Help .... RPC problem with Win2k servers since Blaster patch?

From: al (ask)
Date: 09/17/03

  • Next message: al: "Re: Help .... RPC problem with Win2k servers since Blaster patch?"
    Date: Wed, 17 Sep 2003 11:13:26 +0100
    
    

    Three weeks ago, I patched 8 servers (Win2k standard server) that were SP1
    to SP4 and added all the critical updates and most suggested updates
    (excluding .Net, Journal viewer and Media Player 9) and some network driver
    updates (Compaq Proliant servers). Since last Friday, there have been
    continuous problems with them.

    These 8 servers were 4 DNS servers with DHCP (just one ran WINS) and 4 print
    servers with DHCP active but scope disabled as fallback. I would also add
    that about 30 other servers were updated in the same manner (file and
    application servers mainly, but also DNS and print servers on other sites)
    and have been absolutely fine.

    What happens is they suddenly stop responding completely for about 10
    minutes and then come back up again. They have various RPC errors in their
    event logs, a sample of which is detailed at the bottom of this posting.
    Basically, it would seem RPC fails and everything that depends on it then
    logs an error too. I'm wondering if the catalyst for this failure is
    replication traffic, which would initialise an RPC transport with other
    servers?

    Has anyone else noticed this problem? It could be SP4 but is more likely a
    result of a problem with the RPC patches released for the Blaster worm. I'm
    rebuilding one of the DNS servers right now as a test, but it's going to be
    really hard for me to rebuild the others as (typically!!) this is in our
    customer care site with staff working almost 24 hours.

    Any suggestions as to what might be going on or how to fix it? I've tried
    removing all the patches but the problem still persists ...

    al

    ----------------------------------------------------------------------------
    -----------
    Event Type: Error
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7022
    Description:
    The Remote Procedure Call (RPC) service hung on starting.

    Event Type: Error
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7001
    Description:
    The Print Spooler service depends on the Remote Procedure Call (RPC) service
    which failed to start because of the following error:
    After starting, the service hung in a start-pending state.

    Event Type: Error
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7001
    Description:
    The Kerberos Key Distribution Center service depends on the Remote Procedure
    Call (RPC) service which failed to start because of the following error:
    After starting, the service hung in a start-pending state.

    Event Type: Error
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7001
    Description:
    The Distributed Transaction Coordinator service depends on the Remote
    Procedure Call (RPC) service which failed to start because of the following
    error:
    After starting, the service hung in a start-pending state.


  • Next message: al: "Re: Help .... RPC problem with Win2k servers since Blaster patch?"

    Relevant Pages

    • Help .... RPC problem with Win2k servers since Blaster patch?
      ... >servers with DHCP active but scope disabled as fallback. ... RPC errors in their ... >The Remote Procedure Call service hung on starting. ... the service hung in a start-pending state. ...
      (microsoft.public.win2000.security)
    • RE: RPC/HTTPS GC question
      ... RPC over HTTP Interactions on the Back-End Servers: ... The Microsoft Exchange Information Store service listens for incoming ...
      (microsoft.public.exchange.admin)
    • Re: The remote procedure call was cancelled.
      ... RPC needs high ports>1024. ... All the servers are connected to central HUB (four ... When we try to replicate the naming context ...
      (microsoft.public.windows.server.active_directory)
    • Re: rpc ober http problem
      ... Now it seems, that rpc over http is working, don't know ... I can read and write mail messages from my outlook client ... >don't need to expose the global catalog servers if the ...
      (microsoft.public.exchange.connectivity)
    • RPC terminated/Ntauthority Error Windows 2000/XP shuts down
      ... The original post was: ... This error typically signified a virus. ... Scroll through the list to "RPC.. ... Then run your Windows Updates and get all critical updates, ...
      (microsoft.public.security.virus)