We experienced a strange behavior on some 2003 r2 ent 32bit web servers (IIS): sometimes (till now 5 times in 4 month) these machines hang. Ping replays, telnet to open ports works but RDP and web services doesn't. In KVM the pointer is present and when the CRTL ALT DEL are pressed nothing happen... so the only action is to press for 5" the power botton. EventViewer stop logging and the last event is a perl batch (5.8.8) that doesn't close completely. This batch works from 2 years every 5 minutes.. so it seems very strange.. My questions: 1. HOW TO LOG THIS ISSUE? 2. Anyone experienced this? 3. How to solve? THX!

Hi Lyo11, In a straight way , it is not possible to log this behavior. The reason is its intermittent. Technical analysis: When you login to windows , you would use GINA to enter the user name and the password, and uses existing user access token to login to the console. . So one option i could think is to remotely launch the process explorer and then perform ctrl+alt+del ( this you need to perform every time you login so that you would be able to see the applications running on the server ) Other option is to run the server without any 3rd paryt applications , u can use msconfig to disable all the 3rd party applicaitons services ( this is only to test the system behavior ) From my debugging experience i could say that some of the 3rd party applicaitons are not launching the shell / explorer.exe.

Have you tried logging system usage; eg, cpu, memory, disk, etc, to see what is happening to system resources when this event occurs? jav