RIS setup

  • Thread starter Thread starter Brian
  • Start date Start date
B

Brian

Ive installed a group of test machines with Win2k and SP4
using RIS. The process works fine.
I then install various apps using GPO. These include MSI
and ZAP files.
Everything works fine. The problem is when a machine is
left logged out and idle for a while, usually overnight.
When a user logs in, it takes a while for the icons to
display on the desktop. Eventually they do appear, but
icons no longer appear in control panel or the programs
menu. A reboot sorts all these symptoms out, but I dont
really want to roll out machines using RIS on mass knowing
these symptoms exist. I suspect its an explorer.exe
problem but how can I be sure and how would I resolve it?
Any ideas?
 
If you hand load Win2K and SP4, then use GPO to install the programs, do the
same symptoms occur?

What are the event log errors on the sick machines?
 
Nothing untoward in the event logs.
Dont know about Hand install.
Im going to RIS a machine, without applying GPO. Set up
auditing on the Registry and C:\ for the System account.
Then all I can do is leave it a few days and apply each
software app every second day or so. Thats the problem
with the symptoms, they are very sporadic.
Another symptom I noticed yesterday was that the CD ROM
drives started playing up. Some wouldnt read the CD's,
others would read them, would start the autoplay but then
fail to proceed. Again a reboot sorted things out.
 
On two of the machines I have now found the following 3
errors:
Application Error:4097 Source:EventSystem

The COM+ Event System detected a bad return code during
its internal processing. HRESULT was 800706BE from line
42 of. \eventsystemobj.cpp.

Then another identicle but with HRESULT was 80070BA

Application Error:4097 Source:DR Watson

The application svchost.exe generated an application
error. The error occurred on <date>@<time>. The
exception generated was c0000005 at address E03C3A68[<no
symbols>]

Then at the same time a System event occurs:

EventID:7031 Source: Service Control Manager

The remote procedure call (RPC) service terminated
unexpectedly. It has done this 1 time(s). The following
corrective action will be taken in 0 milliseconds: No
action.
 
I'll look this up later on today, but my first thought was a Blaster
infection?

--
Scott Baldridge
Windows Server MVP, MCSE
On two of the machines I have now found the following 3
errors:
Application Error:4097 Source:EventSystem

The COM+ Event System detected a bad return code during
its internal processing. HRESULT was 800706BE from line
42 of. \eventsystemobj.cpp.

Then another identicle but with HRESULT was 80070BA

Application Error:4097 Source:DR Watson

The application svchost.exe generated an application
error. The error occurred on <date>@<time>. The
exception generated was c0000005 at address E03C3A68[<no
symbols>]

Then at the same time a System event occurs:

EventID:7031 Source: Service Control Manager

The remote procedure call (RPC) service terminated
unexpectedly. It has done this 1 time(s). The following
corrective action will be taken in 0 milliseconds: No
action.

-----Original Message-----
If you hand load Win2K and SP4, then use GPO to install the programs, do the
same symptoms occur?

What are the event log errors on the sick machines?


--
Scott Baldridge
Windows Server MVP, MCSE



.
Click to expand...
Click to expand...
 
Have you checked for the MSBlaster yet?

The Stinger will check for you:

http://us.mcafee.com/virusInfo/default.asp?id=stinger

--
Scott Baldridge
Windows Server MVP, MCSE
I'll look this up later on today, but my first thought was a Blaster
infection?

--
Scott Baldridge
Windows Server MVP, MCSE
On two of the machines I have now found the following 3
errors:
Application Error:4097 Source:EventSystem

The COM+ Event System detected a bad return code during
its internal processing. HRESULT was 800706BE from line
42 of. \eventsystemobj.cpp.

Then another identicle but with HRESULT was 80070BA

Application Error:4097 Source:DR Watson

The application svchost.exe generated an application
error. The error occurred on <date>@<time>. The
exception generated was c0000005 at address E03C3A68[<no
symbols>]

Then at the same time a System event occurs:

EventID:7031 Source: Service Control Manager

The remote procedure call (RPC) service terminated
unexpectedly. It has done this 1 time(s). The following
corrective action will be taken in 0 milliseconds: No
action.

-----Original Message-----
If you hand load Win2K and SP4, then use GPO to install the programs, do the
same symptoms occur?

What are the event log errors on the sick machines?


--
Scott Baldridge
Windows Server MVP, MCSE

Ive installed a group of test machines with Win2k and SP4
using RIS. The process works fine.
I then install various apps using GPO. These include MSI
and ZAP files.
Everything works fine. The problem is when a machine is
left logged out and idle for a while, usually overnight.
When a user logs in, it takes a while for the icons to
display on the desktop. Eventually they do appear, but
icons no longer appear in control panel or the programs
menu. A reboot sorts all these symptoms out, but I dont
really want to roll out machines using RIS on mass knowing
these symptoms exist. I suspect its an explorer.exe
problem but how can I be sure and how would I resolve it?
Any ideas?


.
Click to expand...
Click to expand...
Click to expand...
 
Thanks Scott, it looks like it was the blaster. Ive
cleaned the machines up and they seem to be stable.
-----Original Message-----
Have you checked for the MSBlaster yet?

The Stinger will check for you:

http://us.mcafee.com/virusInfo/default.asp?id=stinger

--
Scott Baldridge
Windows Server MVP, MCSE
I'll look this up later on today, but my first thought was a Blaster
infection?

--
Scott Baldridge
Windows Server MVP, MCSE
On two of the machines I have now found the following 3
errors:
Application Error:4097 Source:EventSystem

The COM+ Event System detected a bad return code during
its internal processing. HRESULT was 800706BE from line
42 of. \eventsystemobj.cpp.

Then another identicle but with HRESULT was 80070BA

Application Error:4097 Source:DR Watson

The application svchost.exe generated an application
error. The error occurred on <date>@<time>. The
exception generated was c0000005 at address E03C3A68 [<no
symbols>]

Then at the same time a System event occurs:

EventID:7031 Source: Service Control Manager

The remote procedure call (RPC) service terminated
unexpectedly. It has done this 1 time(s). The following
corrective action will be taken in 0 milliseconds: No
action.


-----Original Message-----
If you hand load Win2K and SP4, then use GPO to install
the programs, do the
same symptoms occur?

What are the event log errors on the sick machines?


--
Scott Baldridge
Windows Server MVP, MCSE

Ive installed a group of test machines with Win2k and
SP4
using RIS. The process works fine.
I then install various apps using GPO. These include
MSI
and ZAP files.
Everything works fine. The problem is when a machine is
left logged out and idle for a while, usually overnight.
When a user logs in, it takes a while for the icons to
display on the desktop. Eventually they do appear, but
icons no longer appear in control panel or the programs
menu. A reboot sorts all these symptoms out, but I dont
really want to roll out machines using RIS on mass
knowing
these symptoms exist. I suspect its an explorer.exe
problem but how can I be sure and how would I resolve
it?
Any ideas?


.
Click to expand...
Click to expand...


.
Click to expand...
 
Back
Top