Terminal Servers Crashing BIG PROBLEM

[dan400007]

HELP!!!

 

We've just installed a set of Terminal Servers running Server 2008 and Server 2008 R2 and I've got a huge problem.

 

At random intervals we get the following error in the Application Log:

 

Faulting application svchost.exe, version 6.0.6001.18000, time stamp 0x47918b89, faulting module WINSTA.dll_unloaded, version 0.0.0.0, time stamp 0x4791a7c8, exception code 0xc0000005, fault offset 0x7580681e, process id 0x58c, application start time 0x01cb53d111fab6c2.

 

Problem is that this then takes out several essential services:

Windows Remote Management

Terminal Services

Network Location Awareness

Distributed Transaction Coordinator

DNS Client

Cryptographic Services

 

I've tried removing the RAID, reinstalling, installing only MS Office 2010, etc but this the problem occurs between 30minutes and 5 hours of booting. The amount of sessions makes no difference.

 

I thought that it was maybe a problem with roaming problems or the Aero interface etc, so I switched to mandatory profiles and classic windows but still the same.

 

I've search the internet and haven't managed to find a solution.

 

I'm really after anything now.

[AngryTechnician]

Do you have any minidump or memory.dmp files to look at? Might give you more info on what's crashing.

[dan400007]

Sorry no dumps

[3s-gtech]

Is this happening on all the TSs, or just one from a farm?

[joe90bass]

I had blue screens on ours when first setup with 2008. Turned out to be the broadcom management suite which I had used to load balance the NICs. It took one of our support calls to MS to track down though. Our servers are Fujitsu RX300. Might be worth stripping down to bare minimum any management stuff and/or looking for updated drivers. If you have a schools agreement/technet plus(?) then MS are worth a shot as well

[AceDaz]

I had this coming up on our servers, turned out to be that Sophos wasn't being updated from our LEA and let a virus in.

[dan400007]

@3s-gtech: Problem is with several servers and on different hardware

 

@joe90bass: The servers don't blue screen, simply the svchost.exe crashes taking the rest of the services with it. I've never used MS Support before, how many support calls do you get with a schools agreement?

 

@darrenmcginnis: Running without Sophos was my last hope today but the servers still have the same problem

[AngryTechnician]

Are the services you've listed the ONLY ones running in that instance of svchost? Might be worth checking using Process Explorer, and if there are any third-party services running in the same instance, start investigating there.

[ChrisH]

@3s-gtech: Problem is with several servers and on different hardware

 

@joe90bass: The servers don't blue screen, simply the svchost.exe crashes taking the rest of the services with it. I've never used MS Support before, how many support calls do you get with a schools agreement?

 

@darrenmcginnis: Running without Sophos was my last hope today but the servers still have the same problem

 

I think it is 2 a year. You have to do some extra registering to claim them I believe. ZeroHour had to do this not so long ago so he would be able to advise you on this.

[dan400007]

Well, it may be fixed.

 

I've disabled the following services that interact with the svchost.exe instance that runs Terminal Serivces:

 

BITs

Windows Update

Windows Driver Foundation

Network List Service

Network Location Awareness

 

The server has since survived over 4000 connections from a couple of testing clients, so its looking good at the moment. Something of a 'dirty' fix but it at least gives an interim solution (if it works of course!!)

[dan400007]

Just a quick update. With the services disabled the servers haven't failed once.

 

When I get some more time I'll revisit this and find a more suitable and permanent solution which I'll post here.