# [SOLVED] Server 2008R2 issue



## IT-Barry

> Faulting application name: svchost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
> Faulting module name: ntdll.dll, version: 6.1.7601.17514, time stamp: 0x4ce7c8f9
> Exception code: 0xc0000005
> Fault offset: 0x00000000000506a1
> Faulting process id: 0x384
> Faulting application start time: 0x01cc67a7f90e5a9e
> Faulting application path: C:\Windows\system32\svchost.exe
> Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
> Report Id: a50a92c8-d3b1-11e0-8bbc-0019999c08f2


This is the starting issue, a whole bunch of exchange related errors follow, the server then needs bounced to sort, If I am lucky enough to be on RDP at the time I can remotly restart, If im not I cannot rdp onto it and need to restart it onsite.

This happens at irregular intervals during the day for no apparent reason, a.k.a we arent working on the server at the time.

When this happens outlook becomes disconnected which is a major nono for the client.

Need help?

Edit: also get failed store mount of database mailbox database and also failed mount of database mailbox errors reoccuring around the time disconnection happens, says the rpc server is too busy, which is the server which is what i'm on, that has the top error, so I think the svhost causes the services to fall over thus crashing the mailboxes and all subsequent services like rdp


----------



## Troy_Jollimore

*Re: Server 2008R2 issue*

What brand/type of server is it? What other applications are running on it? You've probably checked most of the 'usual suspects' already, but before you go dragging Exchange and Server through the mud, perhaps something else is giving the server fits?

I had the problem with Symantec BESR and a white-box server. Caused no end of mysterious lock-ups and reboots that seemed to be USB-related.


----------



## IT-Barry

*Re: Server 2008R2 issue*

Fujitsu box, windows 2008r2

Cant remember exact model without digging. Models not a problem been running fine, I recently decommsioned an old server due to disconnects that were happening, but this hasnt cleared up the disconnects.

only new things on the server are acronis which we stopped the vss service appears as an error in event viewer multiple times due to this.

Fell over again on the hour first time was 12.31 now again at 13.31

Have acronis backup on it so going to kill that off first, also got spiceworks on it, will try killing that off second.

Seems to be a scheduled thing causing it. svchost is always the first to go then exchange all falls due to whatever causes svhost to fall.


----------



## IT-Barry

*Re: Server 2008R2 issue*

Stopped acronis services completley no problems so far.

That along with tonnes of other things like removing dns records for name servers and some powershell commands later.

Heres hoping.


----------



## Wand3r3r

*Re: Server 2008R2 issue*

ntdll.dll according to google contains kernal functions.
clear of rootkits, malware, virus's?

are you up on all of your updates?
checked the volumes with chkdsk /f ?
defragged?

acronis has been pretty darn reliable compared to backup exec  which we use both.

clues are in the event viewer logs. It's a matter of looking at all the errors, not jumping to conclusions on what they mean [can't always believe ms online docs], and looking at what there is in commonality. Its never specific but general but it at least gives you a place to start looking.


----------



## IT-Barry

*Re: Server 2008R2 issue*

The above error is always the starting one, the other services only ever come after this one.

I will look into the point you posted, will report back.

EDIT:We moved dns to the new server from the old one and left the static ip looking to the old server, changed this and monitoring it.

Hopefully this sorts it.


----------



## IT-Barry

*Re: Server 2008R2 issue*

DNS also defaulted to using ipv6,

Will using How to disable certain Internet Protocol version 6 (IPv6) components in Windows Vista, Windows 7, and Windows Server 2008 to set it to use ipv4 as prefix fix this, or disabling ipv6 work or will it cause bother?


----------



## IT-Barry

*Re: Server 2008R2 issue*

Another update

Nothing to do with ipv6.

Defo dns for now, changed it to .9 and internet doesnt work properly.
Working on it will update when the internet works.


----------



## IT-Barry

*Re: Server 2008R2 issue*

May as well close this for now too many issues to get help with will return with a new thread once its stable/back to one issue.

least the internets working now, web app also allows access to emails and works fine, think its dns not allowing outlook to access the server as it constantly says disconnected on the client workstations.


----------



## IT-Barry

*Re: Server 2008R2 issue*

Outlook now connected, leaving it to run, will monitor event viewer and either mark as solved or return with another error.


----------



## mjones1

*Re: Server 2008R2 issue*



Wand3r3r said:


> ntdll.dll according to google contains kernal functions.
> clear of rootkits, malware, virus's?
> 
> are you up on all of your updates?
> checked the volumes with chkdsk /f ?
> defragged?
> 
> acronis has been pretty darn reliable compared to backup exec  which we use both.
> 
> clues are in the event viewer logs. It's a matter of looking at all the errors, not jumping to conclusions on what they mean [can't always believe ms online docs], and looking at what there is in commonality. Its never specific but general but it at least gives you a place to start looking.


Have to agree there, Acronis is running on our server 2008r2 box as well, no issues yet either...


----------



## IT-Barry

*Re: Server 2008R2 issue*

Application error still causing bother.

Might get rid of spiceworks soon.

Also drivers were outdated gonna update them, and its missing a service pack for exchange so will install it and see how it goes.


----------



## IT-Barry

*Re: Server 2008R2 issue*

Turned out to be Spiceworks.

Solved.


----------



## Troy_Jollimore

Excellent. Way to hunt it down. Although it's maddening when an app like that is the source of a problem, yet you could have an identical install on an identically set-up identical piece of hardware, that works great...


----------

