Network Connections service hanging

[Igor Andjelic]

Hi,

We have one Compaq ProLiant ML370 G2 and one G3 server with Windows Server 2003, SE + SP1 installed (the SP was included in the installation). There are no extra Microsoft updates installed, only drivers from HP Support Pack CD. The servers are not on the same subnet nor on the same location and beside being in the same domain, they are not connected with each other.

Those two servers were normally restarted a few times during the period of several weeks. Then one day after yet another restart and after the "Windows Server 2003" screen ("Preparing network connections") they established network connection (we pinged them continually). But when the "Applying computer settings" screen appeared, they've lost it and could not regain it. Those two screens took almost 10 minutes to pass and when we finally got the desktop (the domain user was logged in because it's credentials were in cache), I opened the Services MMC and saw that the Network Connections service was in the status of starting and obviously hanging in it. The RPC service was started. After next reboot, the same thing. They only managed to have stable network connection when started in "Safe mode with networking".

While browsing through System and Application Logs I've seen many errors most of which were related to configured network connection. One entry said that the IPSec service blocked all incoming and outcoming connections so I've set the service from Automatic to Manual and on next boot-up in normal mode the server managed to keep the connectivity. But all of the errors in Logs remained.

Now I addressed Microsoft's KB825826 that is resolving invisible network connection icons and hanging of NetMan service. It is a procedure of 17 steps which did not prove helpful so I've decided to reinstall one server and now it's up and running nicely. The other server is still to be fixed.

The problem is definitely not related to any domain group policy rule and the problem appeared only on those servers (we have many servers on many locations, but those two are the only ones acting like that).

What should we do?

Thanks in advance.

[Igor Andjelic]

I fear I haven't been clear enough on one point.

Those servers are the only ones of that type on our branch locations. Elsewhere we have servers of different vendors, so I believe the problem must be vendor/model related.

[Navaneeda Kumar]

Hi,
You can verifiy the following points.
1. Install the latest Performance support Pack(PSP-contains the latteset drivers for the sever hardware ie... lan and Board,Storage etc...)
2.Pls verify that yo have all the necessary RPC patches are installed in your Server.
3.Verifiy that the Lan cable is in good and working condition
4.In services tab pls verify all the Automatic services are started. If any services is not started then clear your system event viewer and restart the server. After restarting go to the system event logs and verify what is the first error event log. Then find out what is the dependancies services for that.

i hope this will help you in final conclusion.

Thanks,
Navaneet

[Igor Andjelic]

Thank You very much for replying.

To answer Your questions:

1. PSP installed is of version 7.30 A. I see that the latest release is 7.51 A, so I'll download it and install it on server next week (when I'm on location). I'll update the firmware with the CD version 7.50 (the last time I updated it with the CD version 7.20).

2. What do You mean by "RPC patches"? Standard Windows patches or something related to Remote Procedure Call?

3. Ofcourse the LAN cable is firmly in its UTP position both in server and in switch.

4. I'll verify that all of them are started after I upgrade the system. But I must say that I didn't get confused with the old error entries in logs. I know when I see the message that Event Log System has entered the started state, this is the moment it has began looging again after the boot-up and all of the relevant entries are with timestamps later than that.

[Rune J. Winje]

Have a look at this blog

http://www.itwriting.com/blog/?postid=212

And do let us know if any of the suggestions fixes it.

Cheers,
Rune

[Rune J. Winje]

Particularly the suggestion to change the RPC service account from "Network Service" to "Localsystem" seems successful in a couple of cases I know of.

The theory being that perhaps some policy or security fix has blocked the "Network Service" account from doing it's job...


Cheers,
Rune

[Igor Andjelic]

Hi and thanks for replying.

Yes, it seems that that could help, indeed. Unfortunately, I didn't check that the last time and I needed to reinstall the servers since we couldn't wait any longer. In the mean time, I got into some testing with the same software environment, but on virtual servers and got some interesting results.

The first physical server in production wasn't a DC and had the problem. The other server was promoted and had the same problem. I recreated the scenario on two different virtual servers (MS & VMw), i.e. promoted them and installed one third-party application. After DCPromo and two restarts, those VS's had the same network issue.

It seems to me that we've experienced addressed problem only the first time and, perhaps, could have resolved it as described. The second time, I fear, the reason was somewhat different.

Anyway, very useful information for the future.

I thank everyone for participating in the resolution of this problem.

Bye.