Windows 2000 SP4 RollUp 1 problems?

[Neko-]

I'm using a machine running Windows 2000 Server SP4 English and is a
DC (not a major one, so I can play with it a bit). Recently Microsoft
released the Windows 2000 Security Roll Up Package 1, which I
installed on a few PC's without any problems. When installing it on
the DC machine however, it ran into some problems.

When installing it from the Windows Update site, halfway through the
installation it suddenly couldn't find a file it needed to copy. It
wasn't located in the temporary directory the EXE was expanded to. I
aborted the installation, but after rebooting the machine somehow the
Internet Explorer would not start anymore. The process was in the list
of running processes, I just never got a window to start browsing. All
normal network connectivity remained unhampered from the looks of it.

I then downloaded the actual package to a local EXE file
(Windows2000-KB891861-x86-ENU.EXE) through another machine, and moved
it over the network to the affected DC. Installed it, and without any
issues it installed it as it should. Rebooted the PC... Same problem
with IE remained. I could try starting it, but it'd hang some
processes (I couldn't access the startbar anymore, couldn't run
EXPLORER.EXE and such), and not display a browse window. Killing the
IEXPLORE.EXE process released everything again allowing me to proceed
with normal operation. I tried reinstalling IE, but this just stated
that I had the latest components already. Reinstalling IE (after a few
hitches) also did not provide for a solution.

Then the Automatic Updates came around stating it had downloaded new
updates, and it asked me if it could install them. Well... seeing I
had a minor issue already, any further updates (among two or three
security updates, IE had an update listed) might solve it. So I
agreed. Left the window open for a night, but nothing got installed.

I then booted up the machine in safemode with network support. Tried
IE... Started normally. Browsed to the Windows Update site, and
installed the available critical updates. No problems whatsoever. It
installed normally, and asked for a reboot. No problem... Rebooted the
machine. Tried IE... No go. IE still exhibits the same problem. As a
work-around I installed FireFox... That one connects to the internet
without any problems. So something appearantly is loaded on normal
boot that interferes with the functioning if IE.

I'd be content with using that if it wasn't for the fact that I
noticed some other problems. Not that the machine needs the software
(I may remove it alltogether, but it may help out pointing to a cause
of the whole) but AdAware had issues updating. It managed to update
eventually tho. SpyBot S&D updated without issues, SpywareBlaster
however hangs when trying to update the signature files. SpySweeper
appearantly likes to go the same way as IE, and refuses to start
alltogether. Lastly, the machine is running SETI (the CPU has got to
do something when it's not being used much), and I've noticed that
that machine seems unable to connect to the SETI website for returning
it's results packet.

The network connectivity isn't hampered and FireFox connects out to
the internet normally, so I'm ruling out the possibility of TCPIP
dying on me or the networkcard having issues. Also since IE works when
running in safemode, I kinda rule out an issue with IE itself (and as
a result any of the other programs aswell), and am looking more for an
underlying problems within the OS. Appearantly some part of that
RollUp package (and perhaps because of the failed first install) is
interfering with normal operation of the machine, or atleast certain
programs. As I said, it's not the primary machine, but I do like to
keep any machine functional as much as possible.

Tho one would expect that if the package was successfully installed on
a later pass that any file conflicts or registry issues should've been
taken care of.

The logfiles do not yield any real errors that might point to the
cause of the issue. There is a message (right after restarting the
machine) depicted in the application log:

EventID 61 - Warning - WMI ADAP was unable to process the RemoteAccess
performance library due to a time violation in the open function.
(http://www.eventid.net/display.asp?eventid=61&eventno=21&source=WinMgmt&phase=1)

I do not use any performance counters on that machine, so I'm biased
to go with the second noted on that page:

Woodrow Wayne Collins (Last update 3/11/2004):
If this error appears at the same time as the system is rebooting, no
action is necessary as it is to be expected.

The Systemlog yields an error 8022 - Warning - The browser was unable
to retrieve a list of domains from the browser master <OTHERPC> on the
network \Device\NetBT_Tcpip_{47D422E2-33A7-4E9D-8E50-CB519A8D9B64}.
The data is the error code.
The data depicts: 0000: 47 00 00 00 G...

http://www.eventid.net/display.asp?eventid=8022&eventno=453&source=BROWSER&phase=1

This also does not look like a real cause for problems. Since both are
warnings, I discard 'm both as not being real issues.

So I'm turning here to see if anyone might have some idea what is
going on, and what might be done about it.

Thanks in advance for any comment, feedback or solution provided.

Neko-

 

[Linea Recta]

What is a DC machine??


--
regards,

|\ /|
| \/ |@rk
\../
\/os

mccm dot vos at hccnet dot nl

 

[Neko-]

DC = Domain Controller

I thought that be rather obvious, so I just kept to the short-name of
it. Oh well

 

[George Hester]

D(omain)C(ontroller).

Two things maybe. Try to remove the TCP\IP from the Network card. Reboot
and put it back in Or turn off Web View in Windows Explorer | Tools | Folder
settings... | General | check Classic view.

 

[Neko-]

The Web View isn't enabled. So running Explorer works fine. It's
starting to act up appearantly as soon as IE components are being
loaded.

I could try the TCP/IP solution tho... However since normal network
traffic isn't affected, and FireFox runs normally, I seriously doubt
the TCP/IP stack itself is faulty.

The machine only runs TCP/IP, and seeing it can be accessed from the
network normally, aswell as access other network based resources I
doubt that will help much. I know instances where the RPC isn't quite
normally bound to TCP/IP, but those cases only occur on re-dumped
machines. *shrug*

Anyway. Tried accessing the properties of the LAN connection. A very
descriptive error popped up: "An unexpected Error occurred". Couldn't
open the LAN properties in any way, so I just rebooted the machine
into SafeMode with network support and tried through there. Same
message: "An unexpected error occurred". Plain Safemode... no opening
at all.

Tracked that error at the Microsoft support site. About the only
article describing the issue is located at:
http://support.microsoft.com/default.aspx?scid=kb;en-us;824923

Tried both solutions on there. (not specified as a solution for
Windows 2000, but hey). Solution 1 (netshell.dll) did not provide a
solution. So I turned to the ole32.dll. Restart of the computer.

The error still occurs, but atleast IE now opens a window again. It
just keeps looking and looking, and looking. Window remains empty.
Tried pinging to a website, no problems. IP resolving and connectivity
is there. It just doesn't display in IE. Looked that error up:
http://support.microsoft.com/default.aspx?scid=kb;en-us;555027

Didn't help me. :-(

So the TCP/IP doesn't look like the culprit. Seems there is something
more sinister going on. Anyone have any further idea's on how to
proceed here?

Thanks for any and all responses.

Neko-

 

[Slart Bartfast]

Hi Neko,

We ran this MS update last week;

Update Rollup 1 for Microsoft Windows 2000 Service Pack 4 that is dated June
28, 2005
Article ID : 900345
Last Review : July 8, 2005
Revision : 2.0


We have two Domain Controllers, and one of them - the FSMO GC, blue screened
with A Stop ..1E ntoskrnl.exe error.

There was no way to get out of it except when we paid $300 for a 'five day
only' version of Winternals ERD Comander. We were able to boot with the ERD
CD and 'roll back' the MS Rollup.
After that it was OK. Just to test if this was a 'one off' error, we ghosted
the Domain Controller and tried the MS Rollup again and got blue screened
again.

Regards,
Slarty Bartfast

 

[ZDAS7]

Hi Neko,

We ran this MS update last week;

Update Rollup 1 for Microsoft Windows 2000 Service Pack 4 that is dated June
28, 2005
Article ID : 900345
Last Review : July 8, 2005
Revision : 2.0


We have two Domain Controllers, and one of them - the FSMO GC, blue screened
with A Stop ..1E ntoskrnl.exe error.

There was no way to get out of it except when we paid $300 for a 'five day
only' version of Winternals ERD Comander. We were able to boot with the ERD
CD and 'roll back' the MS Rollup.
After that it was OK. Just to test if this was a 'one off' error, we ghosted
the Domain Controller and tried the MS Rollup again and got blue screened
again.

Regards,
Slarty Bartfast

I've not had any problems with the updates until today. We found this
on another newsgroup. (We should not have had to do this. But, we did
due to an unrecoverable NTOSKRNL exception.) This is for Windows 2000
only.
=========================================
for this problem someone in this NG knew the solution. It worked for
some
other guy as well.


problem:
--------
I just attempted to update a Windows 2000 Server SP4 through Windows
Update
including the Update Rollup. After reboot it shows a Blue Screen.

Stop: 0x0000001E (0x0000005,0x804A6467,0x00000000,0x00000000)
KMode_Exception_not_handled
Adress 804A6467 base at 80400000, DateStamp 427b58bb - ntoskrnl.exe


All F8 options don't work. There have never been any problems with the
server which is a file and DHCP Server in an W2K domain.

Does anybody know a solution? Should I run a repair installation from
CD? Is
there a known problem with the update rollup?
---------


solution:
---------
Try uninstalling the Rollup Pack

reboot in recovery console
cd to your windows directory
cd $NtUpdateRollupPackUninstall$
cd spuninst
do a dir and make sure there is spuninst.txt file in there
use the command "batch spuninst.txt"
exit the recovery console

 

[Slart Bartfast]

This method would have been OK for me, but I couldn't even get into it with
F8! There was no way in except via this Winternals boot CD.

--


Regards,

Slarty Bartfast



Friction is a drag.

 

[ZDAS7]

This method would have been OK for me, but I couldn't even get into it with
F8! There was no way in except via this Winternals boot CD.

--


Regards,

Slarty Bartfast



Friction is a drag.

I had to boot from my Windows 2000 installation CD, install the SCSI
drivers (because I had RAID Drives - F6 when prompted), follow the
onscreen instructions and specify Repair. Then, go into the Recovery
Console from there. "Safe mode" (any of them) or "Debug mode" would
not work, so this method allowed me to successfully run the recovery
console. Just be sure not to do an install, unless that's you're
intention. Hope this helps.

 

[Neko-]

Well... that went well

Did the solution below... No real worries there. It came back that it
had some access denieds on some files, but copied everything after
that back appearantly fine. Then the reboot out of the recovery
console came by...

Which landed me on the Windows is starting screen (with the nice bar
at the bottom), and then it *tried* to switch to the nice graphic
screen depicting the start of Windows normally... Which didn't appear.
It just rebooted.

Got up to the same place... Rebooted again... And again, and again.

So... Boot from the W2K server CD... Choose to repair windows... Did
all that without a hitch. Reboot of the PC... Same error occurred.
Cycle of reboots all at the same point. As soon as the post-preboot
ends, it dies on me and reboots.

Safe Mode? Nope. Same happens, right after it loads the MUP.SYS
driver.

So... I guess the rollback from the rollup officially killed off the
PC... I'm guessing I'm gonna have to disconnect the data disks this
weekend, and reinstall Windows. Re-integrate it into the domain, and
just run with a clean install again. All in all, a tad of work which
I'm not really looking forward to for the moment :-/

Maybe the fact that it's hot and it's 23:00 in the evening may have
something to do with my mood now.

Oh well... Thanks for everyone's help sofar. If anyone has any ideas
left, I'd be willing to listen to 'm

Neko-

 

[Slart Bartfast]

Hi Neko and ZDAS7,

As I said, I had the same ntoskrnl.exe stop error after the MS Hotfix. I
tried to get into safe mode with F8 and it would stop loading at the Windows
screen. Using the Windows 2000 CD to repair said 'no hard disk'!
I was able to put a SCSI 2000 bootable hard drive in and I could see the
failed hard drive as secondary. I could copy over a new ntosknrl.exe and try
various other things like chkdsk etc, but the ONLY way for us to get out of
this was to reinstall everything, but instead we were able to use Winternals
boot CD and that was able roll back to a state before the MS Update. It cost
about $300 for five day usage, but it was worth it.

--


Regards,

Slarty Bartfast



It's tourist season in Florida, bag limit two.

 

[Neko-]

Like I said before... this machine aint THAT critical. I do not feel
any need to actually invest $300 to get it running again (provided it
will be able to get back up again), if a reinstall can provide me the
same functionality. The machine has been abused for multiple things
over the course of time, so a reinstall may not really be too bad of
an idea.

Neko-

 

[Slarty Bartfast]

Unfortunately, this was our main Domain Controller with DNS, FSMO and GC,
plus lots of hard to configure stuff. We really didn't look foward to
re-installing it.

--


Regards,

Slarty Bartfast



Answers: $1, Short: $5, Correct: $25, dumb looks are still free.

 

[Rob Stow]

Unfortunately, this was our main Domain Controller with DNS, FSMO and GC,
plus lots of hard to configure stuff. We really didn't look foward to
re-installing it.

That is why I always make a backup image of the system/boot
partition before installing *anything* from MicroSoft. Even
updates to things from MicroSoft that /should/ have nothing to do
with the OS should not be installed without first making an image
or at least doing a thorough backup, because some idiot at some
point made the decision to integrate crapware like IE, OE,
Office, etc, into the OS.

I have had my own problems with this rollup, but having backup
images on hand has made it fast and easy to go undo the changes
made by the rollup.

 

[Slarty Bartfast]

Hi Rob,

Since you mention backups, I have been testing ARCserve Brightstor V11
Disaster Recovery.
We have two IBM xSeries 335 servers.
One Server, PYXIS is a DC2 and has Exchange 5.5 and the DLT8000 tape drive.
It also backs up remotely the first DC PAVO.

I have a test system here that duplicates our 'real' system with PYXIS and
PAVO but using old Compaq Deskpro computers. The 'remote' restore of PAVO
works very well on the test system, but not on the real PAVO.

I knew I would come to grief with the 'ServerGuide' setup CDROM that the
xSeries uses - in real life it was nothing like the ARCserve documentation
describes.

I am going to look further into this, but I just raised it now since you
mentioned it. Do you have any suggestions?

We do a 'full' backup each day, but couldn't restore because 'no hard drive'
was found.


--


Regards,

Slarty Bartfast



Swifties overly modify dialog excessively, said Tom adverbially.

 

[George Hester]

You know Rob it is not the integration that is to blame. It is the removal of what we expect of the integration. That's the issue. For when what we expect is removed by Microsoft ostensibly for security reasons than a whole bunch of crap happens that nobdy expected and is why I for one install nothing new from Microsft. Everything here is about 2 years old and that is where everything is going to stay until Microsoft comes out with their new op sys's and there they sit until the next one. I have been played for the panzy once too often