Server instability
I have a Windows 2008 SP2 (not R2) server which has the terminal service role installed. Twice now this month, the server has kicked users off late at night, and services start failing (logged as event 7011- A timeout (30000 milliseconds) was reached
while waiting for a transaction response from the xxx service.).
The last time this happened, it started with event 1074. What's odd is the user who initiated the shutdown and the process which shut it down. Only, the server didn't shut down - it was hung with 7011 events all through the night until someone
was able to respond to the situation. Here is the 1074 event.
The process LogonUI.exe has initiated the shutdown of computer SEA-TS on behalf of user NT AUTHORITY\SYSTEM for the following reason: Other (Planned)
Reason Code: 0x85000000
Shutdown Type: shutdown
Comment: s
How do I begin to try to figure out what is going on here? I have since performed a restart of the server and the restart happened without issue.
December 28th, 2011 1:49pm
Hello,
I have a Windows 2008 SP2 (not R2) server which has the terminal service role installed. Twice
now this month, the server has kicked users off late at night, and services start failing (logged as event 7011- A timeout (30000 milliseconds) was reached while waiting for a transaction response from the xxx service.).
You can increase the timeout value: http://smallvoid.com/article/winnt-service-timeout.html
For the shutdown issue, check that there is no scheduled task that runs a shutdown script and that there is no application that initiated that.
This
posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft Student
Partner 2010 / 2011
Microsoft Certified
Professional
Microsoft Certified
Systems Administrator: Security
Microsoft Certified
Systems Engineer: Security
Microsoft Certified
Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft Certified
Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Microsoft Certified
Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows 7, Configuring
Microsoft
Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
Microsoft Certified
IT Professional: Enterprise Administrator
Microsoft Certified IT Professional: Server Administrator
Microsoft Certified Trainer
Free Windows Admin Tool Kit Click here and download it now
December 28th, 2011 1:54pm
I don't see any scheduled tasks set to shutdown or restart the server. I don't see that a service is set to restart the server as a recovery action.
Increasing the timeout on services sounds like it would just increase the timeout - not prevent whatever is happening from happening.
December 28th, 2011 5:49pm
Hi,
As I can see that there are someone manually shutdown the server, because there was a comment "s" for the shutdown reason. Please check out whether there was someone run a script and shutdown the server.
In addition, please scan the server using antivirus programs.
Best Regards,
Yan LiYan Li
TechNet Community Support
Free Windows Admin Tool Kit Click here and download it now
December 29th, 2011 2:11am
So you have users who have access to shutdown the server,you might want to start by correcting that...Regards zizebra http://auction.joyoustimes.net
December 29th, 2011 4:53am
I can assure you, my end users do not have access to do a shutdown. With a normal shutdown, it shows domain\user for the user who initiated the shutdown. This was performed by NT Authority\System. I don't have any scripts set to run.
This server did it again over night. So that's 3 times in the last two weeks. Only once did it give me a event 1074, shutdown event, so I think it's safe to say I can't focus on that.
What I can see, each time, event 7011 starts. The first is always "NlaSvc".
"A timeout (30000 milliseconds) was reached while waiting for a transaction response from NlaSvc service." After NlaSvc, this event is logged several times with other services: CryptSvc, Schedule, seclogon, ShellHWDetection, Symantec AntiVirus,
wuauserv, BITS, CertPropSvc, EapHost, RasMan, UmRdpService, UxSms, AudioEndpointBuilder, dot3svc, Netman. It then repeats these events numerous times until someone responds to the situation and power cycles the server. When an end user tries to
RDP to the server, they just get a "Welcome" screen and it never loads the desktop.
The first time this happend, it was shortly after 10 PM, the second was shortly after 1 AM and this time, it was after 6 AM. This randomness would also dismiss a scheduled task.
Running an AV scan right now. It does do a weekly scan, but am running a full now.
The only real issue I see with the server is the fact that it's a 32 bit server and memory gets spread thin. As soon as our core app is supported on 64 bit, I plan on building a replacement terminal server. I don't want to have to rebuild this
server with 32 bit right now! Still, this isn't happening during peak usage.
Free Windows Admin Tool Kit Click here and download it now
December 29th, 2011 11:48am
I started searching for event id 7011 and NlaSvc, and am finding a lot of people describing the same symptoms. In each case, the solution is unique. Some say it's a hotfix that fixes it, others say it's a combination of hotfix and removal of
Symantec Endpoint Protection. Most of the hits are on Citrix forums, but they are Windows issues by nature. Seems this can happen to both Server 2008 and 2008 R2, though the fixes are different for both OS's. Trouble with the MS "hotfixes"
is the file versions in the hotfixes are mostly older than what's currently on the server.
http://support.microsoft.com/kb/976674
http://support.microsoft.com/kb/980380
http://option9.blogspot.com/2010/01/windows-server-2008-freezes-finally.html
http://community.spiceworks.com/topic/76115-termdd-56-flood-of-service-timeouts-7011-brings-down-terminal-server-win2k
December 29th, 2011 1:38pm
It happened again this morning. After the server came back up, I applied two hotfixes. I'm hopeful that either one of these will correct this situation.
http://support.microsoft.com/kb/976674
http://support.microsoft.com/kb/980568
Free Windows Admin Tool Kit Click here and download it now
December 30th, 2011 12:55pm