dsrestor post SP1

Installed SP1 about a week ago on a server that previous to the install was
trouble free. Since SP1 the Server simply quits functioning. Screen goes
black and Exchange disconnects from clients. All that can be done is hold the
power button in until the server shutdowns and then power it back on.

There is nothing in the event logs to indicate the cause of the freeze, but
after restarting a startup error can be found in the event application log
- Event ID 1005 "dsrestor" The DSRestore filter failed to connect to local
SAM server. Error returned is <id 997>. If you click on the link in the event
window it takes you nowhere. Typical Microsoft "Page cannot be displayed".
The file the error points to in the info. you can choose to send to Microsoft
is DSREvt.dll version 5.2.3790.0. I have looked everywhere for information,
clues whatever, without success. Anybody out there have any insight? Could
this be the cause of the freeze and if so is there a workaround or solution?
The freeze follows no pattern. The times of day are random and it happens
about once every 36 – 40 hours.

Thank You
JLS

I just looked this error up today on www.eventid.net

"From a newsgroup post: "DSRestore's job is to synchronize the domain admin
password with the dsrm password. The dsrestore process will run every 30
minutes to verify that the passwords are coordinated. If they are not,
dsretore will synchronize them. The 1005 error indicates that dsrestore was
unable to connect to the SAM and verify if the passwords are coordinated when
the server boots. My guess is that it fails at boot due to a race condition.
If the process fails, it does not run again until the server is rebooted. As
a workaround, you can manually reset the DSRM password to match the domain
admin password by using ntdsutil. See Q322672 for information on how to reset
the Directory Services Restore Mode administrator account".
--
Jonathan Filson
KKI Technologies
Small Business Specialist


"JLS" wrote:

> Installed SP1 about a week ago on a server that previous to the install was
> trouble free. Since SP1 the Server simply quits functioning. Screen goes
> black and Exchange disconnects from clients. All that can be done is hold the
> power button in until the server shutdowns and then power it back on.
>
> There is nothing in the event logs to indicate the cause of the freeze, but
> after restarting a startup error can be found in the event application log
> - Event ID 1005 "dsrestor" The DSRestore filter failed to connect to local
> SAM server. Error returned is <id 997>. If you click on the link in the event
> window it takes you nowhere. Typical Microsoft "Page cannot be displayed".
> The file the error points to in the info. you can choose to send to Microsoft
> is DSREvt.dll version 5.2.3790.0. I have looked everywhere for information,
> clues whatever, without success. Anybody out there have any insight? Could
> this be the cause of the freeze and if so is there a workaround or solution?
> The freeze follows no pattern. The times of day are random and it happens
> about once every 36 – 40 hours.
>
> Thank You
> JLS
>

Thanks for the quick reply. As I was scrolling through some posts I found the
dsrestor as a known issue post SP1 and it has nothing to do with my freeze
problem. Server goes black, stays running but all services are unreachable.
Only way out is to hard boot. This is new since SP1. Previously this server
had no issues. It is not heat, power supply, memory, disk space or UPS. The
only thing I can think of is it might be Trend Micro. The only reason i
mentioned this is I have seen more than a few references to Trend Micro
problems post SP1. I am going to uninstall and re-install to see if this
stops the phantom freeze and will post back my findings. However, if anybody
else has any insight, all thought appreciated. I am going to repost this
problem under a different title. Thanks Again
JLS

"KKI Technologies" wrote:

> I just looked this error up today on www.eventid.net
>
> "From a newsgroup post: "DSRestore's job is to synchronize the domain admin
> password with the dsrm password. The dsrestore process will run every 30
> minutes to verify that the passwords are coordinated. If they are not,
> dsretore will synchronize them. The 1005 error indicates that dsrestore was
> unable to connect to the SAM and verify if the passwords are coordinated when
> the server boots. My guess is that it fails at boot due to a race condition.
> If the process fails, it does not run again until the server is rebooted. As
> a workaround, you can manually reset the DSRM password to match the domain
> admin password by using ntdsutil. See Q322672 for information on how to reset
> the Directory Services Restore Mode administrator account".
> --
> Jonathan Filson
> KKI Technologies
> Small Business Specialist
>
>
> "JLS" wrote:
>
> > Installed SP1 about a week ago on a server that previous to the install was
> > trouble free. Since SP1 the Server simply quits functioning. Screen goes
> > black and Exchange disconnects from clients. All that can be done is hold the
> > power button in until the server shutdowns and then power it back on.
> >
> > There is nothing in the event logs to indicate the cause of the freeze, but
> > after restarting a startup error can be found in the event application log
> > - Event ID 1005 "dsrestor" The DSRestore filter failed to connect to local
> > SAM server. Error returned is <id 997>. If you click on the link in the event
> > window it takes you nowhere. Typical Microsoft "Page cannot be displayed".
> > The file the error points to in the info. you can choose to send to Microsoft
> > is DSREvt.dll version 5.2.3790.0. I have looked everywhere for information,
> > clues whatever, without success. Anybody out there have any insight? Could
> > this be the cause of the freeze and if so is there a workaround or solution?
> > The freeze follows no pattern. The times of day are random and it happens
> > about once every 36 – 40 hours.
> >
> > Thank You
> > JLS
> >

Dsrestror has nothing to do with these errors you are seeing.

What else is in the log files and call PSS on this. Issues with a
Service pack install are a free call.

JLS wrote:

>Installed SP1 about a week ago on a server that previous to the install was
>trouble free. Since SP1 the Server simply quits functioning. Screen goes
>black and Exchange disconnects from clients. All that can be done is hold the
>power button in until the server shutdowns and then power it back on.
>
>There is nothing in the event logs to indicate the cause of the freeze, but
>after restarting a startup error can be found in the event application log
>- Event ID 1005 "dsrestor" The DSRestore filter failed to connect to local
>SAM server. Error returned is <id 997>. If you click on the link in the event
>window it takes you nowhere. Typical Microsoft "Page cannot be displayed".
>The file the error points to in the info. you can choose to send to Microsoft
>is DSREvt.dll version 5.2.3790.0. I have looked everywhere for information,
>clues whatever, without success. Anybody out there have any insight? Could
>this be the cause of the freeze and if so is there a workaround or solution?
>The freeze follows no pattern. The times of day are random and it happens
>about once every 36 – 40 hours.
>
>Thank You
>JLS
>
>
>

If you are running APC software version 6 you need to upgrade to version 7

--
Frank McCallister SBS MVP
COMPUMAC
"JLS" <> wrote in message
news:8842B691-92C8-4F13-9BC3-...
> Installed SP1 about a week ago on a server that previous to the install
> was
> trouble free. Since SP1 the Server simply quits functioning. Screen goes
> black and Exchange disconnects from clients. All that can be done is hold
> the
> power button in until the server shutdowns and then power it back on.
>
> There is nothing in the event logs to indicate the cause of the freeze,
> but
> after restarting a startup error can be found in the event application
> log
> - Event ID 1005 "dsrestor" The DSRestore filter failed to connect to local
> SAM server. Error returned is <id 997>. If you click on the link in the
> event
> window it takes you nowhere. Typical Microsoft "Page cannot be displayed".
> The file the error points to in the info. you can choose to send to
> Microsoft
> is DSREvt.dll version 5.2.3790.0. I have looked everywhere for
> information,
> clues whatever, without success. Anybody out there have any insight? Could
> this be the cause of the freeze and if so is there a workaround or
> solution?
> The freeze follows no pattern. The times of day are random and it happens
> about once every 36 - 40 hours.
>
> Thank You
> JLS
>

I suspect it is Trend Micro SMB causing this Server to intermittently freeze
post SP1, but I do not have enough information yet to form a conclusion. The
Event logs are clean. No events to indicate why the Server quits providing
services and freeze. It is not a heat or Power issue. I do not use UPS
software for a number of reasons, so it is not UPS. I just have a gut feeling
that it is Scanmail for Exchange that is hanging this server. I have removed
Trend Micro from the server. Rebooted and run a health check on all services
– OK. Reinstalled Trend SMB Client\Server\Messaging Suite and reinstalled
Scanmail for Exchange and rebooted. Event logs are clean, except for
dsrestor, which after reading around, I can essentially ignore. I will run
the server over the weekend, see what happens and post my results on Monday.
Since SP1 the Server has not had an uptime of more than 36 hours, so Monday
should be a good preliminary test. Thanks

JLS


"Frank McCallister SBS MVP" wrote:

> If you are running APC software version 6 you need to upgrade to version 7
>
> --
> Frank McCallister SBS MVP
> COMPUMAC
> "JLS" <> wrote in message
> news:8842B691-92C8-4F13-9BC3-...
> > Installed SP1 about a week ago on a server that previous to the install
> > was
> > trouble free. Since SP1 the Server simply quits functioning. Screen goes
> > black and Exchange disconnects from clients. All that can be done is hold
> > the
> > power button in until the server shutdowns and then power it back on.
> >
> > There is nothing in the event logs to indicate the cause of the freeze,
> > but
> > after restarting a startup error can be found in the event application
> > log
> > - Event ID 1005 "dsrestor" The DSRestore filter failed to connect to local
> > SAM server. Error returned is <id 997>. If you click on the link in the
> > event
> > window it takes you nowhere. Typical Microsoft "Page cannot be displayed".
> > The file the error points to in the info. you can choose to send to
> > Microsoft
> > is DSREvt.dll version 5.2.3790.0. I have looked everywhere for
> > information,
> > clues whatever, without success. Anybody out there have any insight? Could
> > this be the cause of the freeze and if so is there a workaround or
> > solution?
> > The freeze follows no pattern. The times of day are random and it happens
> > about once every 36 - 40 hours.
> >
> > Thank You
> > JLS
> >
>
>
>

The server in question, Compaq ML350 was a clean install of SBS 2003 back in
2004. Virus protection on the server was Trend Micro SMB Client, Server,
Messaging Suite 6 for Exchange. All Trend Micro Services were stopped,
disabled and the server was rebooted before applying the full 5 part Service
Pack. After the SP1 installation was completed, Trend Micro Services were
re-enabled and the Server was rebooted.

Afterwards the Server would simply stop providing services and the screen
would go black. Attempts to connect or shutdown the server remotely were
unsuccessful. Server was shutdown manually by punching the power on the
server.

Completely removed and reinstalled Trend Micro, several reboots. Reconnected
all Trend Micro clients. Previous to this procedure the Server did not have
an uptime of more than 36 hours. So far the Server has been running for 51
hours without incident. Is this conclusive? Maybe.

Over the weekend I did perform a test run with 2 other servers and these are
my observations.

2 Compaq ML350 servers, virtually identical to the problem server,
originally with clean installs of SBS 2003 about 8 months ago. Both Servers
were running the same Trend Micro SMB Messaging Suite.

On Server 1 I disabled all Trend Micro Services, rebooted and performed the
full 5 part SP1 install.

On Server 2 I uninstalled the complete Trend Micro Software suite, several
reboots, and then performed the full 5 part SP1 install.

After the install Server 1 seemed fine but Trend Micro was not performing as
before the install. A check of status showed that not all services were quite
running as expected. It is hard to explain, but it was just not right.
Reconnecting the clients showed that privileges had changed on some and not
on others.

On Server 2, the service pack install finished without incident, other than
having to delete the GUID from the registry, HKEY_LOCAL_MACHINE/ SOFTWARE/
MICROSOFT/ MICROSOFT SQL SERVER/ SHAREPOINT/ SQLSERVERAGENT� to allow the
Sqlagent$SBSMONITORING and Sqlagent$SHAREPOINT services to start. I have had
to do this on about half of the SP1 installs. Reinstalled Trend Micro with
Scanmail for Exchange and all clients were reconnected to Trend Micro and all
seems to be working as expected.

Event logs on both Servers were uneventful. On one I got the dsrestr (Server
1) error, but not on Server 2.

As on the original problem Server and Server 1, I have completely removed
and re-installed Trend Micro and so far all seems to be working without any
incidents or errors on both Servers. On Server 2 there have been no further
issues and all 3 have been running throughout the weekend.

If I can offer this conclusion based on this small test scenario, I would
suggest that disabling Trend Micro Client\Server\Messaging Suite is not
sufficient. I might suggest to all preparing to upgrade to SP1 that they
completely uninstall their Trend Micro products prior to the upgrade and then
re-install post SP1 and reconnect the clients to the Server. Reconnecting
each client takes about 1 minute per client. If the original Server from this
post gives me any further problems, I will post the problem at that time.

So far, since removing and reinstalling Trend Micro on the original problem
Server, the server has been up for over 50 hours. A significant improvement
over the previous uptimes post SP1.

Thank You

JLS

"JLS" wrote:

> I suspect it is Trend Micro SMB causing this Server to intermittently freeze
> post SP1, but I do not have enough information yet to form a conclusion. The
> Event logs are clean. No events to indicate why the Server quits providing
> services and freeze. It is not a heat or Power issue. I do not use UPS
> software for a number of reasons, so it is not UPS. I just have a gut feeling
> that it is Scanmail for Exchange that is hanging this server. I have removed
> Trend Micro from the server. Rebooted and run a health check on all services
> – OK. Reinstalled Trend SMB Client\Server\Messaging Suite and reinstalled
> Scanmail for Exchange and rebooted. Event logs are clean, except for
> dsrestor, which after reading around, I can essentially ignore. I will run
> the server over the weekend, see what happens and post my results on Monday.
> Since SP1 the Server has not had an uptime of more than 36 hours, so Monday
> should be a good preliminary test. Thanks
>
> JLS
>
>
> "Frank McCallister SBS MVP" wrote:
>
> > If you are running APC software version 6 you need to upgrade to version 7
> >
> > --
> > Frank McCallister SBS MVP
> > COMPUMAC
> > "JLS" <> wrote in message
> > news:8842B691-92C8-4F13-9BC3-...
> > > Installed SP1 about a week ago on a server that previous to the install
> > > was
> > > trouble free. Since SP1 the Server simply quits functioning. Screen goes
> > > black and Exchange disconnects from clients. All that can be done is hold
> > > the
> > > power button in until the server shutdowns and then power it back on.
> > >
> > > There is nothing in the event logs to indicate the cause of the freeze,
> > > but
> > > after restarting a startup error can be found in the event application
> > > log
> > > - Event ID 1005 "dsrestor" The DSRestore filter failed to connect to local
> > > SAM server. Error returned is <id 997>. If you click on the link in the
> > > event
> > > window it takes you nowhere. Typical Microsoft "Page cannot be displayed".
> > > The file the error points to in the info. you can choose to send to
> > > Microsoft
> > > is DSREvt.dll version 5.2.3790.0. I have looked everywhere for
> > > information,
> > > clues whatever, without success. Anybody out there have any insight? Could
> > > this be the cause of the freeze and if so is there a workaround or
> > > solution?
> > > The freeze follows no pattern. The times of day are random and it happens
> > > about once every 36 - 40 hours.
> > >
> > > Thank You
> > > JLS
> > >
> >
> >
> >