Event 4311, Source:netBT after applying latest patches

[Magoo]

In 3 out of 5 Win2003 servers, SAN connected, I applied latest patches
842773, 890859, 893086, 890923 and on event I got error:
Event:4311, source:netbt

Basically servers get no IP address and a "Run time error" message box
appears after Windows startup.

In one server I attempted to remove TCP/IP protocol, and reinstall it but
that did not improve the situation. I removed patches, but that did not fix
the problem either. I confirmed that on the affected three servers event
4311 was inexistent prior to patch deployment last night.

If anyone there has seen similar problem please let me know.

 

[Steven L Umbach]

Ouch. I have not heard of any specific problems. What you could try is to
remove the patches on one of the servers to see if it helps. With trial and
error you may be able to isolate it to a particular patch number and then
contact Microsoft [ see below] with all the specifics [ installed
software/hardware] to see if they can help being sure to specify that the
problem resulted as a result of a security update. Usually you can use add
and remove programs to remove a patch. There are also some Windows Update
newsgroups where you may want to post and there is one specific to Windows
2000. --- Steve

Support:
. Customers in the U.S. and Canada can receive technical support from
Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for
support calls that are associated with security updates.

 

[Derek Fradsham]

I have a customer who reported this exact same problem (yesterday) on
several of his servers. Background:

All Windows 2003 member servers in 2003 AD - no SP1
Some are SAN attached
Various apps running on servers, EPO, IIS/Coldfusion
upon reboot, very slow to get to logon screen, most of the time spent at
"preparing network connections"
Cannot ping the machine until after a logon.
4311 event in log.

I am having them check to see what patches were recently installed, and to
run an AV & spyware check, as this sounds like either a MS patch screwup or
an infestation.

Please respond with anything found.

Derek

 

[Magoo]

MS admitted was a bug in the patch. Problem solved !