Server 2019 login issue

[simpsonj]

Having an issue with a Server 2019 VM not letting anyone login.

 

It's setup to allow select users to login with Remote Desktop (only two at a time), and is very rarely used.

 

One of the users tried to access the server remotely, but can't login. I try logging in remotely, and it connects, shows a black screen briefly, then kicks me out.

 

I logged into the host, and tried to login via Hyper-V, but when pressing ctrl+alt+delete, a blue screen appears with the whirly circle, then kicks back to the ctrl+alt+delete page. I checked the VMs hard drive and found it to be near full (around 26MB of space left), and a folder of near 40GB of Windows Security definitions.

 

I've tried:

 

Creating a GPO that disables the ctrl+alt+delete requirement

Adding an extra 100GB of disk space to the VM, then remotely accessing disk manager to expand the drive

Rebooting the server

 

Now when I try to login, the creen flicks up and it shows my admin account with the whirly wheel for a second or so, then kicks me back to the date and time screen.

 

I'm at a loss, my Google-Fu has failed me, and wondered if anyone had any ideas!?

[HPlum78]

Are you able to remote connect to the Event logs on it? (or look at the logs in a central log store) might be able to get a better clue from those...

[simpsonj]

Yep, I can get into Event Viewer, a few errors of note under System:

 

7009 - A timeout was reached while waiting for the MSDTC Service to connect

7000 - The Distributed Transaction Coordinator service failed to start: the service did not respond to the start or control request in a timely fashion

7009 - A timeout was reached waiting for the sppsvc service to start

7000 - The Software Protection service failed to start: the service did not respond to the start or control request in a timely fashion

10149 - The WinRM service is not listening for WS-Management requests

6038 - Microsoft Windows Server has detected that NTLM authentication is presently being used between clients and this server. This event occurs once per boot of the server on the first time a client uses NTLM with this server.

7000 - The Spooler service failed to start due to the following error: the service did not respond to the start or control request in a timely fashion

[robintech]

Can you start PowerShell ISE as a domain admin and then enter a session with the 2019 server to run SFC like

 

runas /user:Contoso\domainadmin powershell

Enter-PSSession servername

sfc /scannow

Edited November 24, 2023 by ittech2342323

[simpsonj]

So can get a remote powershell session (thank you@ittech2342323) and ran sfc /scannow - didn't pick up any issues.

I've 'unlocked' the server from Sophos serve prrotection and rebooted - no change

I thought with powershell I could either install the latest windows updates, or uninstall the last one, but apparently this is blocked remotely, either as a security feature or a bug.

Beginning to lose the will with this one!

[AGSPC]

How many virtual processors has it got? You need at least two if you run Sophos because Sophos hogs the first one when you log in, so you get booted out when you try to log in if you only have a single core. There's a tech article somewhere on Sophos, I'll see if I can find it...

 

EDIT - Technical explanation here: https://community.sophos.com/intercept-x-endpoint/f/discussions/137696/rdp-not-working-on-hyper-v-server-2022

 

Also Sophos recommend two cores now - https://support.sophos.com/support/s/article/KB-000034920?language=en_US

Edited November 27, 2023 by AGSPC

[simpsonj]

Using Windows Admin Center gives me access to Windows Updates, so installing the November cumulative patch now, so fingers crossed that works.

Interestingly, trying to Remote Desktop through WAC gives me an error 'Your session was ended by another user. Try again in a few minutes.'

[simpsonj]

How many virtual processors has it got? You need at least two if you run Sophos because Sophos hogs the first one when you log in, so you get booted out when you try to log in if you only have a single core. There's a tech article somewhere on Sophos, I'll see if I can find it...

 

EDIT - Technical explanation here: https://community.sophos.com/intercept-x-endpoint/f/discussions/137696/rdp-not-working-on-hyper-v-server-2022

 

Also Sophos recommend two cores now - https://support.sophos.com/support/s/article/KB-000034920?language=en_US

 

I'm sure it's something to do with Sophos, Windows update, Windows Defender and a powercut.

 

But it does have 8 virtual processors, so I don't think this is the issue sadly, but thank you for the heads up!

[simpsonj]

That said, if the Windows Update doesn't solve the issue, I'll try to uninstall Sophos and see if that helps.

 

Also, if Sophos requires it's own Core, I'm not sure how that works with Hyper-V VMs.

[simpsonj]

Completely uninstalled Sophos.

 

Problem remains.

[Olliedawg]

Can you run " sconfig " in powershell & check if remote desktop is set to disabled?

 

Can you run " query user /server:computername " in powershell and see which users it shows as logged in (if any).

[robintech]

can only think of something is stopping the services starting, does it definitely have free space with

get-psdrive

[simpsonj]

Can you run " sconfig " in powershell & check if remote desktop is set to disabled?

 

Can you run " query user /server:computername " in powershell and see which users it shows as logged in (if any).

 

sconfig was saying remote desktop was disabled - But enabled in Windows Admin Center - Ticked 'Allow connections only from computers running Remote Desktop with Network Level Authentication' and now sconfig is showing Remote Desktop as Enabled

 

query user just spits out an error 'No User exists for *' running it on other servers brings up a list of users. I'm presuming it just means no one is logged on.

 

get-psdrive shows 134.66GB of free disk space.

 

Whether the fact that the C: Drive was completely full at one point has played a role in this issue I'm not sure, though I doubt it helped.

 

Thanks both, this issue is driving me crazy

[simpsonj]

can only think of something is stopping the services starting, does it definitely have free space with

get-psdrive

 

I can see the services, such as LSM, and they show as running.

 

That said, when I run the server in Safe Mode with Networking, it just sits on 'Please Wait for the Local Session Manager'

[simpsonj]

I'm toying with the idea of taking it off the domain and seeing if that at least allows me to login.

 

But if I do that, and it doesn't work, it's going to potentially be a lot harder to put in any other fixes, so want to completely exhaust any other ideas first!

[Olliedawg]

sconfig was saying remote desktop was disabled - But enabled in Windows Admin Center - Ticked 'Allow connections only from computers running Remote Desktop with Network Level Authentication' and now sconfig is showing Remote Desktop as Enabled

 

query user just spits out an error 'No User exists for *' running it on other servers brings up a list of users. I'm presuming it just means no one is logged on.

 

get-psdrive shows 134.66GB of free disk space.

 

Whether the fact that the C: Drive was completely full at one point has played a role in this issue I'm not sure, though I doubt it helped.

 

Thanks both, this issue is driving me crazy

 

Hm ok - if no users are shown as logged in, that rules out the 2 user limit i suppose. Is the user profile service definitely running on the vm? Can you log in as a local admin on the vm?

 

it's very strange. Hopefully you get to the bottom of it!

[HPlum78]

Have not been keeping up, so still not able to connect? what is this server doing? I will use a Jeff Snover saying here "Cattle not Pets" and that's to say if it's poorly take it out back and put a bullet in its head... I know that we have a desire to root cause every issue and if it was more than one server (VM) I would be saying lets do just that, but for one server just stand up a new one and move on that's the smarter way to deal with these kind of issues. (I have made a lot of assumptions here, so it may not be as simple as that sounds).

[simpsonj]

Hm ok - if no users are shown as logged in, that rules out the 2 user limit i suppose. Is the user profile service definitely running on the vm? Can you log in as a local admin on the vm?

 

it's very strange. Hopefully you get to the bottom of it!

 

Yep, User Profile service is running.

 

Thanks, removing all Windows updates and seeing if that solves the problem...

[simpsonj]

Have not been keeping up, so still not able to connect? what is this server doing? I will use a Jeff Snover saying here "Cattle not Pets" and that's to say if it's poorly take it out back and put a bullet in its head... I know that we have a desire to root cause every issue and if it was more than one server (VM) I would be saying lets do just that, but for one server just stand up a new one and move on that's the smarter way to deal with these kind of issues. (I have made a lot of assumptions here, so it may not be as simple as that sounds).

 

Ordinarily I'd absolutely agree, but this Server happens to have our archive SIMS installation on it, so I'd need to transfer that across to a new server, which I can't do and would cost £££, so trying everything I can to get this server back up and running! Particularly annoying as this server doesn't do anything, has nothing else installed, and yet is still busted, seemingly just from Sophos, SIMS and Windows Updates.

[simpsonj]

Working on updates

100% complete

Don't turn off your computer

 

Been on this for an hour now.

 

[HPlum78]

Fair enough like I said was unsure of the use so clearly practical.

[simpsonj]

No dice

 

[DaveTheTech]

I thought that you didnt need a licence to read historic data?

[simpsonj]

I thought that you didnt need a licence to read historic data?

 

I believe you're right, we don't need a licence (other than an SQL licence, which we have), but it's the actual act of transferring SIMS and its database to another server (especially without the ability to remote onto the existing server).

 

I guess it's a case of installing SIMS and pointing it to a SIMS database, but as I've never done this before, I've no idea where to start. All ears to any suggestions or guides though!

[simpsonj]

Safe mode - Please Wait for Local Session Manager - 2 hours + later - just a blue screen. Not a BSOD, just a blue screen and a cursor.

 

Time to give this server the last rites I think, and try to shift SIMS.

 

Thanks to all suggestions given, much appreciated.