Terminal Server not Responding - Help!

[HisNameWasRobertPaulson]

Okay, time to enlist the infinite knowledge of the
newsgroup...

We have serveral terminal servers here that are
experiencing the same symptoms from time to time. Here is
what happens:
There will be an average amount of users logged onto the
system, using Microsoft Office apps & printing from these
apps.
On occasion, the server will simply QUIT servicing Remote
Desktop requests. The server will appear to be 'busy' in
TS manager and when attempting to connect to the server
via RDP - the server does NOT respond. All the while, the
previous users are still logged on and going about thier
business.

I have cotacted MS support twice in reguards to this issue
and have been provided with 6, count 'em, 6 post SP-4
hotfixes.

The problem remains. The server will remain in this state
for an undetermined amount of time. The only solution to
this problem is rebooting the server, which is no solution
at all.

As usuall, nothing of note appears in the logs and I am
simply clueless.

Any suggestions would be GREATLY appreciated! Thanks!

-Mike

 

[Vera Noest [MVP]]

When this happens, can you still logon to the console of the TS?
If so, can you check which processes are running and if any of
them is monopolizing the CPU? If it's winlogon.exe and
spoolsrv.exe, you've found the problem.
Next time this happens, can you stop and restart the spooler
service in stead of rebooting the whole server, and see if that
solves the problem?

If you can start Terminal Services Manager on the console, what is
the state of the rdp listener? Is it "down"?

Do you have any antivirus program running on the server? Have you
made sure that the RealTime FileSystem Protection (or whatever
this component is called in you virusscanner) is *not* running in
every user session?

Can you post the numbers of the post-SP4 hotfixes that you already
have applied?

Impossible to say anything for sure without knowing the answers to
the above questions, but chances are that the spooler is giving
you problems.
Have you installed any 3th party printer drivers on the server?
That is the most common cause for crashing or hanging a Terminal
Server. If so, you should uninstall all these drivers completely
from the TS and map the printers to native printer drivers on the
Server.

239088 - Windows 2000 Terminal Services Server Logs Events 1111,
1105, and 1106
http://support.microsoft.com/?kbid=239088

 

[Nay]

Vera's suggestions are great. I thought I'd add a couple
more - do you have any load-balancing solutions sitting
in front of those TSs such as ServerIron? Also, once you
are logged on to the TS (after it starts having the
issue) can you do a netstat -a and see if the server is
listening on port 3389?

Nay

 

[HisNameWasRobertPaulson]

Vera, thank you for the reply and sorry for the delay. Here are some
details::

When this happens, can you still logon to the console of the TS?

I don't know. These servers are located across town at another site,
so it is very hard to get to them when this happens. It is usually
critical that we just get it going as soon as possible, so I have
never had the chance to logon to the console. Next chance I get, I
will, though.

If so, can you check which processes are running and if any of
them is monopolizing the CPU? If it's winlogon.exe and
spoolsrv.exe, you've found the problem.

Again, I wish I knew - but lets say it was winlogon.exe & spoolsv.exe
- what would be a potential fix?

Next time this happens, can you stop and restart the spooler
service in stead of rebooting the whole server, and see if that
solves the problem?

I will try this.

If you can start Terminal Services Manager on the console, what is
the state of the rdp listener? Is it "down"?

Will try this next time - I wish I had an answer for you now, though!

Do you have any antivirus program running on the server? Have you
made sure that the RealTime FileSystem Protection (or whatever
this component is called in you virusscanner) is *not* running in
every user session?

We do have McAfee NetShield 7.0 - but only one instance of it is
running, even with 50 users logged on. However, I do get the McAfee
splash-screen when I and others log on - is this indicative of
multiple instances running? (although taskman only shows one)

Can you post the numbers of the post-SP4 hotfixes that you already
have applied?

Here are the hotfixes I have: (post Service Pack 4)
KB324446 (with proper regedits)
KB822834
KB823980
KB824146
KB827825
KB828153
KB828326

Impossible to say anything for sure without knowing the answers to
the above questions, but chances are that the spooler is giving
you problems.
Have you installed any 3th party printer drivers on the server?
That is the most common cause for crashing or hanging a Terminal
Server. If so, you should uninstall all these drivers completely
from the TS and map the printers to native printer drivers on the
Server.

We have tried to clean all 3rd party print drivers off the server. All
print drivers should be Windows provided or certified for Terminal
Services compatable. Although there are over 260 installed drivers on
the system, so it is hard to tell. But I am pretty sure.

Thanks!!!

-Mike

 

[HisNameWasRobertPaulson]

This is a good point.
We are using the standard load balancer that comes with Advanced
Server. We use it to load balance only 3389(rdp).
I have not tried netstat -a , but this is an excellent suggestion that
I will certainly try next time this happens.
My guess is no, because when the server is unresponsive, wlbs
recognizes this and routes requests away from that server.
Thank you,
-Mike

 

[Vera Noest [MVP]]

inline...

(e-mail address removed) (HisNameWasRobertPaulson) wrote in

Vera, thank you for the reply and sorry for the delay. Here are
some details::

in message


I don't know. These servers are located across town at another
site, so it is very hard to get to them when this happens. It is
usually critical that we just get it going as soon as possible,
so I have never had the chance to logon to the console. Next
chance I get, I will, though.


Again, I wish I knew - but lets say it was winlogon.exe &
spoolsv.exe - what would be a potential fix?

That would have been 822834 - which you already have.

I will try this.


Will try this next time - I wish I had an answer for you now,
though!


We do have McAfee NetShield 7.0 - but only one instance of it is
running, even with 50 users logged on. However, I do get the
McAfee splash-screen when I and others log on - is this
indicative of multiple instances running? (although taskman only
shows one)

Mmm, I've never used McAfee myself, but the splash screen doesn't
sound good. Can you disable McAfee completely on your Terminal
Servers?

Here are the hotfixes I have: (post Service Pack 4)
KB324446 (with proper regedits)
KB822834
KB823980
KB824146
KB827825
KB828153
KB828326

You might look at these as well:

817446 - Terminal Services Stops Responding
http://support.microsoft.com/?kbid=817446

823747 - Windows 2000 Terminal Server Stops Responding and a Black
Screen Appears
http://support.microsoft.com/?kbid=823747

 

[Guest]

I possibly have the same problem. I have two terminal servers (Windows 2003 Server) they are independant and service two independant user groups. One locks up more than the other and has a few more users (20 versus 15). The symptoms are as follows:

1. New RDP connections will get a logon screen but desktop never loads (blank grey screen only). Previously connected users are not affected. Users that map drives to resouces on that server are affected. Administrator can log onto the console.

2. As a few minutes pass, new RDP requests do not get logon screen. Previously connected users continue to function as do users that have mapped drives to resources on that server. Administrator will get logon screen but desktop never loads. Administrator can still manage server from management console of another computer.

3. A few more minutes pass and all previously connected users and locally mapped users can continue to work but server is locked up for anyone else and must be powered off.

4. During the downward spiral winlogon and csrss processes continue to grow in number. They are always above a 1:1 process to user ratio. I don't know for sure that this is bad but it does not look normal to me. Some of my users use a dial-up connection and get kicked of intermittantly. I don't know if that is leaving orphaned processes out there and that is why I am having problems or what my be the issue. I am running a DOS application on both of these servers with the latest version of TAMEDOS but this problem occurs much more frequently on one server than the other.

I have dual processors and 2Gb of RAM.
The clients are connecting via RDP from Win98, 2000 and XP clients.