IIS & SMTP Services Shutting Down

By rkuhn ·
I have a domain with 15 servers. Any server in that domain with either IIS or SMTP installed will simultaneously stop.

Actually, all IIS services stop and any SMTP service becomes disabled.

I have looked for some rogue Group Policy setting and found nothing. I have scanned and rescanned for viruses and rootkits and found nothing.

I'm showing no unusal activity or traffic between servers or at the firewall. I'm showing no spike in CPU, memory, etc at each individual server level.

For two days in a row the services all stopped early in the morning, waited about 4 hours to do it again but then started stopping every 1 hour or so. In other words, the frequency seems to pick up as the day goes on.

Any ideas would be appreciated.

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Answers

Collapse -

what's the log files [event viewer] have to say?

by CG IT In reply to IIS & SMTP Services Shutt ...

it'll be in there if the services stop

Collapse -

Group Policy Problem?

by rkuhn In reply to what's the log files [eve ...

I've been down this road already but there does seem to be a correlation between "Event I 1704 Security policy in the Group Policy object has been applied successfully" and the server services stopping.

I did find in GP a policy to prevent the installation of IIS. It was accidentally applied to my servers instead of just domain PC's. I have since reversed that policy and allow installation of IIS on the servers.

After I did that, I did a "gpupdate /force" on each server and rebooted so that policy shouldn't be in affect anymore especially after seeing Event ID 1704 frequently. It appears that my GP policies are being applied.

It's almost as if the GP policy "broke" all IIS services and/or is still in effect but I see no evidence of that.

BTW, the local and domain GP policies on these servers allows installation of IIS.

Collapse -

Group Policy Explanation

by rkuhn In reply to what's the log files [eve ...

Per Microsoft:

"When you enable this setting, it will prevent Internet Information Services (IIS) from being installed, and you will not be able to install Windows components or applications that require IIS. Users installing Windows components or applications that require IIS may not receive a warning that IIS cannot be installed because of this Group Policy. Enabling this setting will not have any effect on IIS if IIS is already installed on the computer."

The last sentence is what baffles me. It does seem to be having an effect on previously installed IIS services.

Collapse -

if it was applied at the OU level and to only the computers OU

by CG IT In reply to Group Policy Explanation

then it should not effect the servers in the servers OU.

If your seeing errors in the event viewer relationg to the SMTP and IIS services and you apply that GPO at the domain level, I would venture to say, for the servers, block policy inheritence.

I'd reboot the servers instead for command line forced update.

Related Discussions

Related Forums