I'd setup a perfmon capture to cover that time and grab Processes\* When we find these, it's usually a hardware agent's inventory process gone amock, and we don't see it after the fact because it was just called from a service.
If it happens to be the hardware agent, exe image name is probably Surveyor.exe for HP and PegasusProvider.exe for IBM. Can't remember what Dell's looks like. --James On 3/25/09, Sherry Abercrombie <[email protected]> wrote: > I have an interesting issue that has been happening for almost 6 weeks now. > Every Wed. at approximately 1:40-1:45 PM, one of our domain controllers > basically becomes totally unresponsive, causing the other two DC's to become > effectively useless, AND causes the Exchange server to become unresponsive > to clients. (Outlook 2003) . > > The only clue that I have from the event logs is from the Directory Service > log, > Event ID: 1232 > Source: NTDS Replication > Category: DS RPC Client > Type: Warning > Description: Active Directory attempted to perform a remote procedure call > (RPC) to the following server. The call timed out and was cancelled. > > Server: > f9f58f44-e7e7-4ea5-92fe-aa38ff4cb646._msdcs.domain.com > > The server guid referenced here is one of the other domain controllers, that > at this point in time, is scheduled to be rebuilt. (FSMO roles have been > moved, etc etc) > > The Exchange server event log just shows that it cannot contact any global > catalog server and lists the 3 dc's that we have which are all global > catalog servers. > > During the duration of this "outage" this specific dc cannot be accessed > either remote desktop, or direct on the console, but the other dc's are > accessible as well as the Exchange server, albeit very slow response. > > I have Googled,looked at EventID.net and Microsoft on this, and have come up > with very little. Did find a MS KB article that recommended making a > registry change on the DC's to make the RPC call timeout at least 45 > minutes, this was done last week, and the DC's were rebooted over the > weekend to apply this registry change, but, today it happened again, so that > didn't work. Found some other MS KB articles that were not applicable but > did reference that event. > > Windows 2003 server, SP2. My question is, what the heck is replicating once > a week that could be causing RPC to time out like this and basically bring > the domain to a halt for 10 - 15 minutes? As I stated, this DC is going to > be rebuilt, it just annoys me that I cannot find the reason for it, and a > solution other than the rebuild. > > TIA, > -- > Sherry Abercrombie > > "Any sufficiently advanced technology is indistinguishable from magic." > Arthur C. Clarke > > ~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK Test! ~ > ~ <http://www.sunbelt-software.com/product.cfm?id=400> ~ -- Sent from my mobile device ~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK Test! ~ ~ <http://www.sunbelt-software.com/product.cfm?id=400> ~
