Networks

Ask something
Question Locked

windows networking question - sort of

0 helpful
15 replies

by kenone

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have an old server (MS Server 2K) that I want to upgrade/refit. When I turn the server off one of our admin machines goes into zombie mode. It takes about 1-2 minutes to open any file or even a right click menu. Turn the server back on, all is well again. This machine has a TON of programs on it. I would like to avoid rebuilding it (xp sp2). How do I figure out which program is pointing at that old server?

15 replies

by bizzo

When your second machine goes into "zombie mode", you could check the event logs to see if any services or applications are polling or timing out trying to connect to the powered off server.

by churdoo

Does the XP workstation have static IP or DHCP? Check to see what is has for DNS settings; I suspect it may be looking for the old server for DNS resolution.

by kenone

I see no errors in event viewer, or anywhere else. The machine has a static IP. We use it for all sorts of day-to-day chores. I already checked out the Mounts2 key in the registry and all the printers and mapped drives. I uninstalled the backup client as well.

by robo_dev

To begin with, figuring out what ports are in use may be helpful.

Also a netstat at the server may provide similar insight.

I would run nbtstat also, then run nbtstat -R to make sure the local netbios table is not hosed up.

I would do a search for the server name in the registry of the PC.

It isn't by chance using a login script that was on the server?

Personally I would hookup my laptop with the WireShark protocol analyzer. That would show you in a jiffy....

by robo_dev

-b Displays the executable involved in creating each connection or listening port.

-v When used in conjunction with -b, will display sequence or components involved in creating the connection or listening
port for all executables.

Who knows, it could be some nasty trojan virus phoning-home to the server..... :)

by kenone

netstat reports a bunch of connections from the server-all to other servers none to any workstations all TCP connections are to Local:0
UDP connections, other servers
nbstat doesn't run on either the workstation or server, not recognized as a valid command.
The only connections that the workstation reports are for Lotus Notes and this server is not and never was a notes server.

by kenone

That only reports one server connection and it's not the one causing the problem. Ran it with the -R anyway, no change.

by jswentworth

Download WireShark onto the workstation, begin a packet capture, shutdown the server for a few minutes, then bring the server back up, all while the packet capture is going.

Search the captured packets for references to that server.

by kenone

I did a registry search for the server name and there are hundreds of references to this old server, none look suspicious/active.
No scripts that I can find either side. It does this no matter who logs on too. Also does it in "Safe Mode"

by robo_dev

Totally off the wall question...is there a NetWare client on the PC? I saw this type of behavior with that client software.

Using "Windows Image Acquisition Service"? This can cause weird explorer slowness issues.

I assume you've done a 'disconnect' of all network drives, and cleaned out any shares configured in the network neighborhood??

by kenone

No Netware stuff on the entire network. Not sure what Windows Image Acquisition Service is so I guess we don't use it. Yeah the next thing I was gonna try is to take the box out of the domain, shut down the server and then rejoin the domain, hope That works.

by rob miners

http://technet.microsoft.com/en-us/sysinternals/default.aspx?PHPSESSID=9692e65a5ee7da54b8d439d907f7965b

There is a collection of tools that may help. Try process explorer.

This discussion is closed to new replies.