Problems with Win 2K services

[Jesus De La Torre]

Hello:

I am having some problems with our PDC, a Win 2K Adv Serv
SP4 with Exchange 2000 SP3. It has been working fine for
almost a year, but two days ago some services (SMTP, DHCP,
Terminal and FRS) stopped. When I tried to restart them,
the error "Logon failure: account currently disabled"
appeared. This same error occurs when I try to clear the
Application Log. Did something happened with the
LOCALSYSTEM account?

Since then, I have been receiving the following errors in
the Event Viewer:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 30/01/2004
Time: 10:28:26 a.m.
User: N/A
Computer: ...
Description:
The File Replication Service service terminated with the
following error:
Insufficient system resources exist to complete the
requested service.

Event Type: Error
Event Source: smtpsvc
Event Category: None
Event ID: 429
Date: 30/01/2004
Time: 10:32:32 a.m.
User: N/A
Computer: ...
Description:
Virtual Server Invalid MailQueue Directory: The specified
mail queue directory is not valid. Cannot start the SMTP
Service.
Data:
0000: 33 05 00 00 3...

Event Type: Error
Event Source: IISLOG
Event Category: None
Event ID: 2
Date: 28/01/2004
Time: 05:03:54 p.m.
User: N/A
Computer: ...
Description:
IIS Logging was unable to create the directory
C:\WINNT\System32\LogFiles\W3SVC7. The data is the error.
For additional information specific to this message please
visit the Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.
Data:
0000: 33 05 00 00 3...

Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 100
Date: 28/01/2004
Time: 05:06:44 p.m.
User: N/A
Computer: ...
Description:
The server was unable to logon the Windows NT
account 'IUSR_...' due to the following error: The
specified module could not be found. The data is the
error code.
For additional information specific to this message please
visit the Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.
Data:
0000: 7e 00 00 00 ~...

Event Type: Error
Event Source: DhcpServer
Event Category: None
Event ID: 1017
Date: 28/01/2004
Time: 05:18:43 p.m.
User: N/A
Computer: ...
Description:
The description for Event ID ( 1017 ) in Source (
DhcpServer ) cannot be found. The local computer may not
have the necessary registry information or message DLL
files to display messages from a remote computer. The
following information is part of the event: Logon failure:
account currently disabled. .
Data:
0000: 33 05 00 00 3...

Event Type: Error
Event Source: NtFrs
Event Category: None
Event ID: 13539
Date: 30/01/2004
Time: 08:54:05 a.m.
User: N/A
Computer: MTYSANANGELW2K
Description:
The File Replication Service cannot replicate
c:\winnt\sysvol\domain because the pathname of the
replicated directory is not the fully qualified pathname
of an existing, accessible local directory.

I thought it could be a virus, but we have eTrust
Inoculate, and even thought it has detected some emails
with the Mydoom and Mimail, the attachments have been
deleted. I run a complete scan and it did not detect any
virus or worm.

Any idea what this could be? What should I do? Do you need
any more data? Any help will be appreciated!!

Thanks in advance for your help.

 

[Richard McCall [MSFT]]

If you check the properties of the machine account Is it disabled. You can
also check the useraccountcontrol attribute. For a DC it should be 532480

 

[Jesus De La Torre]

The machine account is under the Domain Controllers OU and
its userAccountControl property is set to 532480, as you
said it should be.

Any other ideas?

I really don't know what happened, there was no recent
software installation, no upgrade, no configuration
change, performed by us.

I cannot access the DC Security Policy, because of
the "logon failure: account currently disabled" error.
Even sometimes if I logoff and then try to logon, I
receive an error telling me that an error ocurred, so I
need to manually turn off the server.

Thanks for your help.

 

[Scott Harding - MS MVP]

Are you using a service account to run any of these services that may have
had it's password expire?

 

[Jesus De La Torre]

No Scott, almost all services are using the Local System
account.

I have been looking for a solution all over the Microsoft
Support Site and some search engines, and I haven't found
any info related with those errors.

Thanks for your help.

 

[Unregistered]

I had the same thing happen to me today. I also am running inoculat
6.0. Go into realtime monitor and make sure your quarantine is off
This was on for me and was wreaking havoc. Disabled quarantine and I a
back to normal. Hope this helps.

Lo

Unregistered