I have a server with an unresponsive console (but otherwise seems to be operating) running Server 2003 32-bit. Ctl-Al-Del doesn't work and logon window is frozen. I can connect remotely, but only get a blank desktop screen (no login or desktop or menu). I would like to restart this machine as cleanly as possible, as it is a file server and (as a side effect of this) I am not sure I am getting any good backups. In this case, I really need to find a better way to recover operation of this server besides just power-cycling it. What I have tried is shutdown command: shutdown /s /f /m \\172.16.16.1 , which tells me that it has successful completed (if I try it a second time, it returns an error that the another shutdown command has been queued). However, the server does not shut down. I've also tried to kil Explorer on that server, but that doesn't seem to "take" either The other error I see in the system event log is many occurrences of this:Event Type: ErrorEvent Source: SrvEvent Category: NoneEvent ID: 2000Date: 2/1/2010Time: 11:39:36 AMUser: N/AComputer: WTW-FILEDescription:The server's call to a system service failed unexpectedly.I would appreciate any suggestions on how to regain control of this server.James A. Helfer | COMPUTER SYSTEMS ADMINISTRATOR WTW ARCHITECTS | PITTSBURGH PA

I've had this issue before in my datacenter. The unfortunate truth is that its stuck in a loop and you will end up powercyleing it. I did hours of research on that same error. I found the root cause for me was I ended up having a bad drive in the Raid. To save yourself the trouble it may be worth the power cycle and then you will be able to go over the system logs a bit more to see if you can pull more data from the server.

Since whatever process has goen screwy also is prevening a backup, I'm reluctant to just bounce a server that does not have a recent backup. However, unless I can find the offender and free up the process, I will have to do just that.James A. Helfer | COMPUTER SYSTEMS ADMINISTRATOR WTW ARCHITECTS | PITTSBURGH PA

Hello Jim, Can you please check if there is Symantec Notification Server installed on this problematic server? If so, the third party applicaition may cause this performance decrease issue. To resolve this problem, please contact Symantec for more help. Here is the more detail description: Performance may decrease on a server that is running the 64-bit edition of Windows Server 2003 and that has Symantec Notification Server 6.0 installed http://support.microsoft.com/kb/951031 Meanwhile , you can consider booting the problematic system with clean boot to check if the issue still exists. Steps to clean boot: 1. Click Start->Run...-> type msconfig and press Enter 2. Click Services tab and select Hide All Microsoft Services and Disable All third party Services. 3. Click Startup tab and Disable All startup items 4. Click OK and choose Restart 5. After reboot, check whether the problem still occurs You may check in the Task Manager to see which process takes the memory resources. For example, if the SVCHOST takes the memory in climbing, you need to check which services are running with that SVCHOST process. For other processes such as explorer.exe, iexplorer.exe, you need to check which DLL files are launched by the processes. If the process is a service, you can use these steps to find out what applications are using most of the memory: Open Task Manager, click on the Processes tab, look for the process that is using the memory and note its' PID (Process ID). Please note that you may need to go to the View/Select Columns menu and make sure that PID (Process Identifier) is checked. Once you have the PID run the following from a command prompt: tasklist /svc This should give you the application associated with the PID you identified in the previous step. With the previous steps, you can locate which service or application causes system hang issue. If you want to know the root cause of the issue, we need to analyze the performance log and crash dump file. Since the forum is not the best channel to troubleshoot this issue, I would suggest that you contact Microsoft Customer Support service to troubleshoot this issue efficiently. They are the best resource for this kind of issues. You may obtain the phone numbers for specific technology request please take a look at the web site listed below: https://support.microsoft.com/common/international.aspx?iid=174859&iguid=56907522-6886-4238-a70f-a1d06a4473c7_2_2&rdpath=1 Hope the issue will be resolved soon. This posting is provided "AS IS" with no warranties, and confers no rights.

Thanks, but while I do have a Symantec endpoint protection client running on this machine, I do not think I have notification server running on it. In any event, as the console is unresponsive, and I cannot connet with Remote Desktop, I cannot run taskmanager or msconfig or any gui commands, but am limited to cli commands that I can execute remotely on the server.James A. Helfer | COMPUTER SYSTEMS ADMINISTRATOR WTW ARCHITECTS | PITTSBURGH PA

I tried killing various tasks to see if I could get back control, but absent some way to tell what the problem process was, I ended up cold-booting the machine. :-( James A. Helfer | COMPUTER SYSTEMS ADMINISTRATOR WTW ARCHITECTS | PITTSBURGH PA

Yes its never the way we want to do it i've had to do that as well when dealing with symantec products. Actualy due to our large network size we are now looking into forefront as a solution not to say its better but we are having more luck testing it and manageing it than with the symantec issue.One other problem to watch out for. The def files for SEP and the manager broke when the year went to 2010 so they are working on if not have fixed yet the date showing 12/31/09 with a new revision number every day. This is fine however we intigrate our juniper vpn to verify the defs are within the last 30 days. We had to disable this additional check to keep people allowed to work in vpn. Just an FYI for you on this.