PERFGURU : windows server 2003

"Windows Update failing" Torubleshooting Steps

pawansharma — Fri, 18 Jul 2008 08:37:00 GMT

1) Windows update can fail due to many reasons.But as an initial troubleshooting step we can run script givenbelow.

The following script will re-register windows update dlls and recreate software distribution & catroot folder.

To run the script please copy the highlighted content and save it as wu.bat.

regsvr32 comcat.dll /s

regsvr32 shdoc401.dll /s

regsvr32 shdoc401.dll /i /s

regsvr32 asctrls.ocx /s

regsvr32 oleaut32.dll /s

regsvr32 shdocvw.dll /I /s

regsvr32 shdocvw.dll /s

regsvr32 browseui.dll /s

regsvr32 browseui.dll /I /s

regsvr32 msrating.dll /s

regsvr32 mlang.dll /s

regsvr32 hlink.dll /s

regsvr32 mshtmled.dll /s

regsvr32 urlmon.dll /s

regsvr32 plugin.ocx /s

regsvr32 sendmail.dll /s

regsvr32 scrobj.dll /s

regsvr32 mmefxe.ocx /s

regsvr32 corpol.dll /s

regsvr32 jscript.dll /s

regsvr32 msxml.dll /s

regsvr32 imgutil.dll /s

regsvr32 thumbvw.dll /s

regsvr32 cryptext.dll /s

regsvr32 rsabase.dll /s

regsvr32 inseng.dll /s

regsvr32 iesetup.dll /i /s

regsvr32 cryptdlg.dll /s

regsvr32 actxprxy.dll /s

regsvr32 dispex.dll /s

regsvr32 occache.dll /s

regsvr32 occache.dll /i /s

regsvr32 iepeers.dll /s

regsvr32 urlmon.dll /i /s

regsvr32 cdfview.dll /s

regsvr32 webcheck.dll /s

regsvr32 mobsync.dll /s

regsvr32 pngfilt.dll /s

regsvr32 licmgr10.dll /s

regsvr32 icmfilter.dll /s

regsvr32 hhctrl.ocx /s

regsvr32 inetcfg.dll /s

regsvr32 tdc.ocx /s

regsvr32 MSR2C.DLL /s

regsvr32 msident.dll /s

regsvr32 msieftp.dll /s

regsvr32 xmsconf.ocx /s

regsvr32 ils.dll /s

regsvr32 msoeacct.dll /s

regsvr32 inetcomm.dll /s

regsvr32 msdxm.ocx /s

regsvr32 dxmasf.dll /s

regsvr32 l3codecx.ax /s

regsvr32 acelpdec.ax /s

regsvr32 mpg4ds32.ax /s

regsvr32 voxmsdec.ax /s

regsvr32 danim.dll /s

regsvr32 Daxctle.ocx /s

regsvr32 lmrt.dll /s

regsvr32 datime.dll /s

regsvr32 dxtrans.dll /s

regsvr32 dxtmsft.dll /s

regsvr32 WEBPOST.DLL /s

regsvr32 WPWIZDLL.DLL /s

regsvr32 POSTWPP.DLL /s

regsvr32 CRSWPP.DLL /s

regsvr32 FTPWPP.DLL /s

regsvr32 FPWPP.DLL /s

regsvr32 WUAPI.DLL /s

regsvr32 WUAUENG.DLL /s

regsvr32 ATL.DLL /s

regsvr32 WUCLTUI.DLL /s

regsvr32 WUPS.DLL /s

regsvr32 WUWEB.DLL /s

regsvr32 wshom.ocx /s

regsvr32 wshext.dll /s

regsvr32 vbscript.dll /s

regsvr32 scrrun.dll mstinit.exe /setup /s

regsvr32 msnsspc.dll /SspcCreateSspiReg /s

regsvr32 msapsspc.dll /SspcCreateSspiReg /s

regsvr32 /s urlmon.dll

regsvr32 /s mshtml.dll

regsvr32 /s shdocvw.dll

regsvr32 /s browseui.dll

regsvr32 /s jscript.dll

regsvr32 /s vbscript.dll

regsvr32 /s scrrun.dll

regsvr32 /s msxml.dll

regsvr32 /s actxprxy.dll

regsvr32 /s softpub.dll

regsvr32 /s wintrust.dll

regsvr32 /s dssenh.dll

regsvr32 /s rsaenh.dll

regsvr32 /s gpkcsp.dll

regsvr32 /s sccbase.dll

regsvr32 /s slbcsp.dll

regsvr32 /s cryptdlg.dll

regsvr32 /s schannel.dll

regsvr32 /s oleaut32.dll

regsvr32 /s ole32.dll

regsvr32 /s shell32.dll

regsvr32 /s initpki.dll

regsvr32 /s msscript.ocx

regsvr32 /s dispex.dll

regsvr32 jscript.dll /s

del %temp% /Q /F

del c:\wutemp /Q /F

net stop wuauserv

ren %windir%\system32\catroot2 catroot2.old

cd /d %windir%\SoftwareDistribution

rd /s DataStore /Q

regsvr32 wuapi.dll /s

regsvr32 wups.dll /s

regsvr32 wuaueng.dll /s

regsvr32 wucltui.dll /s

regsvr32 wuweb.dll /s

regsvr32 msxml.dll /s

regsvr32 msxml2.dll /s

regsvr32 msxml3.dll /s

regsvr32 urlmon.dll /s

net start wuauserv

2) Check if WU is working fine. If not then follow next steps

3) Clean boot the computer

a.Start-Run-Msconfig
b. Click "Hide all microsoft services"
c. Click "Disable All"
d. Click Apply/OK and restart

4) Install latest Windows Update agent

http://technet.microsoft.com/en-us/library/bb932139.aspx

5) Below two articles contain common steps which can be followed in WU issue.

http://support.microsoft.com/?id=910337

http://support.microsoft.com/?id=836941

But it’s always a good practice to look for the errors in windows update log and then troubleshoot it.

6) To open windowsupdate.log click on Startà Runà type “windowsupdate.log”

7) To find the error search the log (from bottom)with key word like ERROR,

2008-06-13 11:08:35:022 1068 d58 AU # WARNING: Search callback failed, result = 0x80244018

2008-06-13 11:08:35:022 1068 d58 AU # WARNING: Failed to find updates with error code 80244018

2008-06-13 11:14:11:739 1068 cfc Service ** END ** Service: Service exit [Exit code = 0x240001]

Search error code on http://support.microsoft.com and follow the article related to the error to fix the issue.

Hope this will help to troubleshoot WU issues J

Services not starting after installing service pack on Windows 2003 server

pawansharma — Tue, 15 Jul 2008 09:11:00 GMT

1) Disable all third party services and startup items using msconfig.exe.

2) Restart the machine.

3) Open services console (Start à run à services.msc)

4) Check the status of The Remote Procedure Call (RPC) service (rpcss.exe).

5) If RPC service is running in Network Service account then change the login account LocalSystem

6) Following are the two ways to change the login account:

a. Go to properties of the RPC service and click on Logon.

Select Local System account.

b. Open registry editor(Start à run à regedit)

Go to registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs

Value name: ObjectName

Type: REG_SZ

Value data: NT AUTHORITY\NetworkService

Change value of “Value data” to LocalSystem

c. Reboot the machine.

7) If all the services started after changing the account then issue could be due to Impersonation rights .

8) Open dsa .msc and give account permission impersonation policies under

Computer Configuration- LocalPolicy- Security for the following accounts

-Administrators

-IIS-WPG

-Network service

-Local Service

9) Change the logon account of RPC service

Open registry editor(Start à run à regedit)

Go to registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs

Value name: ObjectName

Type: REG_SZ

Value data: LocalSystem

Change value of “Value data” to NT AUTHORITY\NetworkService

Reboot the machine.

"COM+ Event System and MSDTC service not starting" Trouboulshooting steps

pawansharma — Mon, 14 Jul 2008 11:40:00 GMT

1. In Control Panel, stop all services, and change the Startup Type to "manual" <except> for the following:

- Alerter

- COM+ Event System

- Computer Browser

- Distributed File System

- Distributed Link Tracking Client

- Distributed Link Tracking Server

- DNS Client

- Event Log

- IPSEC Policy Agent

- License Logging Service

- Logical Disk Manager

- Messenger

- Net Logon

- NT LM Security Support Provider

- Network Connectors

- Plug and Play

- Remote Procedure Call (RPC)

- Remote Procedure Call (RPC) Locator

- Removable Storage

- Security Accounts Manager

- Server

- System Event Notification

- Task Scheduler

- TCP/IP NetBIOS Helper Services

- Windows Management Instrumentation

- Windows Management Instrumentation Driver Extensions

- Windows Time

- Workstation

2. Close Control Panel, and restart your computer.

3. At the command prompt, type the following command:

"msdtc -uninstall" (without the quotation marks)

4. In the registry, remove the following keys if they exist:

HKEY_CLASSES_ROOT\CID

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSDTC

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\MSDTC

HKEY_LOCAL_MACHINE\Software\Microsoft\MSDTC

5. At the command prompt, type the following command:

"msdtc -install" (without the quotation marks)

6. Check Event Viewer for the following message:

Event Source: MSDTC

Event ID: 4104

Description: The Microsoft Distributed Transaction Coordinator service was successfully installed..

7. Restore the Startup Type of the services to their original values, and then restart your computer.

8. At a command prompt, type the following command: "msdtc -resetlog" (without the quotation marks)

9. Start > Run > Regsvr32 es.dll –u

10. Open registry and delete the [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem] key and all its subkeys

11. Close regedit

12. Reboot.

13. Start > Run > Regsvr32 es.dll

14. Reboot the system in safe mode and delete all the files in the following directory “%systemroot%\registration”

15. Rename the %WinDir%\System32\Clbcatq.dll file to %WinDir%\System32\~Clbcatq.dll. Make sure that you include the tilde (~) at the start of the file name.

16. Restart the computer

17. Start Registry Editor (Regedt32.exe).

18. Locate and delete the following key in the registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3

19. At a command prompt, type "cd %windir%" (without the quotation marks), and then press ENTER

20. At a command prompt, type "rmdir /s Registration" (without the quotation marks), and then press ENTER. This is the location folder of the registration database.

21. Click the Start button, point to Settings, and then click Control Panel.

22. Double-click Add/Remove Programs, and then click Add/Remove Windows Components

23. Click Next to go through the reinstallation process, to reinstall COM+.

Explanation for the USEPMTIMER switch in the boot.ini

Deepesh — Mon, 18 Feb 2008 10:43:00 GMT

Hello All,

This post covers the use of the USEPMTIMER switch in the boot.ini and also shows how it affects the operating system

Symptoms

Dual Core or multiprocessor AMD Opteron processors may encounter Time Stamp Counter (TSC) drift in certain conditions. Whether the system is affected by this issue depends on the specific ProLiant server generation, the number and type of AMD Opteron processors installed, the operating system, and whether AMD’s PowerNow! feature is being utilized. This condition affects operations such as network communications and performance monitoring tasks that are sensitive to system time. For example, Microsoft Active Directory domain controllers can report an Unexpected Network Error (Event ID 1054).

Event Description:

Windows cannot obtain the domain controller name for your computer network. (An unexpected network error occurred ) . Group Policy processing aborted.

In addition, a negative PING time may be returned after issuing the PING command. The negative PING time occurs because of a Time Stamp Counter drift occurring on AMD Opteron platforms which include more than one processor core.

You may also see that the performance monitor shows you wrong values.

Cause

Many operating systems use the TSC as a timekeeping source. Each processor core (whether it is a single-core processor or dual-core processor) includes a TSC. When the TSC for different processor cores are not synchronized, the above symptoms and behaviors can occur if the operating system is using the TSC as a timekeeping source

Resolution

Edit the BOOT.ini file and add the parameter "/usepmtimer", then reboot the server. Adding the "/usepmtimer" parameter to the BOOT.INI file configures the Windows operating system to use the PM_TIMER, rather than the Time Stamp Counter.

Note: When installing the latest AMD PowerNow! Technology driver from AMD, the BOOT.INI file will automatically be updated with the “/usepmtimer” parameter. While the driver itself does not resolve this issue, the installation process will make the necessary changes to the BOOT.INI file to prevent the issue from occurring.

Detailed Explanation:-

A Microsoft Windows Server 2003-based server may experience time-stamp counter drift if the server uses dual-core AMD Opteron processors or multiprocessor AMD Opteron processors. When this problem occurs, operations that rely on the time-stamp counter may not function correctly. These operations include network communications and performance monitoring. This problem occurs when the time-stamp counters for different processor cores are not synchronized. Windows Server 2003 uses the time-stamp counter as a timekeeping source. Each processor contains a time-stamp counter. Basically, configuring the /USEPMTIMER switch forces the machine to select the ACPI clock for the performance counter timer instead of using the time stamp counter (TSC). Note that only ACPI HALs ever use the PM timer for the function QueryPerformanceCounter; APM and other non-ACPI HALs use the TSC.

W2K SP4:

- The PIC ACPI and Uniprocessor (UP) APIC ACPI HALs use the PM timer for QueryPerformanceCounter.

XP SP2:

- The PIC ACPI and UP APIC ACPI HALs use the PM timer for QueryPerformanceCounter.

- The multiprocessor (MP) APIC ACPI HAL does not use the PM timer for QueryPerformanceCounter by default, instead using the TSC. This can be overridden in three ways. First, the /USEPMTIMER switch may be specified in boot.ini. Second, a mask including 0x10 can be written to HKLM\System\CurrentControlSet\Control\HAL\14140000FFFFFFFF to set a special HAL hack flag (not recommended). Third, the USE_PLATFORM_CLOCK bit can be set in the FADT presented by the system BIOS (bios-level from the hardware vendor).

W2K3 SP1:

- The PIC ACPI and UP APIC ACPI HALs use the PM timer for QueryPerformanceCounter.

- The MP APIC ACPI HAL does not use the PM timer for QueryPerformanceCounter by default, instead using the TSC. This can be overridden in two ways. First, the /USEPMTIMER switch may be specified in boot.ini. Second, the USE_PLATFORM_CLOCK bit can be set in the FADT presented by the system BIOS (note W2K3 does not read the registry value, as XP does - using the registry to set this is of course not recommended).

- W2K3 SP2 uses the PM timer by default for all APIC ACPI HALs, unless the check to see if the BIOS supports this fails .

Unless you are running SP2 for W2K3 (where we use the PM timer for MP APIC ACPI HALs by default now), you must force the use of the PM timer on AMD machines via the /USEPMTIMER switch. The decision to use the PM timer versus the TSC is actually a check done on boot to query the BIOS, and determine whether or not it will properly support the PM timer functions - this check is not 100% accurate on AMD chipsets, and that is why forcing /USEPMTIMER is required. This section of code was rewritten for W2K3 SP2, and you should see the proper performance monitor data on AMD chipsets with SP2 installed without the use of the /USEPMTIMER switch.

The switch /usepmtimer will prevent a lot of known issues with several AMD CPU´S, the solution is to add that switch in the boot.ini or to apply the AMD drivers that will put this switch on the boot.ini

The AMD multiprocessor driver requires this setting for things to work properly, because the default processor time stamp counter (TSC) is not synchronized properly between cores on chipsets for AMD multiprocessor boards. Using the switch forces the system to use the PM timer instead of the TSC timer, which resolves the issue.

Additional Information:-

Platforms Affected

• HP ProLiant BL465c Server series

• HP ProLiant BL685c Server series

• HP ProLiant DL145 G2 Server series

• HP ProLiant DL145 G3 Server series

• HP ProLiant DL145 Server series

• HP ProLiant DL365 Server series

• HP ProLiant DL385 G2 Server series

• HP ProLiant DL385 Packaged Cluster with MSA500G2

• HP ProLiant DL385 Server series

• HP ProLiant DL585 G2 Server series

• HP ProLiant DL585 G2 Storage Server

• HP ProLiant DL585 Server series

• HP ProLiant DL585 Storage Server

• HP ProLiant ML115 Server series

Operating Systems Affected

• Microsoft Windows Server 2003 Enterprise Edition

• Microsoft Windows Server 2003 Enterprise x64

• Microsoft Windows Server 2003 R2 Enterprise Edition

• Microsoft Windows Server 2003 R2 Standard Edition

• Microsoft Windows Server 2003 R2 Standard x64 Edition

• Microsoft Windows Server 2003 Standard Edition

• Microsoft Windows Server 2003 Standard x64

• Microsoft Windows Server 2003 Web Edition

Note: This condition is not specific to HP ProLiant servers and can occur on servers from other manufacturers.

Newer operating systems typically do not use the TSC by default if other timers are available in the system which can be used as a timekeeping source. Other available timers include the PM_Timer and the High Precision Event Timer (HPET). All HP ProLiant servers include the PM_Timer, and the latest generation of HP ProLiant servers supporting AMD Opteron 2200-series and 8200-series processors support HPET. These timers are not affected by this condition. New operating system Windows Server 2008 is not affected by this issue.

Some applications, such as SAP, require a precise clock to time stamp various events. Each processor has an individual internal clock that increments a Time Stamp Counter (TSC) which is available to any application and runs asynchronous from the TSCs in the other processors. Consequently a database application like SAP could query a TSC in one processor for a time stamp and get one answer. Subsequently the software OS scheduler could move that task to another processor and queries to that processor's TSC could result in time stamp information that is completely out of synch with the former query to the other processor.

The document from AMD in the below link also explains the above problem

http://developer.amd.com/Assets/TSC_Dual-Core_Utility.pdf

http://developer.amd.com/Pages/1214200692.aspx

Useful information to provide to Microsoft Support in case of issues with Server Performance

Roop — Thu, 06 Dec 2007 10:27:00 GMT

In case you have got issues with your Server Performance like intermittently becomming unresponsive,generating event id's like 2020,2019,2021 or you are suspecting a problem with resource depletion;then these are the set of logs an engineer from Microsoft would require to help you diagonise the problem.

MPS Reports:

http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd915706/MPSRPT_SETUPPerf.EXE

If you have any questions regarding the usage or operations of the MPS Reporting Tool please review the link below:
http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd915706/MPSRPT_SetupPerf_Readme.txt

Perfmon:

Go to the PC (without any issues). Start, Run and type "perfmon" (without quotation marks) and press OK.

- Expand Performance Logs and Alerts. Highlight Counter Logs and right click in the right pane to bring up a menu. From this menu, select "New Log Settings". Give this log a name.

- Press Add counters. Type in the the server name that we want to monitor ( Example: in the format: \\Servundefined

- Add "All counters" and "All instances" each of the following objects:

             Memory
             Network Interface
             Objects
             Paging File
             Physical Disk
             Process
             Processor
             Redirector
             Server
             Server Work Queues
             System
             Thread
         - Set the Interval for every N minutes.

N = 5 minutes – Issue happens once a day

= 10 minutes- Issue happens once a week

= 15 minutes –Issue happens one in 15 days

= 30 minutes –Issue happens once in 30 days

- Click on the Log Files tab and set Log file type to Binary Circular File and a Limit of 500,000 KB. Please make sure where the Log is currently save have enough disk space to accommodate.

- Go to the schedule tab, set the schedule for "Stop Log- Manually" and "Start Log- Manually.

Here is an article for reference: 248345 How to Create a Log Using System Monitor in Windows 2000 <<<<http://support.microsoft.com/?id=248345>>>>

Note : Logs needs to be taken till the issue occurs next time.

Poolmon

http://support.microsoft.com/kb/177415

Note:Logging needs to be done till the issue occurs next time.