Discussion in 'Server Networking' started by Mark, Jun 10, 2009.

  1. Mark

    Mark Guest

    Our Windows 2008 Terminal Server suffers from an NLASVC timeout error. The
    event ID is 7011. What's important is once the error occurs, the server
    must be restarted to resume operation. The timeout occurs once every 8 to
    12 hours. The actual error is below. The server is running all of the
    latest patches, including SP2. Can NLASVC be disabled?

    Log Name: System
    Source: Service Control Manager
    Date: 6/10/2009 3:24:11 PM
    Event ID: 7011
    Task Category: None
    Level: Error
    Keywords: Classic
    User: N/A
    Computer: KAVSAPP01.knopf.local
    A timeout (30000 milliseconds) was reached while waiting for a transaction
    response from the NlaSvc service.
    Event Xml:
    <Event xmlns="">
    <Provider Name="Service Control Manager"
    Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service
    Control Manager" />
    <EventID Qualifiers="49152">7011</EventID>
    <TimeCreated SystemTime="2009-06-10T19:24:11.000Z" />
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Security />
    <Data Name="param1">30000</Data>
    <Data Name="param2">NlaSvc</Data>
    Mark, Jun 10, 2009
    1. Advertisements

  2. Hello mark,

    The Network Location Awareness service which collects and stores network
    configuration information such as IP addresses, Workgroup and/or Domain name
    changes (if your PC is connected to a Windows network), as well as Location
    change information, and which notifies applications when this information
    changes so that they in turn adapt to the computer's connectivity changes.
    So you should not disable that service.

    Is that service started and set to automatic? Do you run TrendMicro AntiVirus,
    read about a problem with that AntiVirus software?

    Best regards

    Meinolf Weber
    Meinolf Weber [MVP-DS], Jun 11, 2009
    1. Advertisements

  3. Mark

    Mark Guest

    Thanks. For testing purposes, we ended up disabling the NLASVC and NIS
    services. The server runs well without them. The NLASVC errors went away,
    but the "Welcome Screen" hang is still present and the server becomes
    unresponsive and must be rebooted daily. It has become such a problem, that
    we may have have to buildout a replacement 2003 environment.
    Mark, Jun 12, 2009
  4. Mark

    Mark Guest

    When the RDP session starts, the user is prompted for credentials. Once the
    credentials are entered and user presses enter (or the arrow), the RDP
    session displays "Welcome" with the rotating circle (to the left), but the
    log on never gets any further. We've waited over 20 minutes and nothing.

    Normally, a series of messages are displayed like load profile, etc.

    The event log is void of errors. The console is also hung. It has happened
    to all users and appears to the connection independent - RDP client version,
    OS version, do not matter. This happens at least once a day, sometimes
    more. A hard reboot is required to reactivate the server.
    Mark, Jun 12, 2009
  5. Mark

    Mark Guest

    This is from 1 of the 2 servers. Both crash, but this server has more
    issues than the other.

    Microsoft Windows [Version 6.0.6002]
    Copyright (c) 2006 Microsoft Corporation. All rights reserved.

    C:\Users\administrator.KNOPF>ipconfig /all

    Windows IP Configuration

    Host Name . . . . . . . . . . . . : KAVSAPP01
    Primary Dns Suffix . . . . . . . : knopf.local
    Node Type . . . . . . . . . . . . : Hybrid
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No
    DNS Suffix Search List. . . . . . : knopf.local

    Ethernet adapter Local Area Connection:

    Connection-specific DNS Suffix . : knopf.local
    Description . . . . . . . . . . . : VMware PCI Ethernet Adapter
    Physical Address. . . . . . . . . : 00-50-56-BD-77-4A
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes
    IPv4 Address. . . . . . . . . . . :
    Subnet Mask . . . . . . . . . . . :
    Default Gateway . . . . . . . . . :
    DNS Servers . . . . . . . . . . . :
    Primary WINS Server . . . . . . . :
    Secondary WINS Server . . . . . . :
    NetBIOS over Tcpip. . . . . . . . : Enabled
    Mark, Jun 12, 2009
  6. Hello mark,

    DNS looks ok for this server. Because you said both problem machines are
    Terminal servers, maybe you should think about posting to:

    Are the servers VM's, according to the NIC description VMWare? Are the latest
    VMWare tools installed?

    Best regards

    Meinolf Weber

    Meinolf Weber [MVP-DS], Jun 12, 2009
  7. Mark

    Mark Guest

    Yes, I have been posting to that Newsgroup as well. Yes. both machines are
    VM's and running the latest everything. We even took the time to move the
    servers to entirely new hardware. Same issue.


    Mark, Jun 15, 2009
  8. Mark

    Roger Guest

    I have the same problem with Citrix XenApps on Windows Server 2008. Did you
    get your problem solved?

    Roger, Jul 15, 2009
  9. Mark

    Mark Guest

    I apologize for the late response. Our issue is not resolved. We are
    testing a MS Personal Hotfix. The server no longer hangs, it simply crashes
    and reboots. We're experiencing 2 or 3 crashes a week, down from 20 (two

    Mark, Jul 24, 2009
  10. Mark

    Steve Guest

    We are experiencing this issue as well. Our servers exhibit the NLASVC issue
    noted above.

    I have updated the Broadcom NIC drivers (NetXtreme II GB) and it reduced the
    number of crashes from 1-2 per day to about 1-2 per week.

    I am interested in receiving this hotfix, once more publicly avaiable. Is
    there a way to attach our issue to this case?

    Steve, Jul 26, 2009
  11. Were these machines cloned?

    Anthony [MVP], Jul 26, 2009
  12. Mark

    Steve Guest

    Yes and no. Some of them were cloned, and three of them were loaded
    individually from a VLA CD. They are all identical hardware (DELL PE1950 G3).
    We have 8 Terminal servers that are experiencing the issue.

    The SIDs on all of the machines are all unique. We checked that.

    Steve, Jul 26, 2009

  13. Curious, how did you check that the SIDs are unique? Did you use a SID

    IMO, SID changers to not work as advertised, no matter who designed them.
    I've used imaging for many years, and long ago I've learned to use Sysprep
    with the mini-setup option, to create a base image, which upon restart of
    the base image, it goes through a mini-setup, sets up and creates a brand
    new SID just like a new operating system. I've seen and heard numerous
    issues using a base image that was not Sysprepped and using SID changers,
    including what you are experiencing, as well as issues with the VSS writer,
    joined machines not authenticating correctly or not even able to join them,
    and numerous other issues.


    This posting is provided "AS-IS" with no warranties or guarantees and
    confers no rights.

    Please reply back to the newsgroup or forum to benefit from collaboration
    among responding engineers, and to help others benefit from your resolution.

    Ace Fekay, MCT, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA Messaging
    Microsoft Certified Trainer

    For urgent issues, you may want to contact Microsoft PSS directly. Please
    check for regional support phone numbers.
    Ace Fekay [MCT], Jul 26, 2009
  14. Mark

    Steve Guest

    I used the NEWSID tool to check the machine SID.

    We used SYSPREP in order to prepare the images, used GHOST to copy them, and
    ran the mini-setup on each machine.
    Steve, Jul 26, 2009
  15. Mark

    Steve Guest

    I used SYSPREP to change the SIDs on the machines (via the mini-setup option).

    I used NEWSID to check the SIDs on the machines (but not change them).
    Steve, Jul 26, 2009
  16. Hello Steve,

    If you have used sysprep, the SID should be different, or are all servers
    Domain controller? Which option did you use with sysprep?

    Best regards

    Meinolf Weber
    Meinolf Weber [MVP-DS], Jul 26, 2009

  17. If you've used Sysprep with the mini-setup option, then there is no need to
    check if the SIDs are unique, because Sysprep doesn't change the SIDs,
    rather it creates a new SID for the machine and all subcomponents during the
    mini-setup upon reboot.

    What else is installed on this machine? What version of AV? Take a look at
    this link where someone else had a similar problem that would up being Trend
    causing it.

    Ace Fekay [MCT], Jul 26, 2009
  18. Mark

    Steve Guest

    We used the mini setup option. I only used NewSID to determine the servers'
    SIDs to make sure they were unique.

    None of the affected servers are domain controllers; they are all TS servers
    running three different RemoteApp applications.

    To add insult to injury, we have two domain controllers that are in an
    identical hardware configuration. No issues. We also have one PE1950 with
    identical hardware that is used for utility operations running Hyper-V with 4
    Win2003 guests. It runs at full memory and avg 73% CPU utilization all day
    and night. Also no issues.

    I've tried pretty much everything to narrow it down to one or two specific
    variables. It seems to be: PE1950 G3, Broadcom NICs, Win 2008 SP2 or SP1, TS
    Application Role. I've contacted DELL and we've run hardware diagnostics.
    I've also taken two DELL 1750s, installed Win2008, TS App Role and placed
    into our farm. No issues.

    I'm pretty convinced that it's Win2008. If there's a trial/non-public hotfix
    available, I'm willing to try it in our environment. Having the server crash
    is better than having to hard power cycle it in order to get things running
    again (I'd be screwed without intelligent PDUs).
    Steve, Jul 26, 2009
  19. Mark

    Steve Guest

    There is only one application being served from the affected machines. It was
    installed on the 1750s as well.

    I saw the problem regarding Trend Micro, and we have pulled all AV from the
    affected environment. I just run nightly scans from a remote server (no agent
    installed on the affected servers) until we isolate the problem. I know it's
    not the best AV practice, but I'm trying to keep the number of variables
    down. Also, the application is database driven, and files aren't exchanged
    to/from the client computer. There is some printing, and the Easy Print
    driver is used, but this is also the case on the unaffected computers.
    Steve, Jul 26, 2009
  20. Well, unless we missed something, it appears you've covered all the bases.
    See if you can get that hotfix, and let us know if it works out for you.

    Ace Fekay [MCT], Jul 26, 2009
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.
Similar Threads
There are no similar threads yet.