Fed up with this problem

[Yor Suiris]

So now I do dcpromo again to remove the machine as a DC and when I reboot no
request for CD.
So does this mean my AD is the problem?

 

[Matthew Kitchin]

maybe try running this
sfc /scannow
to check all your system files. That doesn't explain what is causing it, but
it could help.

Right no Virus software YET. Because I have had this problem before and in
the past Virus software was put on before the SP and I wanted to elimate
that as a cause. This current machine (attempt) had a brand new hard drive
put in yesterday. The system was loaded and then the SP. No chance for a
virus to get in yet, unless MS's site is infested. Virus software was the
next thing to be installed when this issue rised its head.
And the files in question are NOT dissappearing they are right where they
should be. It is Windows File Protection that thinks there is a problem.
Looks like Windows does not see them as the proper MS files.

I don't see any antivirus on there? Is there any? It's very possible

that

a
virus is wiping out some system files and they have to be replaced.

-Matthew

Results of Matthew's PsInfo & PsList.

System information for \\DC01:
Uptime: 0 days 0 hours 22 minutes 33 seconds
Kernel version: Microsoft Windows 2000, Uniprocessor Free
Product type: Server (Domain Controller)
Product version: 5.0
Service pack: 4
Kernel build number: 2195
Registered organization: H!T
Registered owner: Yor Suiris
Install date: 5/19/2004, 1:26:27 PM
Activation status: Not applicable
IE version: 5.0100
System root: C:\WINNT
Processors: 1
Processor speed: 350 MHz
Processor type: Intel Pentium II or Celeron
Physical memory: 384 MB
Video driver: ATI Technologies Inc. 3D RAGE PRO PCI
Volume Type Format Label Size Free
FreeA
: Removable 0%C
: Fixed NTFS 34.2 GB 32.3 GB 94%D
: CD-ROM 0%H
: Remote 0%L
: Remote 0%P
: Remote 0%S
: Remote 0%U
: Remote 0%X
: Remote 0%Y
: Remote 0%OS
Hot Fix Installed

KB823182 5/19/2004
KB823559 5/19/2004
KB824105 5/19/2004
KB825119 5/19/2004
KB826232 5/19/2004
KB828035 5/19/2004
KB828741 5/19/2004
KB828749 5/19/2004
KB830352 5/19/2004
KB835732 5/19/2004
KB837001 5/19/2004
Q147222 5/19/2004
Q828026 5/19/2004
ServicePackUninstall 5/19/2004
Applications:
Internet Explorer Q832894
Outlook Express Q837009
WebFldrs 9.00.3501
WinZip
Windows 2000 Administration Tools 5.0.0.0000
Windows 2000 Hotfix - KB823182 20030618.121409
Windows 2000 Hotfix - KB823559 20030627.135515
Windows 2000 Hotfix - KB824105 20030716.151320
Windows 2000 Hotfix - KB825119 20030827.151123
Windows 2000 Hotfix - KB826232 20031007.160553
Windows 2000 Hotfix - KB828035 20031023.142138
Windows 2000 Hotfix - KB828741 20040311.130332
Windows 2000 Hotfix - KB828749 20031023.124056
Windows 2000 Hotfix - KB830352 20031104.120658
Windows 2000 Hotfix - KB835732 20040323.171849
Windows 2000 Hotfix - KB837001
Windows Media Player Hotfix [See Q828026 for more information]


PsList 1.26 - Process Information Lister
Copyright (C) 1999-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

Process information for DC01:

Name Pid Pri Thd Hnd Priv CPU Time Elapsed Time
Idle 0 0 1 0 0 0:18:49.203 0:27:07.645
System 8 8 39 189 24 0:00:56.691 0:27:07.645
SMSS 168 11 6 36 1208 0:01:10.631 0:27:07.645
CSRSS 196 13 11 503 1424 0:00:05.447 0:25:51.786
WINLOGON 220 13 16 428 14336 0:04:53.562 0:25:50.384
SERVICES 248 9 40 639 4448 0:00:05.167 0:25:49.352
LSASS 260 9 41 855 28860 0:00:10.144 0:25:49.342
termsrv 356 10 14 106 1796 0:00:00.190 0:25:48.151
svchost 496 8 10 249 1516 0:00:00.801 0:25:46.168
spoolsv 520 8 11 135 2568 0:00:00.270 0:25:45.497
msdtc 744 8 21 200 1848 0:00:00.240 0:25:12.740
dfssvc 880 8 6 108 1108 0:00:00.190 0:25:09.685
tcpsvcs 900 8 18 271 3988 0:00:00.851 0:25:09.615
svchost 920 8 21 349 3192 0:00:00.921 0:25:09.495
ismserv 940 8 13 335 3396 0:00:00.470 0:25:09.355
LLSSRV 948 9 12 179 2576 0:00:00.741 0:25:07.943
ntfrs 988 8 19 523 5836 0:00:03.935 0:25:07.692
regsvc 1092 8 2 29 268 0:00:00.010 0:25:05.990
LOCATOR 1116 8 3 41 600 0:00:00.050 0:25:04.378
mstask 1128 8 7 121 1080 0:00:00.160 0:25:04.087
WinMgmt 1208 8 4 113 832 0:00:14.240 0:25:02.966
WINS 1228 8 18 289 2692 0:00:00.280 0:25:02.175
svchost 1240 8 6 174 3636 0:00:00.210 0:25:02.084
DNS 1260 8 14 142 1656 0:00:00.260 0:25:01.924
inetinfo 1276 8 27 609 6184 0:00:01.011 0:25:01.784
svchost 1760 8 12 168 1540 0:00:00.150 0:24:33.208
explorer 716 8 14 439 6216 0:00:26.688 0:19:19.647
CMD 1340 8 1 23 296 0:00:00.040 0:11:33.637
TASKMGR 1992 13 3 48 692 0:00:00.220 0:09:24.782
mdm 1944 8 4 90 740 0:00:00.090 0:05:02.725
notepad 2012 8 2 43 752 0:00:00.120 0:04:35.155
notepad 720 8 2 43 748 0:00:00.150 0:01:46.172
pslist 788 13 2 103 736 0:00:00.100 0:00:00.050


If these files are really disappearing, something is removing them. There
has to be something going on on these systems to make this happen. Could
you
run
psinfo -d -s -h
from http://www.sysinternals.com/ntw2k/freeware/psinfo.shtml and
pslist from http://www.sysinternals.com/ntw2k/freeware/pslist.shtml
and post the output?

-Matthew

Retail version of Win2k server that we got with the purchase of the
computer.
And in the System logs it shows about 25 files have been copied

(or
not

if
I
don't supply the CD) by Windows File Protection.
Such as:
c_iscii.dll
busmouse.sys
bhsupp.dll
agt0415.dll
pinball.exe
ksolay.ax
is50.dll
fs2.dll
etc., etc.
What type of media (select, standard, trial, beta, etc) are you using
to
install the OS?

Ok and more.
Just to see if the current one follows the same as the others. I
went
back
to MS to get more of their patches. And NOW during the install

I
get

'Unknown software package" when checking for an MS signature. Again
the
same thing on all machines.
Every machine I have done a dcpromo on goes the same way. It wants
the
CD
on
every boot and then does not find any MS signatures on subsquent
updates.
If
I try to redo SP4 (download and install later) I get a warning about
being
unable to install a non retail copy of the SP.


Yes the full SP (express refers to the installation. Like do it
Now
rather
then download and do it later).

And yes I give it the CD and it spins and files get

replaced.
And

then
on
the next reboot I go through the same thing again and again. One
of
the
machines I just leave the CD in it so it doesn't bother me about
it.
And
it
has been doing this for over a year now. I want it to stop!


It always wants CD.
I now have three machines (all DCs) that want the Windows
CD everytime they boot.
The recent one I just built today. I installed the Win2k O/S
then did a dcpromo and then install SP 4 express. And

now

it to
pick

 

[George Hester]

Yeah that's what it is looking like. All I can figure at this point is your System File Protection is firing up. Repeatedly. Do you see any messages at boot like System File Protection?

This article may help:

http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/featusability/systeman.mspx

 

[Yor Suiris]

Any one still following?

Well we seemed OK after the reverse dcpromo. So I figured my problem is with
AD & Dcpromo and I might as well load the rest of the software. So I start
the virus install (same copy I have installed many many times) and what pops
up "Digtial Signature Not Found". Never saw that in any of the other
installs done with the same "read only" copy of the software (note on the
other DCs Virus/all software was installed before Dcpromo was done). Oh and
I ran McAfee's Stinger just before this to be sure I wasn't installing the
virus software over top of a virus.

So I go to MS to get more patches and what do you know, "Digtial Signature
Not Found". !!!!!!

And as stated already, This is not just one random machine, it is every DC I
try to create. These machines can no longer recognize a file's authority,
hence windows file protection wanting to replace everything all the time.

I would pull my hair out if I had any left.
So anyone still with me? Any more ideas.

 

[Yor Suiris]

Boot up looks a normal as any Win2K. I will check the link and see.
Thanks.

Yeah that's what it is looking like. All I can figure at this point is your
System File Protection is firing up. Repeatedly. Do you see any messages
at boot like System File Protection?

This article may help:

http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/featusability/systeman.mspx

 

[Hans-Jochen Trost]

Yor,

Thanks for the links Hans. But my problem is with creating a DC not removing
it.

[snip]

yes, I noticed that removal was at the top of the texts. However, it
looked like drilling down from those links would yield information
also about creating DCs.

Cheers, Jochen
hjtrost at microfab dot com


Nil nimium studeo, Caesar, tibi velle placere,
nec scire ut an sis albus an ater homo.
Catullus

 

[Aimme Lirette MSFT]

This concerns me:
Activation status: Not applicable

I ran this util on my machines and all of them say the activation status is
activated, or not activated- Not applicable as far as I can tell seems to
mean you could be running a not for resale, or demo version of the operating
system.

What is the media you are using to install from again?

Aimme

 

[Matthew Kitchin]

I don't believe that is an issue. I get that on my machine that was built
with 2000 server select media (see below).

C:\WINDOWS>c:\script\Psinfo.exe \\padme -d -s -h

PsInfo v1.5 - Local and remote system information viewer
Copyright (C) 2001-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

System information for \\padme:
Uptime: 32 days 1 hour 23 minutes 10 seconds
Kernel version: Microsoft Windows 2000, Uniprocessor Free
Product type: Server (Domain Controller)
Product version: 5.0
Service pack: 4
Kernel build number: 2195
Registered organization: nna
Registered owner: nna
Install date: 4/23/2001, 3:39:42 PM
Activation status: Not applicable
IE version: 6.0000
System root: C:\WINNT
Processors: 1
Processor speed: 930 MHz
Processor type: Intel Pentium III
Physical memory: 512 MB
Video driver: ATI Technologies Inc. Rage IIC PCI
Volume Type Format Label Size Free
FreeA

: Removable 0%C
: Fixed NTFS OS 7.8 GB 5.2 GB 66%D
: Fixed NTFS AD and other 43.0 GB 42.8 GB 99%Z
: CD-ROM 0%OS
Hot
Fix Installed

KB329115 2/14/2004
KB823182 10/20/2003
KB823559 8/24/2003
KB823980 8/24/2003
KB824105 9/22/2003
KB824141 10/20/2003
KB824146 9/22/2003
KB825119 10/20/2003
KB826232 10/20/2003
KB828028 3/6/2004
KB828035 10/20/2003
KB828741 4/18/2004
KB828749 2/14/2004
KB835732 4/18/2004
KB837001 4/18/2004
Q147222 5/5/2001
Q295688 6/14/2002
Q828026 4/18/2004
ServicePackUninstall 9/12/2002
Applications:
CI/O Management Software 4.01
Dell OpenManage Array Manager
HP OpenView OmniBack II 4.1 04.10.0176
Intel(R) PRO Ethernet Adapter and Software
McAfee VirusScan Enterprise 7.1.0
Microsoft Active Directory Connector
Server Administrator
WebFldrs 9.00.3501
WinZip
Windows 2000 Administration Tools 5.0.0.0000
Windows 2000 Application Compatibility Update
Windows 2000 Hotfix - KB329115 20031024.155236
Windows 2000 Hotfix - KB823182 20030618.121409
Windows 2000 Hotfix - KB823559 20030627.135515
Windows 2000 Hotfix - KB823980 20030705.101654
Windows 2000 Hotfix - KB824105 20030716.151320
Windows 2000 Hotfix - KB824141 20030805.151423
Windows 2000 Hotfix - KB824146 20030823.144456
Windows 2000 Hotfix - KB825119 20030827.151123
Windows 2000 Hotfix - KB826232 20031007.160553
Windows 2000 Hotfix - KB828028 20040122.114409
Windows 2000 Hotfix - KB828035 20031002.141358
Windows 2000 Hotfix - KB828741 20040311.130332
Windows 2000 Hotfix - KB828749 20031023.124056
Windows 2000 Hotfix - KB835732 20040323.171849
Windows 2000 Hotfix - KB837001
Windows 2000 Service Pack 4
Windows Media Player Hotfix [See Q828026 for more information]

 

[Matthew Kitchin]

Sounds really stupid, but upgrade to IE 6.1 with 128 bit encryption. You are
running the original IE that came with 2000. I know it sounds dome, but IE
components have been known to be pretty important in the past.

I assume that version of IE has a lower encryption level. I'm just trying to
find things that are different between your install and mine. Give it a
shot, it can't hurt.

Right no Virus software YET. Because I have had this problem before and in
the past Virus software was put on before the SP and I wanted to elimate
that as a cause. This current machine (attempt) had a brand new hard drive
put in yesterday. The system was loaded and then the SP. No chance for a
virus to get in yet, unless MS's site is infested. Virus software was the
next thing to be installed when this issue rised its head.
And the files in question are NOT dissappearing they are right where they
should be. It is Windows File Protection that thinks there is a problem.
Looks like Windows does not see them as the proper MS files.

I don't see any antivirus on there? Is there any? It's very possible

that

a
virus is wiping out some system files and they have to be replaced.

-Matthew

Results of Matthew's PsInfo & PsList.

System information for \\DC01:
Uptime: 0 days 0 hours 22 minutes 33 seconds
Kernel version: Microsoft Windows 2000, Uniprocessor Free
Product type: Server (Domain Controller)
Product version: 5.0
Service pack: 4
Kernel build number: 2195
Registered organization: H!T
Registered owner: Yor Suiris
Install date: 5/19/2004, 1:26:27 PM
Activation status: Not applicable
IE version: 5.0100
System root: C:\WINNT
Processors: 1
Processor speed: 350 MHz
Processor type: Intel Pentium II or Celeron
Physical memory: 384 MB
Video driver: ATI Technologies Inc. 3D RAGE PRO PCI
Volume Type Format Label Size Free
FreeA
: Removable 0%C
: Fixed NTFS 34.2 GB 32.3 GB 94%D
: CD-ROM 0%H
: Remote 0%L
: Remote 0%P
: Remote 0%S
: Remote 0%U
: Remote 0%X
: Remote 0%Y
: Remote 0%OS
Hot Fix Installed

KB823182 5/19/2004
KB823559 5/19/2004
KB824105 5/19/2004
KB825119 5/19/2004
KB826232 5/19/2004
KB828035 5/19/2004
KB828741 5/19/2004
KB828749 5/19/2004
KB830352 5/19/2004
KB835732 5/19/2004
KB837001 5/19/2004
Q147222 5/19/2004
Q828026 5/19/2004
ServicePackUninstall 5/19/2004
Applications:
Internet Explorer Q832894
Outlook Express Q837009
WebFldrs 9.00.3501
WinZip
Windows 2000 Administration Tools 5.0.0.0000
Windows 2000 Hotfix - KB823182 20030618.121409
Windows 2000 Hotfix - KB823559 20030627.135515
Windows 2000 Hotfix - KB824105 20030716.151320
Windows 2000 Hotfix - KB825119 20030827.151123
Windows 2000 Hotfix - KB826232 20031007.160553
Windows 2000 Hotfix - KB828035 20031023.142138
Windows 2000 Hotfix - KB828741 20040311.130332
Windows 2000 Hotfix - KB828749 20031023.124056
Windows 2000 Hotfix - KB830352 20031104.120658
Windows 2000 Hotfix - KB835732 20040323.171849
Windows 2000 Hotfix - KB837001
Windows Media Player Hotfix [See Q828026 for more information]


PsList 1.26 - Process Information Lister
Copyright (C) 1999-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

Process information for DC01:

Name Pid Pri Thd Hnd Priv CPU Time Elapsed Time
Idle 0 0 1 0 0 0:18:49.203 0:27:07.645
System 8 8 39 189 24 0:00:56.691 0:27:07.645
SMSS 168 11 6 36 1208 0:01:10.631 0:27:07.645
CSRSS 196 13 11 503 1424 0:00:05.447 0:25:51.786
WINLOGON 220 13 16 428 14336 0:04:53.562 0:25:50.384
SERVICES 248 9 40 639 4448 0:00:05.167 0:25:49.352
LSASS 260 9 41 855 28860 0:00:10.144 0:25:49.342
termsrv 356 10 14 106 1796 0:00:00.190 0:25:48.151
svchost 496 8 10 249 1516 0:00:00.801 0:25:46.168
spoolsv 520 8 11 135 2568 0:00:00.270 0:25:45.497
msdtc 744 8 21 200 1848 0:00:00.240 0:25:12.740
dfssvc 880 8 6 108 1108 0:00:00.190 0:25:09.685
tcpsvcs 900 8 18 271 3988 0:00:00.851 0:25:09.615
svchost 920 8 21 349 3192 0:00:00.921 0:25:09.495
ismserv 940 8 13 335 3396 0:00:00.470 0:25:09.355
LLSSRV 948 9 12 179 2576 0:00:00.741 0:25:07.943
ntfrs 988 8 19 523 5836 0:00:03.935 0:25:07.692
regsvc 1092 8 2 29 268 0:00:00.010 0:25:05.990
LOCATOR 1116 8 3 41 600 0:00:00.050 0:25:04.378
mstask 1128 8 7 121 1080 0:00:00.160 0:25:04.087
WinMgmt 1208 8 4 113 832 0:00:14.240 0:25:02.966
WINS 1228 8 18 289 2692 0:00:00.280 0:25:02.175
svchost 1240 8 6 174 3636 0:00:00.210 0:25:02.084
DNS 1260 8 14 142 1656 0:00:00.260 0:25:01.924
inetinfo 1276 8 27 609 6184 0:00:01.011 0:25:01.784
svchost 1760 8 12 168 1540 0:00:00.150 0:24:33.208
explorer 716 8 14 439 6216 0:00:26.688 0:19:19.647
CMD 1340 8 1 23 296 0:00:00.040 0:11:33.637
TASKMGR 1992 13 3 48 692 0:00:00.220 0:09:24.782
mdm 1944 8 4 90 740 0:00:00.090 0:05:02.725
notepad 2012 8 2 43 752 0:00:00.120 0:04:35.155
notepad 720 8 2 43 748 0:00:00.150 0:01:46.172
pslist 788 13 2 103 736 0:00:00.100 0:00:00.050


If these files are really disappearing, something is removing them. There
has to be something going on on these systems to make this happen. Could
you
run
psinfo -d -s -h
from http://www.sysinternals.com/ntw2k/freeware/psinfo.shtml and
pslist from http://www.sysinternals.com/ntw2k/freeware/pslist.shtml
and post the output?

-Matthew

Retail version of Win2k server that we got with the purchase of the
computer.
And in the System logs it shows about 25 files have been copied

(or
not

if
I
don't supply the CD) by Windows File Protection.
Such as:
c_iscii.dll
busmouse.sys
bhsupp.dll
agt0415.dll
pinball.exe
ksolay.ax
is50.dll
fs2.dll
etc., etc.
What type of media (select, standard, trial, beta, etc) are you using
to
install the OS?

Ok and more.
Just to see if the current one follows the same as the others. I
went
back
to MS to get more of their patches. And NOW during the install

I
get

'Unknown software package" when checking for an MS signature. Again
the
same thing on all machines.
Every machine I have done a dcpromo on goes the same way. It wants
the
CD
on
every boot and then does not find any MS signatures on subsquent
updates.
If
I try to redo SP4 (download and install later) I get a warning about
being
unable to install a non retail copy of the SP.


Yes the full SP (express refers to the installation. Like do it
Now
rather
then download and do it later).

And yes I give it the CD and it spins and files get

replaced.
And

then
on
the next reboot I go through the same thing again and again. One
of
the
machines I just leave the CD in it so it doesn't bother me about
it.
And
it
has been doing this for over a year now. I want it to stop!


It always wants CD.
I now have three machines (all DCs) that want the Windows
CD everytime they boot.
The recent one I just built today. I installed the Win2k O/S
then did a dcpromo and then install SP 4 express. And

now

it to
pick

 

[Yor Suiris]

OK some progress. I installed IE6 (with 128 bit encription) and booted a few
times. Now I no longer get requested for the CD. This is good. I will still
have to try Dcpromo.
However I still get "Digital Signature Not Found" when going for updates at
MS or installing our Virus software.
I may have to format and go for a fresh start to be sure though, I have put
this machine through a lot of changes in the last couple of days.

I don't believe that is an issue. I get that on my machine that was built
with 2000 server select media (see below).

C:\WINDOWS>c:\script\Psinfo.exe \\padme -d -s -h

PsInfo v1.5 - Local and remote system information viewer
Copyright (C) 2001-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

System information for \\padme:
Uptime: 32 days 1 hour 23 minutes 10 seconds
Kernel version: Microsoft Windows 2000, Uniprocessor Free
Product type: Server (Domain Controller)
Product version: 5.0
Service pack: 4
Kernel build number: 2195
Registered organization: nna
Registered owner: nna
Install date: 4/23/2001, 3:39:42 PM
Activation status: Not applicable
IE version: 6.0000
System root: C:\WINNT
Processors: 1
Processor speed: 930 MHz
Processor type: Intel Pentium III
Physical memory: 512 MB
Video driver: ATI Technologies Inc. Rage IIC PCI
Volume Type Format Label Size Free
FreeA

: Removable 0%C
: Fixed NTFS OS 7.8 GB 5.2 GB 66%D
: Fixed NTFS AD and other 43.0 GB 42.8 GB 99%Z
: CD-ROM 0%OS
Hot
Fix Installed

KB329115 2/14/2004
KB823182 10/20/2003
KB823559 8/24/2003
KB823980 8/24/2003
KB824105 9/22/2003
KB824141 10/20/2003
KB824146 9/22/2003
KB825119 10/20/2003
KB826232 10/20/2003
KB828028 3/6/2004
KB828035 10/20/2003
KB828741 4/18/2004
KB828749 2/14/2004
KB835732 4/18/2004
KB837001 4/18/2004
Q147222 5/5/2001
Q295688 6/14/2002
Q828026 4/18/2004
ServicePackUninstall 9/12/2002
Applications:
CI/O Management Software 4.01
Dell OpenManage Array Manager
HP OpenView OmniBack II 4.1 04.10.0176
Intel(R) PRO Ethernet Adapter and Software
McAfee VirusScan Enterprise 7.1.0
Microsoft Active Directory Connector
Server Administrator
WebFldrs 9.00.3501
WinZip
Windows 2000 Administration Tools 5.0.0.0000
Windows 2000 Application Compatibility Update
Windows 2000 Hotfix - KB329115 20031024.155236
Windows 2000 Hotfix - KB823182 20030618.121409
Windows 2000 Hotfix - KB823559 20030627.135515
Windows 2000 Hotfix - KB823980 20030705.101654
Windows 2000 Hotfix - KB824105 20030716.151320
Windows 2000 Hotfix - KB824141 20030805.151423
Windows 2000 Hotfix - KB824146 20030823.144456
Windows 2000 Hotfix - KB825119 20030827.151123
Windows 2000 Hotfix - KB826232 20031007.160553
Windows 2000 Hotfix - KB828028 20040122.114409
Windows 2000 Hotfix - KB828035 20031002.141358
Windows 2000 Hotfix - KB828741 20040311.130332
Windows 2000 Hotfix - KB828749 20031023.124056
Windows 2000 Hotfix - KB835732 20040323.171849
Windows 2000 Hotfix - KB837001
Windows 2000 Service Pack 4
Windows Media Player Hotfix [See Q828026 for more information]

This concerns me:
Activation status: Not applicable

I ran this util on my machines and all of them say the activation status is
activated, or not activated- Not applicable as far as I can tell seems to
mean you could be running a not for resale, or demo version of the operating
system.

What is the media you are using to install from again?

Aimme

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Could
you not using wants
the it
Now One
of about
it.

 

[Ricardo M. Urbano - W2K/NT4 MVP]

Sounds really stupid, but upgrade to IE 6.1 with 128 bit encryption. You are
running the original IE that came with 2000. I know it sounds dome, but IE
components have been known to be pretty important in the past.

I assume that version of IE has a lower encryption level. I'm just trying to
find things that are different between your install and mine. Give it a
shot, it can't hurt.

Right no Virus software YET. Because I have had this problem before and in
the past Virus software was put on before the SP and I wanted to elimate
that as a cause. This current machine (attempt) had a brand new hard drive
put in yesterday. The system was loaded and then the SP. No chance for a
virus to get in yet, unless MS's site is infested. Virus software was the
next thing to be installed when this issue rised its head.
And the files in question are NOT dissappearing they are right where they
should be. It is Windows File Protection that thinks there is a problem.
Looks like Windows does not see them as the proper MS files.

I don't see any antivirus on there? Is there any? It's very possible

that

a
virus is wiping out some system files and they have to be replaced.

-Matthew

Results of Matthew's PsInfo & PsList.

System information for \\DC01:
Uptime: 0 days 0 hours 22 minutes 33 seconds
Kernel version: Microsoft Windows 2000, Uniprocessor Free
Product type: Server (Domain Controller)
Product version: 5.0
Service pack: 4
Kernel build number: 2195
Registered organization: H!T
Registered owner: Yor Suiris
Install date: 5/19/2004, 1:26:27 PM
Activation status: Not applicable
IE version: 5.0100
System root: C:\WINNT
Processors: 1
Processor speed: 350 MHz
Processor type: Intel Pentium II or Celeron
Physical memory: 384 MB
Video driver: ATI Technologies Inc. 3D RAGE PRO PCI
Volume Type Format Label Size Free
FreeA
: Removable 0%C
: Fixed NTFS 34.2 GB 32.3 GB 94%D
: CD-ROM 0%H
: Remote 0%L
: Remote 0%P
: Remote 0%S
: Remote 0%U
: Remote 0%X
: Remote 0%Y
: Remote
0%OS
Hot Fix Installed

KB823182 5/19/2004
KB823559 5/19/2004
KB824105 5/19/2004
KB825119 5/19/2004
KB826232 5/19/2004
KB828035 5/19/2004
KB828741 5/19/2004
KB828749 5/19/2004
KB830352 5/19/2004
KB835732 5/19/2004
KB837001 5/19/2004
Q147222 5/19/2004
Q828026 5/19/2004
ServicePackUninstall 5/19/2004
Applications:
Internet Explorer Q832894
Outlook Express Q837009
WebFldrs 9.00.3501
WinZip
Windows 2000 Administration Tools 5.0.0.0000
Windows 2000 Hotfix - KB823182 20030618.121409
Windows 2000 Hotfix - KB823559 20030627.135515
Windows 2000 Hotfix - KB824105 20030716.151320
Windows 2000 Hotfix - KB825119 20030827.151123
Windows 2000 Hotfix - KB826232 20031007.160553
Windows 2000 Hotfix - KB828035 20031023.142138
Windows 2000 Hotfix - KB828741 20040311.130332
Windows 2000 Hotfix - KB828749 20031023.124056
Windows 2000 Hotfix - KB830352 20031104.120658
Windows 2000 Hotfix - KB835732 20040323.171849
Windows 2000 Hotfix - KB837001
Windows Media Player Hotfix [See Q828026 for more information]


PsList 1.26 - Process Information Lister
Copyright (C) 1999-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

Process information for DC01:

Name Pid Pri Thd Hnd Priv CPU Time Elapsed
Time
Idle 0 0 1 0 0 0:18:49.203
0:27:07.645
System 8 8 39 189 24 0:00:56.691
0:27:07.645
SMSS 168 11 6 36 1208 0:01:10.631
0:27:07.645
CSRSS 196 13 11 503 1424 0:00:05.447
0:25:51.786
WINLOGON 220 13 16 428 14336 0:04:53.562
0:25:50.384
SERVICES 248 9 40 639 4448 0:00:05.167
0:25:49.352
LSASS 260 9 41 855 28860 0:00:10.144
0:25:49.342
termsrv 356 10 14 106 1796 0:00:00.190
0:25:48.151
svchost 496 8 10 249 1516 0:00:00.801
0:25:46.168
spoolsv 520 8 11 135 2568 0:00:00.270
0:25:45.497
msdtc 744 8 21 200 1848 0:00:00.240
0:25:12.740
dfssvc 880 8 6 108 1108 0:00:00.190
0:25:09.685
tcpsvcs 900 8 18 271 3988 0:00:00.851
0:25:09.615
svchost 920 8 21 349 3192 0:00:00.921
0:25:09.495
ismserv 940 8 13 335 3396 0:00:00.470
0:25:09.355
LLSSRV 948 9 12 179 2576 0:00:00.741
0:25:07.943
ntfrs 988 8 19 523 5836 0:00:03.935
0:25:07.692
regsvc 1092 8 2 29 268 0:00:00.010
0:25:05.990
LOCATOR 1116 8 3 41 600 0:00:00.050
0:25:04.378
mstask 1128 8 7 121 1080 0:00:00.160
0:25:04.087
WinMgmt 1208 8 4 113 832 0:00:14.240
0:25:02.966
WINS 1228 8 18 289 2692 0:00:00.280
0:25:02.175
svchost 1240 8 6 174 3636 0:00:00.210
0:25:02.084
DNS 1260 8 14 142 1656 0:00:00.260
0:25:01.924
inetinfo 1276 8 27 609 6184 0:00:01.011
0:25:01.784
svchost 1760 8 12 168 1540 0:00:00.150
0:24:33.208
explorer 716 8 14 439 6216 0:00:26.688
0:19:19.647
CMD 1340 8 1 23 296 0:00:00.040
0:11:33.637
TASKMGR 1992 13 3 48 692 0:00:00.220
0:09:24.782
mdm 1944 8 4 90 740 0:00:00.090
0:05:02.725
notepad 2012 8 2 43 752 0:00:00.120
0:04:35.155
notepad 720 8 2 43 748 0:00:00.150
0:01:46.172
pslist 788 13 2 103 736 0:00:00.100
0:00:00.050


If these files are really disappearing, something is removing them.
There
has to be something going on on these systems to make this happen. Could
you
run
psinfo -d -s -h
from http://www.sysinternals.com/ntw2k/freeware/psinfo.shtml and
pslist from http://www.sysinternals.com/ntw2k/freeware/pslist.shtml
and post the output?

-Matthew

Retail version of Win2k server that we got with the purchase of the
computer.
And in the System logs it shows about 25 files have been copied (or
not
if
I
don't supply the CD) by Windows File Protection.
Such as:
c_iscii.dll
busmouse.sys
bhsupp.dll
agt0415.dll
pinball.exe
ksolay.ax
is50.dll
fs2.dll
etc., etc.
What type of media (select, standard, trial, beta, etc) are you
using
to
install the OS?

Ok and more.
Just to see if the current one follows the same as the others. I
went
back
to MS to get more of their patches. And NOW during the install I
get
'Unknown software package" when checking for an MS signature.
Again
the
same thing on all machines.
Every machine I have done a dcpromo on goes the same way. It wants
the
CD
on
every boot and then does not find any MS signatures on subsquent
updates.
If
I try to redo SP4 (download and install later) I get a warning
about
being
unable to install a non retail copy of the SP.


Yes the full SP (express refers to the installation. Like do it
Now
rather
then download and do it later).

And yes I give it the CD and it spins and files get replaced.
And
then
on
the next reboot I go through the same thing again and again. One
of
the
machines I just leave the CD in it so it doesn't bother me about
it.
And
it
has been doing this for over a year now. I want it to stop!


It always wants CD.
I now have three machines (all DCs) that want the Windows
CD everytime they boot.
The recent one I just built today. I installed the Win2k O/S
then did a dcpromo and then install SP 4 express. And

now

it
wants the CD all the Time. Nothing else has been done or
added. No Virus software yet. No other programs. Nothing but
Win2k, SP4 and run Dcpromo

The other two are the same, Win2k, SP4 and then Dcpromo and
there after they want the CD (and I have posted here for
each machine before with no answer). All I find on MS is to
apply the latest SP, well that appears to be when the
trouble begins.
This is not acceptable and it must be a MS thing as this has
happened with every machine I do a Dcpromo on with sp4.

What gives?
How do I stop it?
Where do I complain?
Where do I get my money back?

Service Pack 4 Express ??
Isn't that just an installer, that checks what you need, to
pick
exactly what your PC need from the Internet.
For your reference: the complete Service Pack 4 is 129 MB
large.

Does it do something with the CD if you give it one?
And after it is done with the CD, after a next boot it ask for
the CD again??

FYI, in the NTx world, IE gets its encryption from the OS, not IE
itself. And, unless I'm mistaken, I'm pretty sure that starting w/ at
least SP3 for W2K, all SP releases for NTx have been 128 bit. So, out
of the box, the OS is 5 bit, but after installing SP3 or higher, it will
be at 128 bit. Before SP3, there was a separate and very small 128 bit
patch for the OS and/or you could download SP1 in both 56 and 128 bit
flavors.

 

[Bruce D. Meyer]

I also get a 'not applicable' on advanced server DC.
For fun, go to www.antivirus.com, and do a 'free housecall' antivirus scan.
Microsoft had me do this as they felt a problem I had might be caused my my
antivirus software being infected. They told me to run the online virus scan
twice to be certain.

A rule of thumb I always follow is to first, pull the wire from the machine
(CAT5) install everything you can, Service packs from CD (The February
Security Update CD has a bunch of hotfixes SP4 etc for W2k, and even
security stuff and SP1 for XP) or just downlaod and burn to CD. Lock the
machine down with the Secuirty Advisor, or Shavlik, and when there is
nothing else you can do offline, go online and do a windows update.
(Remember you can download anything via the Download Basket from windows
update by hand, burn to CD, and install on your virgin machine offline.
Install antivirus software, update the definition files, scan for fun one
time. NOW go online, and when the machine is as up to date as you want it to
be, run dcpromo.
If you need to install software and feel your AV software is interfering
with a succsesful install, just unload or disable the AV software for the
duration of the install. Then, immediately, turn it back on after the
install is succesful. I have seen script kiddies pounding on a new Web
server 5 minutes after I placed it live on a public IP address, so don't
ever think that you'll be safe 'just long enough to download a service
pack.' if your ip block is known to be easy to crack, the kiddies will be
just waiting for your machines to come on line and get in before you can
secure them. If you have ONE MACHINE that has been compromised, every
machine on your network should be suspect. If you have administrator access
for an account, and check email with that account that has administrator
access, if they can fire up a sniffer on that subnet, your email username
and password are sent in plaintext, and once they see the first check for
email on your domain admin account, they can now login to that machine and
any other machine that you have access to.

Bruce D. Meyer, CCNA, MCSE

OK some progress. I installed IE6 (with 128 bit encription) and booted a few
times. Now I no longer get requested for the CD. This is good. I will still
have to try Dcpromo.
However I still get "Digital Signature Not Found" when going for updates at
MS or installing our Virus software.
I may have to format and go for a fresh start to be sure though, I have put
this machine through a lot of changes in the last couple of days.

I don't believe that is an issue. I get that on my machine that was built
with 2000 server select media (see below).

C:\WINDOWS>c:\script\Psinfo.exe \\padme -d -s -h

PsInfo v1.5 - Local and remote system information viewer
Copyright (C) 2001-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

System information for \\padme:
Uptime: 32 days 1 hour 23 minutes 10 seconds
Kernel version: Microsoft Windows 2000, Uniprocessor Free
Product type: Server (Domain Controller)
Product version: 5.0
Service pack: 4
Kernel build number: 2195
Registered organization: nna
Registered owner: nna
Install date: 4/23/2001, 3:39:42 PM
Activation status: Not applicable
IE version: 6.0000
System root: C:\WINNT
Processors: 1
Processor speed: 930 MHz
Processor type: Intel Pentium III
Physical memory: 512 MB
Video driver: ATI Technologies Inc. Rage IIC PCI
Volume Type Format Label Size Free
FreeA

: Removable 0%C
: Fixed NTFS OS 7.8 GB 5.2 GB 66%D
: Fixed NTFS AD and other 43.0 GB 42.8 GB 99%Z
: CD-ROM 0%OS
Hot
Fix Installed

KB329115 2/14/2004
KB823182 10/20/2003
KB823559 8/24/2003
KB823980 8/24/2003
KB824105 9/22/2003
KB824141 10/20/2003
KB824146 9/22/2003
KB825119 10/20/2003
KB826232 10/20/2003
KB828028 3/6/2004
KB828035 10/20/2003
KB828741 4/18/2004
KB828749 2/14/2004
KB835732 4/18/2004
KB837001 4/18/2004
Q147222 5/5/2001
Q295688 6/14/2002
Q828026 4/18/2004
ServicePackUninstall 9/12/2002
Applications:
CI/O Management Software 4.01
Dell OpenManage Array Manager
HP OpenView OmniBack II 4.1 04.10.0176
Intel(R) PRO Ethernet Adapter and Software
McAfee VirusScan Enterprise 7.1.0
Microsoft Active Directory Connector
Server Administrator
WebFldrs 9.00.3501
WinZip
Windows 2000 Administration Tools 5.0.0.0000
Windows 2000 Application Compatibility Update
Windows 2000 Hotfix - KB329115 20031024.155236
Windows 2000 Hotfix - KB823182 20030618.121409
Windows 2000 Hotfix - KB823559 20030627.135515
Windows 2000 Hotfix - KB823980 20030705.101654
Windows 2000 Hotfix - KB824105 20030716.151320
Windows 2000 Hotfix - KB824141 20030805.151423
Windows 2000 Hotfix - KB824146 20030823.144456
Windows 2000 Hotfix - KB825119 20030827.151123
Windows 2000 Hotfix - KB826232 20031007.160553
Windows 2000 Hotfix - KB828028 20040122.114409
Windows 2000 Hotfix - KB828035 20031002.141358
Windows 2000 Hotfix - KB828741 20040311.130332
Windows 2000 Hotfix - KB828749 20031023.124056
Windows 2000 Hotfix - KB835732 20040323.171849
Windows 2000 Hotfix - KB837001
Windows 2000 Service Pack 4
Windows Media Player Hotfix [See Q828026 for more information]

This concerns me:
Activation status: Not applicable

I ran this util on my machines and all of them say the activation

status
is

activated, or not activated- Not applicable as far as I can tell seems to
mean you could be running a not for resale, or demo version of the operating
system.

What is the media you are using to install from again?

Aimme

--
This posting is provided "AS IS" with no warranties, and confers no rights.
If these files are really disappearing, something is removing them. There
has to be something going on on these systems to make this happen. Could
you
run
psinfo -d -s -h
from http://www.sysinternals.com/ntw2k/freeware/psinfo.shtml and
pslist from http://www.sysinternals.com/ntw2k/freeware/pslist.shtml
and post the output?

-Matthew

Retail version of Win2k server that we got with the purchase of the
computer.
And in the System logs it shows about 25 files have been copied

(or
not

if
I
don't supply the CD) by Windows File Protection.
Such as:
c_iscii.dll
busmouse.sys
bhsupp.dll
agt0415.dll
pinball.exe
ksolay.ax
is50.dll
fs2.dll
etc., etc.
What type of media (select, standard, trial, beta, etc) are you using
to
install the OS?

Ok and more.
Just to see if the current one follows the same as the others. I
went
back
to MS to get more of their patches. And NOW during the install

I
get

'Unknown software package" when checking for an MS signature. Again
the
same thing on all machines.
Every machine I have done a dcpromo on goes the same way. It wants
the
CD
on
every boot and then does not find any MS signatures on subsquent
updates.
If
I try to redo SP4 (download and install later) I get a warning about
being
unable to install a non retail copy of the SP.


Yes the full SP (express refers to the installation. Like do it
Now
rather
then download and do it later).

And yes I give it the CD and it spins and files get

replaced.
And

then
on
the next reboot I go through the same thing again and again. One
of
the
machines I just leave the CD in it so it doesn't bother me about
it.
And
it
has been doing this for over a year now. I want it to stop!


It always wants CD.
I now have three machines (all DCs) that want the Windows
CD everytime they boot.
The recent one I just built today. I installed the Win2k O/S
then did a dcpromo and then install SP 4 express. And

now

it to
pick

 

[Bruce D. Meyer]

Just a word about windows 2000 service packs. They are cumulative. You don't
need to run one service pack, and then another. I am sure you knew that,
just making sure. Try a fresh install, NOT on the network. Just LEAVE the
wire out of the wall for now. Got to SP4. Download everything after SP4
using the Download basket on a different machine and burn the updates to a
CD. Install everything. Let it reboot a bunch of times as you mentioned
after a few reboots the problem comes back. Now, install your AV software
and update the DEF files the same way off of a CD. (Most AV companies
provide the def files in a separately downloadable file with an updater.
Once your AV software is up to date, IF you have IIS installed, disable it
or better yet, run the Security Advisor to lock it down. Plug the wire back
into the wall. DON'T run dcpromo yet. If you have a time period where you
can say, 'it has ALWAYS begun having the problem after 8 hours, then let it
run for 12. If still no problems, do a DCPROMO. If the problem comes back
after dcpromo is run, my guess is, you have bad media. See if you can get MS
to provide you with another CD. Try the install from a new CD. The things I
am wondering about is, either you have a compromised machines that is
messing up any machine you install across the network, which is why I say
leave it off the wire until 100% up to date and patched, and to disable IIS
which is super unsecure in a Windows 2000 out of the box install) Or your
have corrupted media. One though also, if you are installing IIS. (which If
I recall is the default) tell it to NOT install IIS during the setup of the
install) If you find the problems go away after following the steps in this
email, disable one at a time each machines antivirus software, to
www.antivirus.com and run the free online house call. (Antivirus scan)
twice. Scan ALL drives, including any floppies, zip disks or CD's that may
be used during the install or later. remember if a machine is infected, many
viruses will attempt to disable antivirus software or prevent a machine from
going to a security, spyware removal and antivirus vendor web site. So if
you can't get to www.antivirus.com, and Symantec or mcaffee, or CA etc, it's
a good guess that that machine is infected.

Hope something here helps.

Bruce D. Meyer, CCNA, MCSE
www.kg4tac.net

 

[Yor Suiris]

Update:
Same machine as before. I redid everything, O/S, SPs and IE6 this time, then
did Dcpromo and created a new domain.A few reboots later and we are showing
no Problems. Hot Damn!
Now I will try IE6 on one of the sick DCs and we will see what happens. If
that clears the problem then I will try to make the new machine a DC on our
production domain.
But as of now it would appear to be an issue with IE6 vs IE5.5.
Thanks to all for the help.

 

[Matthew Kitchin]

Cool!
Id didn't really think that would fix it, I was just trying to find things
different between your servers and mine. I always update IE as one of the
first things when I build a machine. It's primarily because we have a custom
IE build that has the proxy server and things like tat built in.

keep us updated.

-Matthew

 

[Yor Suiris]

Well all is not quite right yet. The latest test machine, created with it's
own AD and not joined to the exsiting AD, after a day or so of seeming OK,
is now not finding digital signatures when going to MS for updates.
At least I am not being asked for the CD.
I am going to format and do it again this time doing IE6 and all the updates
then make it a DC in our Current AD. Cross your fingers.

As a note I have avoided IE6 as when I first put in on a few machines it
slooowed them down. I guess I will have to revisit that issue.

 

[Yor Suiris]

OK, I have reformated, installed the O/S, did SP4, while offline. Then did
IE6, had to connect to internet for that to run. (Why? I downloaded what I
thought was IE6 but it still wanted the internet.???) Then did the Virus
software and it's updates. And I have just finished the other MS critical
updates for the O/S. So far no problems.
So I am now ready to do Dcpromo and join my Domain.
But as it is quitting time here, you'll all have to wait till the morning.
;-)
....yoR

 

[Yor Suiris]

Not good.
Got in early and joined the machine to the domain, (had not done Dcpromo
yet), rebooted and got asked for the CD. Crap!
So a problem with my AD?
Any Ideas, Please this is driving me nuts.

 

[Yor Suiris]

Anyone still with me?
OK so remove it from the domain and boot a few times and no request for CD.
So a problem with my AD.
To summarize:
When I join a Win2K server (only kind I have tried) to my AD I get problems.
They always want the CD on reboot. Do not find Digtial signatures on updates
from MS or anyone else it seems. On my two current DCs (with IE5) I can not
upgrade IE (which I think I need to do to verify the rest of this). I always
get a warning about a pervious install having a boot pending.
On one of the DCs (with Exchange 2000 and mail seems fine, coming and
going), I can not ping anything outside of /or our firewall. I can not find
any web sites when using IE from the Console but have no problem when
connected through Terminal services. Nslookup appears fine I can resolve
names OK and connect to other DNS servers.
On the other DC my logon scripts do not run (i.e. Drive mapping). And the
Sysvol share keeps disappearing, with a log error about replication problems
with the other DC. (Although the other DC shows replication as running fine,
"x changes in the last 60 minutes" etc.,)
No other relavent log entries.
I have done all the Virus scanning I can, used as many different ones as I
could get my hands on. I have verified as many of the running services as I
can track down.
Netdiag shows nothing unusal. Netdom also. Netstat and all the other
utilities I tried show nothing relavent, other then the ping from DC 1.

I am at a loss, I guess I should plan how I am going to build and migrate to
a new AD. Bummer, that will take days and things will get lost. The users
and the Boss.......well you can guess.

So PLEASE any ideas out there?

 

[Matthew Kitchin]

I'm with you, just out of ideas at the moment.
-Matthew