RIS setup

[Brian]

Ive installed a group of test machines with Win2k and SP4
using RIS. The process works fine.
I then install various apps using GPO. These include MSI
and ZAP files.
Everything works fine. The problem is when a machine is
left logged out and idle for a while, usually overnight.
When a user logs in, it takes a while for the icons to
display on the desktop. Eventually they do appear, but
icons no longer appear in control panel or the programs
menu. A reboot sorts all these symptoms out, but I dont
really want to roll out machines using RIS on mass knowing
these symptoms exist. I suspect its an explorer.exe
problem but how can I be sure and how would I resolve it?
Any ideas?

 

[NIC Student]

If you hand load Win2K and SP4, then use GPO to install the programs, do the
same symptoms occur?

What are the event log errors on the sick machines?

 

[Brian]

Nothing untoward in the event logs.
Dont know about Hand install.
Im going to RIS a machine, without applying GPO. Set up
auditing on the Registry and C:\ for the System account.
Then all I can do is leave it a few days and apply each
software app every second day or so. Thats the problem
with the symptoms, they are very sporadic.
Another symptom I noticed yesterday was that the CD ROM
drives started playing up. Some wouldnt read the CD's,
others would read them, would start the autoplay but then
fail to proceed. Again a reboot sorted things out.

 

[Brian]

On two of the machines I have now found the following 3
errors:
Application Error:4097 Source:EventSystem

The COM+ Event System detected a bad return code during
its internal processing. HRESULT was 800706BE from line
42 of. \eventsystemobj.cpp.

Then another identicle but with HRESULT was 80070BA

Application Error:4097 SourceR Watson

The application svchost.exe generated an application
error. The error occurred on <date>@<time>. The
exception generated was c0000005 at address E03C3A68[<no
symbols>]

Then at the same time a System event occurs:

EventID:7031 Source: Service Control Manager

The remote procedure call (RPC) service terminated
unexpectedly. It has done this 1 time(s). The following
corrective action will be taken in 0 milliseconds: No
action.

 

[NIC Student]

I'll look this up later on today, but my first thought was a Blaster
infection?

--
Scott Baldridge
Windows Server MVP, MCSE

On two of the machines I have now found the following 3
errors:
Application Error:4097 Source:EventSystem

The COM+ Event System detected a bad return code during
its internal processing. HRESULT was 800706BE from line
42 of. \eventsystemobj.cpp.

Then another identicle but with HRESULT was 80070BA

Application Error:4097 SourceR Watson

The application svchost.exe generated an application
error. The error occurred on <date>@<time>. The
exception generated was c0000005 at address E03C3A68[<no
symbols>]

Then at the same time a System event occurs:

EventID:7031 Source: Service Control Manager

The remote procedure call (RPC) service terminated
unexpectedly. It has done this 1 time(s). The following
corrective action will be taken in 0 milliseconds: No
action.

-----Original Message-----
If you hand load Win2K and SP4, then use GPO to install the programs, do the
same symptoms occur?

What are the event log errors on the sick machines?


--
Scott Baldridge
Windows Server MVP, MCSE



.

 

[NIC Student]

Have you checked for the MSBlaster yet?

The Stinger will check for you:

http://us.mcafee.com/virusInfo/default.asp?id=stinger

--
Scott Baldridge
Windows Server MVP, MCSE

I'll look this up later on today, but my first thought was a Blaster
infection?

--
Scott Baldridge
Windows Server MVP, MCSE

On two of the machines I have now found the following 3
errors:
Application Error:4097 Source:EventSystem

The COM+ Event System detected a bad return code during
its internal processing. HRESULT was 800706BE from line
42 of. \eventsystemobj.cpp.

Then another identicle but with HRESULT was 80070BA

Application Error:4097 SourceR Watson

The application svchost.exe generated an application
error. The error occurred on <date>@<time>. The
exception generated was c0000005 at address E03C3A68[<no
symbols>]

Then at the same time a System event occurs:

EventID:7031 Source: Service Control Manager

The remote procedure call (RPC) service terminated
unexpectedly. It has done this 1 time(s). The following
corrective action will be taken in 0 milliseconds: No
action.

-----Original Message-----
If you hand load Win2K and SP4, then use GPO to install the programs, do the
same symptoms occur?

What are the event log errors on the sick machines?


--
Scott Baldridge
Windows Server MVP, MCSE

Ive installed a group of test machines with Win2k and SP4
using RIS. The process works fine.
I then install various apps using GPO. These include MSI
and ZAP files.
Everything works fine. The problem is when a machine is
left logged out and idle for a while, usually overnight.
When a user logs in, it takes a while for the icons to
display on the desktop. Eventually they do appear, but
icons no longer appear in control panel or the programs
menu. A reboot sorts all these symptoms out, but I dont
really want to roll out machines using RIS on mass knowing
these symptoms exist. I suspect its an explorer.exe
problem but how can I be sure and how would I resolve it?
Any ideas?


.

 

[Brian]

Thanks Scott, it looks like it was the blaster. Ive
cleaned the machines up and they seem to be stable.

-----Original Message-----
Have you checked for the MSBlaster yet?

The Stinger will check for you:

http://us.mcafee.com/virusInfo/default.asp?id=stinger

--
Scott Baldridge
Windows Server MVP, MCSE

I'll look this up later on today, but my first thought was a Blaster
infection?

--
Scott Baldridge
Windows Server MVP, MCSE

On two of the machines I have now found the following 3
errors:
Application Error:4097 Source:EventSystem

The COM+ Event System detected a bad return code during
its internal processing. HRESULT was 800706BE from line
42 of. \eventsystemobj.cpp.

Then another identicle but with HRESULT was 80070BA

Application Error:4097 SourceR Watson

The application svchost.exe generated an application
error. The error occurred on <date>@<time>. The
exception generated was c0000005 at address E03C3A68 [<no
symbols>]

Then at the same time a System event occurs:

EventID:7031 Source: Service Control Manager

The remote procedure call (RPC) service terminated
unexpectedly. It has done this 1 time(s). The following
corrective action will be taken in 0 milliseconds: No
action.


-----Original Message-----
If you hand load Win2K and SP4, then use GPO to install
the programs, do the
same symptoms occur?

What are the event log errors on the sick machines?


--
Scott Baldridge
Windows Server MVP, MCSE

Ive installed a group of test machines with Win2k and
SP4
using RIS. The process works fine.
I then install various apps using GPO. These include
MSI
and ZAP files.
Everything works fine. The problem is when a machine is
left logged out and idle for a while, usually overnight.
When a user logs in, it takes a while for the icons to
display on the desktop. Eventually they do appear, but
icons no longer appear in control panel or the programs
menu. A reboot sorts all these symptoms out, but I dont
really want to roll out machines using RIS on mass
knowing
these symptoms exist. I suspect its an explorer.exe
problem but how can I be sure and how would I resolve
it?
Any ideas?


.

.