Win2K Refuses to Respond, Recently Patched (Long, But Urgent)

[M. Farrenkopf]

I'm working in a department with about 50 machines, all running Win2K (SP4,
all patched except for below). They are connected to an NT 4.0 domain and
Netware 5.x servers. About half of these machines run the native Novell
client (4.83.00 SP2). For those machines that have the client, they also
receive GPOs that severely limit what a user can do on the machine.

Recently, our IT department sent a patch for MS04-028 down through Netware's
NAL (it allows the system to run updates automatically). From what I could
see, the patch only updated IE6. There were a few machines that had
problems on installation, including becoming unresponsive to icons and the
Start menu getting abbreviated (doesn't show Programs, Favorites, etc.). I
was told to shut down the machines, wait one minute, then turn them back on.
I did this and each machine came up just fine.

However, we have a recurring problem in which these symptoms continue to
appear. A summary of the symptoms includes:

* runs of "The application failed to initialize" (System Log, Application
popup, error code 26, system error 0xC0000142), typically on the screen
saver ("ssmarque.scr")

* sporadic entries of "the application failed to initialize" for other
programs, such as the program that provides access to mainframe applications
(Hostex32.exe) or Groupwise (Grpwise.exe); same system error code
(0xC0000142)

* all icons unresponsive (double-click, no response; point to icon shows
tooltip)

* Start menu abbreviated (missing Programs, Favorites, Documents, etc., down
to and including Log off; Start menu shortcuts above where the Programs menu
should be show up, but are unusable)

* Logging off and logging back on appears to fix (use Ctrl-Alt-Del, choose
Logout)

* only appears on machines that use GPs

* appears to happen after the machine has sat idle for a long time ("long
time," in this context, is undefined, but so far I don't recall a time frame
less than a few hours)

Machines that do not receive the GPs, or that are used constantly, do not
seem to be affected by this problem.

I've backed the patch out, along with several others (841533, 840987,
841356, and 834707) that were applied about the same time. The patch in
question for MS04-028 IE6 was 833989. The problem continues. I'm not sure
if it's continuing because, despite being uninstalled, the patches left
traces behind, or if I'm not looking in the right place. We had no problems
before patch application, and our IT department admitted there was a problem
with the patch. So far, no resolution on their end.

My feeling is that something has changed with Windows (via the patch) that
is causing it to misinterpret one of the policies, or perhaps it's now
mishandling something during the group policy refresh. Rebooting (or just
logging off and back on) fixes the problem.

I haven't found anything on Google/Google Groups, so I get the feeling this
is a unique problem to us. I'm tempted to pull out the kernel debugger, but
I haven't done that yet. If anyone has any information on what might be
causing this, I would be most appreciative of hearing about it. I work in a
busy department that is feeling a real hardship from this issue.

Thanks,
Matt

 

[Guest]

You problem is similar to this one. HTH.

Unexpected behavior occurs when you run many processes on a computer that is
running SQL Server
http://support.microsoft.com/default.aspx?scid=kb;en-us;824422

BR,
Denis

 

[M. Farrenkopf]

You problem is similar to this one. HTH.

Unexpected behavior occurs when you run many processes on a computer that is
running SQL Server
http://support.microsoft.com/default.aspx?scid=kb;en-us;824422

BR,
Denis

Thank you very much for the reference. I will try this and see what
happens.

Due to the timing of the symptoms, I would wonder if one of Microsoft's
latest patches has some kind of memory leak. I'm certain this did not start
until after the latest round of patching.

Thanks,
Matt

 

[M. Farrenkopf]

You problem is similar to this one. HTH.

Unexpected behavior occurs when you run many processes on a computer that is
running SQL Server
http://support.microsoft.com/default.aspx?scid=kb;en-us;824422

So I tried the solution listed and it didn't work. :-( We're back to the
same problem we had before. But thank you for finding it and suggesting it.

Any other suggestions would be appreciated. I'm this close >< to pulling
out the Windows kernel debugger and seeing if I can find a cause.
(Suggestions on good technical Windows internals books would be
appreciated.)

Thanks,
Matt

 

[mfarrenk]

So I tried the solution listed and it didn't work. :-( We're back to the
same problem we had before. But thank you for finding it and suggesting it.

Any other suggestions would be appreciated. I'm this close >< to pulling
out the Windows kernel debugger and seeing if I can find a cause.
(Suggestions on good technical Windows internals books would be
appreciated.)

So I never received any other ideas besides Denis Wong's. Our IT group
finally figured out what it was, but it took four months.

It appears that the Win2K policy files were edited (and, thus,
corrupted) using an editor for Windows XP. I'm told there are postings
on Microsoft's knowledge base that point to incompatibilities between
W2K policy files and WXP policy files that cause the symptoms I
described previously. (I never found anything, but the people In The
Know say they're there.)

I did pull out a debugger and watched what happened. Everything I saw
indicated that Windows was reading the policy files correctly. To that
I say, whatever. Learning to set up the debugger and work through it
at least added to my knowledge.
Thanks again to Denis Wong for at least suggesting a solution.

Matt