Workstations unable to connect to domain

[Guest richard]

Got a strange problem which I hope you guys can shed some light on.

 

Yesterday morining I got into work to find that no pc could connect to the domain. As I could find nothing wrong I rebooted the server and all was well and I put it down to a "blip" on the network". However I have just had a call from them this morning saying that they could not connect to the domain again. As I'm not there until tomorrow I have just told them to reboot the server again for now.

[Dos_Box]

Check you event logs and the services viewer and see what service is crashing. If it is a service crashing you can use the rather handy 'Eventtriggers' command in a batch file and automatically re-start it (as the auto-restart' option on most services is pap).

 

https://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/eventtriggers.mspx?mfr=true

[Guest richard]

I checked the event log yesterday and there were no errors at all.

[Geoff]

run dcdiag on your server and netdiag on an affected client.

[Guest richard]

Thanks Geoff I'll try that tomorrow when I get in.

[plexer]

Also try adcheck from NetIQ

 

Ben

[Guest richard]

When I got in this morning I found a message on the server stating that

 

The Generic Host Process for Win 32 Services has encountered a problem and needed to close

 

There was also a note saying that the Domain went down again at 3pm yesterday. When I checked the event log there was application error at 3.06pm for the svchost.exe stating that it had faulted and that Net32.dll was the faulting module.

 

I did a bit of digging around on the net and found that this looks like a Malware problem. I checked the AV logs and run Ad-Aware on the serverc and found nothing.

[Geoff]

One of the services on the machine crashed. Check the event logs.

[Guest richard]

After the crash the event log os full of the same errors

 

Event ID 1030

 

Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previuosly logged by the policy engine that describes the reason for this.

 

It repeats this every couple of minutes all the way up the event log till I rebooted.