[Number6]

All has been quiet and good with our one site that uses SBS for ages..... until last week.

Now we're getting a situation that manifests itself by all workstations losing connectivity to network shares, outlook going offline, 'blanking' of the user desktops, losing internet access. This happens several times a day at random intervals for anything from a minute to ten minutes at a time. The server hasn't physically crashed during these interludes, I can log in via a physical keyboard and monitor and it seems to be running perfectly fine.

The error log shows a policy error as follows:

-------------------
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1058
Date: 05/11/2009
Time: 09:01:44
User: Domain/User
Computer: ServerName

Description:
Windows cannot access the file gpt.ini for GPO cn={F3DA94C7-139D-410A-90AA-4A6F3F204728},cn=policies,cn=system,DC=Domain,DC=l ocal.
The file must be present at the location <\\Domain.local\SysVol\Domain.local\Policies\{F3DA 94C7-139D-410A-90AA-4A6F3F204728}\gpt.ini>.
(The specified user does not exist. ). Group Policy processing aborted.

For more information,
see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
-------------------------

There's nothing else in any of the logs that I can see that would relate to the problem.

I've done some research on this and MS kb908370 does seem to address this issue, at least partially. However, I've tried the fixes listed in the article and nothing works.

A domain controller that is running Microsoft Windows Server 2003 may stop responding for 2 to 15 minutes several times a day

It's beginning to get a bit irritating, for the users and for me. Obviously the users are getting peed off because they're losing they're folders and desktops so I need to resolve this in a hurry.

Can anyone shed any light on what's happened / how to resolve it?

[Number6]

I just noticed another GP related error:

-----------------
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date: 05/11/2009
Time: 10:59:32
User: Domain/User
Computer: ServerName
Description:
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

For more information, see Help and Support Center at Events and Errors Message Center: Basic Search.
---------------

Can't see any other messages posted by the policy engine though.

[stariq]

mate, try searching for Confick on these forums, your issue seems to be the result of this PITA virus

ST

[Number6]

Originally Posted by stariq

mate, try searching for Confick on these forums, your issue seems to be the result of this PITA virus

ST

Really?

Bugger!

What makes you think it's this virus causing the problem?

[stariq]

Im no expert on this, but the virus 'breaks' all the shares on your network from printers, folders, users areas etc.

Who is your anti virus software by?

We use Sophos and when it happened here the boys at Sophos; John especially were tops; helped every bit of the way.

If you go to thier site Antivirus | Security Software | Data Protection | Encryption Software for businesses - Sophos and search for confick they have a tool which helps identify it, not sure wheather it will work on any other software vendor though but definatley worth a look.

Also try Symantec, they tend to be good as well

Let us know how you get on

ST

[Number6]

We use Sophos.

I'll have a look at the link, thanks.

[Number6]

Update.

Despite many hours of hair pulling and searching by me and my colleagues we are stumped. The network refuses to run in a stable fashion.

We have now taken the decision to throw away the SBS box and replace it with a new R710 server running 2008 std + exchange 2007.

Four weeks of frustration, wasted time and user annoyance!!