Windows Server

Warren J. Hairston · Guest

We just upgraded our SBS 2003 Premium server to SP1. Everything seemed to go
smoothly, including the ISA 2004 upgrade.

However, now I can't logon to the server from any of the workstations as
Administrator. The system hangs at the "Applying your personal settings"
screen for appx. 20 to 30 minutes!!! When it finally gets past this point,
all you see on the desktop is the wallpaper. Pressing CTRL-ALT-DEL
eventually allows you to get to Task Manager, etc. so individual apps can be
browsed/run, but the desktop, taskbar, etc. never appears. Examining the
Event Viewer shows a few Error 40960 and 40961 issues, as if the server
isn't there or can't authenticate the client.

The weird thing is: all other user accounts can login normally from the
workstations (no errors in Event Viewer, no slowdown, etc.). It's only the
Administrator account that has this problem - and it has this problem from
every workstation I've tried. Everything (including the Administrator login)
worked fine prior to the upgrade.

Thanks in advance to anyone who can shed some light on this problem!

Russ Grover · Guest

Sounds like the Administrator Profile is Corrupt?
(But on all PC's?)
Sounds like there's something in the startup of the Admin that's locking
it..

Now when this happens on a Client login I saw there were something in the
Startup
(msconfig) that was messing things up.
Example in the case I found last week that did this same error on a XP Pro
it was two Virus programs trying to startup.
I removed one and it worked.

RE Reading everything you said I was wondering about the ISA Client Didn't
update?
I wonder if that's messing things up?

Anyone?

--
Russ Grover
Small Business IT Support
Portland\Beaverton OR USA
Email: Sales at SmallBusinessITSupport.com
Website: www.SmallBusinessITSupport.com

"Warren J. Hairston" <whairston@logicaloperators.com> wrote in message
news:%23DofFd92FHA.3020@TK2MSFTNGP15.phx.gbl...

Jenny wu [MSFT] · Guest

Hi Warren,

Thank you for posting here! Also thanks for Russ's input.

I am sorry for the delayed response due to weekend. Please understand that
the newsgroups are staffed weekdays by Microsoft Support professionals to
answer your systems and applications questions. Your understanding is
greatly appreciated!

From your problem description, I understand this issue to be:

1. The system hangs at the "Applying your personal settings" screen for
appx. 20 to 30 minutes when the customer tries to logon to the SBS server
box using Administrator account from any client computers.

2. When it finally gets past this point, all you see on the desktop is the
wallpaper. Pressing CTRL-ALT-DEL eventually allows you to get to Task
Manager, etc. so individual apps can be browsed/run, but the desktop,
taskbar, etc. never appears.

If I am off base, please do not hesitate to let me know.

There are various possible causes that could cause this issue. To
troubleshoot it, I would suggest you to go through the following
suggestions.

I. Go though the CEICW wizard to confirm the network configurations on the
SBS server and workstation.

825763 How to configure Internet access in Windows Small Business Server
2003
http://support.microsoft.com/?id=825763

The DHCP service will be configured automatically after you run CEICW. For
you have installed 2 NIC on the SBS server, the default scope option of
DHCP service is as followings after running CEICW.

003 Router SBS internal NIC IP
006 DNS Servers SBS internal NIC IP
015 DNS Domain Name Your Domain Name
044 WINS/NBNS Servers SBS internal NIC IP
046 WINS/NBT Node Type 0x8

In addition, you could check the following settings to confirm network
configuration.

On SBS server:

External NIC:
IP: assigned by your ISP or your hardware router
Gateway: your ISP or your Hardware router IP
DNS: SBS INTERNAL NIC IP as the only entry

Internal NIC:
IP: Fixed IP
Gateway: None
DNS: SBS INTERNAL NIC IP as the only entry

In the DNS console (dnsmgmt.msc), right click your ServerName and click
properties. In the Forwarders tab, your ISP DNS server IP should be
inputted there.

On workstation:

IP: Assigned by DHCP on SBS
Gateway: SBS internal NIC IP
DNS: SBS INTERNAL NIC IP as the only entry

II. Let''s open a command prompt and run the following commands to stop and
restart w32time service:

*****net stop w32time
*****net start w32time

Also check if you have a hardware router/firewall in front of your SBS
server, if so, please open Registry Editor (regedit), go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type
, change the value from whatever to Nt5DS and restart the W32Time service.

Maue sure the service''s startup type is set to automatic.

A. Check if workstations is syncing time with the SBS 2003 server and if
not, run the following command:
net time /setsntp:<SBS_Server_Name>
NOTE: Replace <SBS_Server_Name> with the real server name of the SBS 2003
server.
After doing the above steps, reboot the client workstations and then try to
logon the server box. Then try to test, how about the result?

III. What is the Service Pack of your Windows XP client workstation? There
is a known issue with the same symptom and the hotfix is included in the
Windows XP SP2. I would suggest you to install the last service pack on
your client workstation and update them to date. More information for this
issue:

329457 Computer Seems to Hang When You Log On
http://support.microsoft.com/?id=329457

IV. Please try to add the string "DNS" to the key "DependOnService" (place
it under LanmanServer) under registry key Netlogon, you can find it in:

"\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon"

V. Do you have any third-party anti-virus or firewall program installed on
client workstations or on the server box? What if you disable/uninstall
them?

VI. Please try to logon the server box under ''Safe Mode with Networking''
startup, how about the result?

VII. Please try to create a new domain admin user account using Add User
Wizard ( Server Management console -> Users) to test, how about the result?

VIII. When you logon to the server box locally using the Administrator
account, how long time it takes to apply your personal settings?

If the issue persists, please kindly help me collect some information for
further analyze the issue:

1. Please give me group policy report by run command: " gpresult /v >
c:\gpresult.txt " (no quotation marks) in command prompt respectively on
the server box and the problematic client computer when you reproduced the
issue. And then send me the gpresult.txt file.

2. Please send me an Userenv log when the Administrator try to logon to the
server box

221833 How to enable user environment debug logging in retail builds of
Windows
http://support.microsoft.com/?id=221833

Please add all files to a zip file and send to v-yanniw@microsoft.com

If you have any questions or concerns related to this issue, please let me
know.

I appreciate your time and look forward to hearing from you.

Have a nice day!

Sincerely,

Jenny Wu
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

Jenny wu [MSFT] · Guest

Hi Warren,

Thanks for your update by mail! I appreciate your time to perform test and
collect information. And if you have any unclear about my previous post
content please let me know. I am happy to be further assistance of you!

Have a nice weekend!

Sincerely,

Jenny Wu
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

The partner mail content:
=======================
Thanks for the follow up, Jenny. I'm scheduled to visit that office later
today - I'll try to gather the information you asked for and will let you
know something by the end of the week.

Thanks again for your assistance
- Warren
=======================

--------------------

Warren J. Hairston · Guest

Hi Jenny,

Thanks for your followup. Your understanding of my problem is correct. I
would like to amend the description. It appears that the desktop, start
button, taskbar, etc. WILL eventually appear (after about another 20-30
minutes) - evidently I just wasn't waiting long enough after the "applying
your personal settings" message finally disappeared. Once I'm logged in as
Administrator and have a desktop, it appears that I can't reliably access
anything on the server. Browsing through My Network Places/Entire Network to
the server results in timeout errors. When I shut down the workstation from
this state, synchronizations to the server fail by timing out. So it appears
that I am actually unable to login to the server as Administrator and that I
am just eventually getting logged in locally to the workstation. Of course,
if I login as a regular user from the same workstation, things work
normally.

I tried all of your previous suggestions and had the following results:
I. The CEICW wizard shows the correct settings are in place. These settings
have not changed in months, and are the same settings that were on the
server prior to the SBS 2003 SP1 installation. I also confirmed the DHCP and
network settings (via IPCONFIG) and they were correct as well. The DNS
settings are also correct. On the workstation, the network settings are
correct as well.
II. I started and stopped the Windows Time service as requested - no effect.
There is no hardware router/firewall between the workstations and the server
(just a switch), so I did not change the registry entry you specified. The
Windows Time service is set to Automatic startup and the workstations are
syncing time with the server.
III. All workstations on this network are already running Win XP SP2. I try
to keep the latest patches applied on a regular basis. In fact, it was when
I tried to apply the October patches to these workstations by logging in as
Administrator that I first noticed the problem.
IV. I added the DNS string to the server registry value you specified - no
effect.
V. We are running Symantec AntiVirus Corporate Edition v10 on the server and
workstations. Disabling this software on the server and the testing
workstation had no effect. This package was installed prior to the SP1
update and before the problem began.
VI. I attempted to logon to the server from a workstation using "Safe Mode
with Networking" - same result.
VII. Newly created users can successfully logon to the server. The problem
appears to be with the Administrator account only.
VIII. Logging on to the server locally, it takes only a few seconds to apply
personal settings.

I ran the group policy reports you requested on both the server and
workstation and will send them via a separate direct e-mail. I also included
userenv.log reports from both the server and workstation.

At this point, my users are able to work as always. I have had a few
complaints since installing SP1 from users who say that when they first
logon, they get a message in the system tray telling them that the server is
offline, but after a few minutes, that balloon/icon goes away. I have
another user accessing remotely via VPN connection who tells me that his
copy of Outlook 2003 now takes approximately 10 minutes to first connect to
the Exchange Server running on this box, but once it is connected it runs at
normal speed. Not sure if any of this is related, but it all started
happening at the same time when SP1 was installed on SBS.

Thanks again for any help you can provide!
- Warren

""Jenny wu [MSFT]"" <v-yanniw@online.microsoft.com> wrote in message
news:uKDntfO4FHA.2904@TK2MSFTNGXA01.phx.gbl...

Jenny wu [MSFT] · Guest

Hi,

Thanks for your detail information! I appreciate your time to perform test
and collect information.

I am sorry for the delayed response due to weekend. Please understand that
the newsgroups are staffed weekdays by Microsoft Support professionals to
answer your systems and applications questions. Your understanding is
greatly appreciated!

Let"s perform some tests to try to trouble shoot the issue:

I. For the issue happens on the specific user account, you can try to
refresh the user account permissions to see if any thing works well now.

To refresh user account permissions:
a. Start Server Management console -> Users
b. Click the user account and then click Change User Permissions link to
refresh the user account permissions.

And then use the user account to test, how about the result?

II. If the issue persists, please double check if the user account can not
remote access the SBS server box from any client computers. If the issue
happen only in some specific computer, the issue may caused by the user
profile corrupt. You can do as follows to try to resolve the issue:

a. Login the client computer as local Administrator and copy the domain
Administrator user account profile (C:\Documents and Settings\DomainUserID
(Everything except ntuser.dat)) to another location, then delete the folder.
b. Re-logon the client computer with the domain Administrator user account
and then copy those profiles to the new created user profile.
c. Please try to test the issue to see if the issue be fixed.

III. Have you applied the security update MS05-019 to the SBS 2003 SP1 box?
if not, please refer to the following KB article to get detail information:

898060 Installing security update MS05-019 or Windows Server 2003 Service
Pack
http://support.microsoft.com/?id=898060

IV. Enable the "Network access: Do not allow storage of credentials or .NET
Passports for network authentication" security setting by opening the
appropriate policy (by default, this policy is disabled in local group
policy) and expanding the console tree: Computer Configuration\Windows
Settings\Security Settings\Local Policies\Security Options. Reboot the
computer.

Or, following Registry value removes the "Remember My Password" option from
all prompts for authentication:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa Value Name:
disabledomaincreds

Value Type: REG_DWORD
Values: 0 = allow domain credentials to be stored
1 = do not store domain credentials

Set the disabledomaincreds value to "0" to restore the "Remember My
Password" checkbox on the prompt for authentication.

Try to test, how about the result?

V. If the issue persists, please try to reset Default Domain Policy and
Default Domain Controller Policy to see if the issue be fixed.

Have you make a backup of the Default Domain Policy and Default Domain
Controller Policy? If yes, please try to restore it to test.

If the issue persists, please help me collect more information for further
analyze the issue:

1. Could you find any related error event in the event viewer of the server
and the problematic computer? If yes, please tell me the detail error
message or save a copy of the System /Application log for analyze:

To save a text copy of the security log:

A. Open Event Viewer: Start -> All Programs -> Administrative Tools ->
Event Viewer.
B. Right-click on Security log and select "Save Log File As?".

2. Please send the SystemRoot\debug\netlogon.log and
SystemRoot\debug\netlogon.bak to me.

Please add all files to a zip file and mail me at my mailbox:
v-yanniw@microsoft.com

I appreciate your time and patience to the issue. I am glad to be further
assistance!

Have a nice day!

Sincerely,

Jenny Wu
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

Jenny wu [MSFT] · Guest

Hi,

Based on log information, the issue may be related to the corrupt DNS cache
in client system or the incorrect date/time. To resolve the issue, let us
perform the following steps:

I. Please double check the time on the workstation. Ensure that the day,
time, Time zone, AM/PM, Year are correct.

Then, please perform the following steps on the client:

1. Click Start => Run, type CMD and click OK.
2. Type the following commands and press Enter after each line.

ipconfig /flushdns
ipconfig /registerdns

II. Refresh the time service to synchronize time with time server.

The w32time service problem may prevent client from properly accessing your
domain resources. Please try to start the Windows Time service (w32time)
and see if the issue can be resolved.

A. Let''s open a command prompt and run the following commands to stop and
restart w32time service:

*****net stop w32time
*****net start w32time

Also check if you have a hardware router/firewall in front of your SBS
server, if so, please open Registry Editor (regedit), go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type
, change the value from whatever to Nt5DS and restart the W32Time service.

Maue sure the service''s startup type is set to automatic.

A. Check if the workstation is syncing time with the SBS 2003 server and if
not, run the following command:
net time /setsntp:<SBS_Server_Name>
NOTE: Replace <SBS_Server_Name> with the real server name of the SBS 2003
server.
After doing the above steps, reboot client workstations and then try to
logon the domain. Then try to test, how about the result?

For more info:
816042 How to configure the Windows Time service on a Windows Server
2003-based
http://support.microsoft.com/?id=816042

III. The issue may be related to the user roaming profile, please check if
you configured roaming profiles on the user account. If so, please disable
the roaming profile for the user account and test the issue again.

I am happy to be assistance of you and look forward to your reply!

Have a nice day!

Sincerely,

Jenny Wu
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------