it...
>>
>> many thanks by advance
>> stephane
>>
>>
>
> If they're stopped, have you trid to manually start the IISAdmin service,
> and the web publishing service?
>
> Ace
>

 

[Ace Fekay [MCT]]

"loki" wrote in message
news:3721A299-A5A8-466E-BFD0-5D3DA207D01A@microsoft.com...
> Yes of course... nothing work

also some strange bug in
> IIS (i can not see the web site configuration details for
> exemple)
>
> i not understand why nothing work just after a simple
> restart ! Is this is already happen to someone ?
>
> thanks you by advance
> stephane
>

No, that's not supposed to happen. It could be something else is causing it.
Post an ipconfig /all from the server, as well as the EventID# and Source
Names and the error messages in the events that you see from errors in the
event logs. This will better help than the descriptions you've provided.

Ace

 

[loki]

the problem is that now i can not anymore login under the server

for what i see when i was logged (but in safe mode) is that
in the event they was no error message at all ! this was supprised me,
i was hopping to see some error why all the service not
start... nothing !! just i notice that in the event log we miss
some entry like :
MSDTC started with the following settings: ...
The Terminal Services Configuration service entered the running state.
The Server service entered the running state.
The World Wide Web Publishing Service service entered the running state.

that mean the service not start ! but no explanation why they not start, no
error !
so it's look like the process do an infinite loop somewhere between
"File System Filter 'luafv' (6.0, 2008-01-19T05:59:06.000Z) has successfully
loaded and registered with Filter Manager"
and
"The Plug and Play service entered the running state"

that delay all the other event to happen !
network card driver error ? (but in safe mode i have the internet...)
other driver error ? but why no error in the event log ...


below all the event just after a reboot for the
1rt time the server :

**********************************
**********************************
**********************************
SYSTEM
**********************************
**********************************
**********************************

!!and nothing more still the next hard reboot!!
Information 10/2/2009 12:23:29 AM Microsoft-Windows-FilterManager 6 None
File System Filter 'luafv' (6.0, 2008-01-19T05:59:06.000Z) has successfully
loaded and registered with Filter Manager.
Information 10/2/2009 12:23:21 AM Tcpip 4201 None The system detected that
network adapter Local Area Connection was connected to the network, and has
initiated normal operation.
Information 10/2/2009 12:23:21 AM Tcpip 4201 None The system detected that
network adapter Local Area Connection was connected to the network, and has
initiated normal operation.
Information 10/2/2009 12:23:21 AM l2nd 9 None Broadcom BCM5708C: Network
controller configured for 100Mb full-duplex link.
Information 10/2/2009 12:23:21 AM Tcpip 4201 None The system detected that
network adapter Local Area Connection 2 was connected to the network, and
has initiated normal operation.
Information 10/2/2009 12:23:21 AM Tcpip 4201 None The system detected that
network adapter Local Area Connection 2 was connected to the network, and
has initiated normal operation.
Information 10/2/2009 12:23:21 AM l2nd 9 None Broadcom BCM5708C: Network
controller configured for 100Mb full-duplex link.
Warning 10/2/2009 12:23:19 AM l2nd 4 None Broadcom BCM5708C: The network
link is down. Check to make sure the network cable is properly connected.
Warning 10/2/2009 12:23:18 AM l2nd 4 None Broadcom BCM5708C: The network
link is down. Check to make sure the network cable is properly connected.
Information 10/2/2009 12:23:18 AM l2nd 16 None Broadcom BCM5708C: Driver
initialized successfully.
Information 10/2/2009 12:23:18 AM b06bdrv 18 None \Device\NTPNP_PCI0030:
Ndis device bound successfully.
Information 10/2/2009 12:23:18 AM l2nd 16 None Broadcom BCM5708C: Driver
initialized successfully.
Information 10/2/2009 12:23:18 AM b06bdrv 18 None \Device\NTPNP_PCI0032:
Ndis device bound successfully.
Information 10/2/2009 12:23:18 AM Microsoft-Windows-Kernel-Processor-Power 4
None "Processor 0 exposes the following:

1 idle state(s)
0 performance state(s)
0 throttle state(s)"
Information 10/2/2009 12:23:18 AM Microsoft-Windows-Kernel-Processor-Power 4
None "Processor 3 exposes the following:

1 idle state(s)
0 performance state(s)
0 throttle state(s)"
Information 10/2/2009 12:23:18 AM Microsoft-Windows-Kernel-Processor-Power 4
None "Processor 2 exposes the following:

1 idle state(s)
0 performance state(s)
0 throttle state(s)"
Information 10/2/2009 12:23:18 AM Microsoft-Windows-Kernel-Processor-Power 4
None "Processor 1 exposes the following:

1 idle state(s)
0 performance state(s)
0 throttle state(s)"
Information 10/2/2009 12:23:16 AM Tcpip 4201 None The system detected that
network adapter Loopback Pseudo-Interface 1 was connected to the network,
and has initiated normal operation.
Information 10/2/2009 12:23:16 AM Tcpip 4201 None The system detected that
network adapter Loopback Pseudo-Interface 1 was connected to the network,
and has initiated normal operation.
Information 10/2/2009 12:23:16 AM b06bdrv 12 None \Device\NTPNP_PCI0030:
Driver initialized successfully.
Information 10/2/2009 12:23:16 AM b06bdrv 12 None \Device\NTPNP_PCI0032:
Driver initialized successfully.
Information 10/2/2009 12:23:29 AM EventLog 6013 None The system uptime is 39
seconds.
Information 10/2/2009 12:23:29 AM EventLog 6005 None The Event log service
was started.
Information 10/2/2009 12:23:29 AM EventLog 6009 None Microsoft

 

[Ace Fekay [MCT]]

"loki" wrote in message
news:C2E312C0-149E-460A-8F78-3ED2F856AA2C@microsoft.com...
> the problem is that now i can not anymore login under the server

> for what i see when i was logged (but in safe mode) is that
> in the event they was no error message at all ! this was supprised me,
> i was hopping to see some error why all the service not
> start... nothing !! just i notice that in the event log we miss
> some entry like :
> MSDTC started with the following settings: ...
> The Terminal Services Configuration service entered the running state.
> The Server service entered the running state.
> The World Wide Web Publishing Service service entered the running state.
>
> that mean the service not start ! but no explanation why they not start,
> no error !
> so it's look like the process do an infinite loop somewhere between
> "File System Filter 'luafv' (6.0, 2008-01-19T05:59:06.000Z) has
> successfully
> loaded and registered with Filter Manager"
> and
> "The Plug and Play service entered the running state"
>
> that delay all the other event to happen !
> network card driver error ? (but in safe mode i have the internet...)
> other driver error ? but why no error in the event log ...
>
>
> below all the event just after a reboot for the
> 1rt time the server :



Lot's of info. Thank you.

However, nothing specific stands out. I can't find anything specific with
the "The File System Filter 'luafv' issue" The informational stuff is just
letting you know what's starting, etc.

How about the ipconfig /all?

Was anything installed or changed prior to this all happening?

Ace

 

[loki]

> Lot's of info. Thank you.
>
> However, nothing specific stands out. I can't find anything specific with
> the "The File System Filter 'luafv' issue" The informational stuff is just
> letting you know what's starting, etc.
>
> How about the ipconfig /all?
>
> Was anything installed or changed prior to this all happening?
>
> Ace


you see like me, nothing wrong in the event log ! i can not believe it !
it like i do a bad nightmare. unfortunatly i don't have anymore access
to the server i don't remembered about the ipconfig / all, but i thing
this was ok (because we can use the internet from the server, i connect
to it in safe mode by vnc)

i don't install anything on this server this year (except the windows
update)
and for the 3 last week we haven't installed any windows update.

what i know :
1/ the server was reboot 2 week ago du to a power faillure. but work
well after.
2/ we reboot the server around 1 time a week for the maintenance
of the IIS application
3/ we have 3 other server that are exactly the same that still work
very well (the server are dell PowerEdge 2950, 4 go of memory,
sas hard drive)
3/ it's a web server, more than 20 000 people everyday on it.
could it be an attack that destroy the server ? a fail in php ? but
in this case why the server crash only after we do a reboot ?
4/ when the guy connect in normal mode (but the first time
it's was impossible for him because it's was "apply user settings
for undefinite time), he notice some probleme with the driver of
the network card (also he notice that the windows seam very unstable
some device are not show in the device manager for exemple)
5/ also i notice some strange but in IIS (but i don't know
if it's was because i was in safe mode). for exemple i can
not see the website configuration detail panel of one website,
alway i receive an error when i try to do it given me an empty
configuration panel

thank again for you help !

stephane

 

[Ace Fekay [MCT]]

"loki" wrote in message
news:CE223B4F-B9CA-4350-82ED-35E967EF30B7@microsoft.com...
>> Lot's of info. Thank you.
>>
>> However, nothing specific stands out. I can't find anything specific with
>> the "The File System Filter 'luafv' issue" The informational stuff is
>> just letting you know what's starting, etc.
>>
>> How about the ipconfig /all?
>>
>> Was anything installed or changed prior to this all happening?
>>
>> Ace
>
>
> you see like me, nothing wrong in the event log ! i can not believe it !
> it like i do a bad nightmare. unfortunatly i don't have anymore access
> to the server i don't remembered about the ipconfig / all, but i thing
> this was ok (because we can use the internet from the server, i connect
> to it in safe mode by vnc)
>
> i don't install anything on this server this year (except the windows
> update)
> and for the 3 last week we haven't installed any windows update.
>
> what i know :
> 1/ the server was reboot 2 week ago du to a power faillure. but work
> well after.
> 2/ we reboot the server around 1 time a week for the maintenance
> of the IIS application
> 3/ we have 3 other server that are exactly the same that still work
> very well (the server are dell PowerEdge 2950, 4 go of memory,
> sas hard drive)
> 3/ it's a web server, more than 20 000 people everyday on it.
> could it be an attack that destroy the server ? a fail in php ? but
> in this case why the server crash only after we do a reboot ?
> 4/ when the guy connect in normal mode (but the first time
> it's was impossible for him because it's was "apply user settings
> for undefinite time), he notice some probleme with the driver of
> the network card (also he notice that the windows seam very unstable
> some device are not show in the device manager for exemple)
> 5/ also i notice some strange but in IIS (but i don't know
> if it's was because i was in safe mode). for exemple i can
> not see the website configuration detail panel of one website,
> alway i receive an error when i try to do it given me an empty
> configuration panel
>
> thank again for you help !
>
> stephane


I see, so there were two things that seems possibly mitigated this:

1. Power failure forcing it down.

2. Possible change in the web app during maintenance, but I don't think this
would have caused it.

If you boot in Safe Mode, none of the drivers and most services are not
started. That is why you can't do anything with IIS in safe mode.

I think the NIC got hit, possibly something else, too. Reboot into the BIOS.
Disable the NICs, and boot up.

If you have another NIC to install, disable the onboard NICs, and install
the other NIC. Go into Safe Mode with networking, set the IP addresses, then
reboot in normal mode. If that works, then you know it's a NIC issue or
something else on the board that can't communicate with the NIC. If this is
the case, call Dell to replace the board, assuming it's still under
warranty.

Ace