Hmm, it is an HP box, so that is a possibility. Although I doubt I'll get the opportunity to setup a perfmon capture, since this DC is going to get demoted this afternoon and completely rebuilt.
On Wed, Mar 25, 2009 at 3:29 PM, James Wells <[email protected]> wrote: > I'd setup a perfmon capture to cover that time and grab Processes\* > > When we find these, it's usually a hardware agent's inventory process > gone amock, and we don't see it after the fact because it was just > called from a service. > > If it happens to be the hardware agent, exe image name is probably > Surveyor.exe for HP and PegasusProvider.exe for IBM. Can't remember > what Dell's looks like. > > --James > > On 3/25/09, Sherry Abercrombie <[email protected]> wrote: > > I have an interesting issue that has been happening for almost 6 weeks > now. > > Every Wed. at approximately 1:40-1:45 PM, one of our domain controllers > > basically becomes totally unresponsive, causing the other two DC's to > become > > effectively useless, AND causes the Exchange server to become > unresponsive > > to clients. (Outlook 2003) . > > > > The only clue that I have from the event logs is from the Directory > Service > > log, > > Event ID: 1232 > > Source: NTDS Replication > > Category: DS RPC Client > > Type: Warning > > Description: Active Directory attempted to perform a remote procedure > call > > (RPC) to the following server. The call timed out and was cancelled. > > > > Server: > > f9f58f44-e7e7-4ea5-92fe-aa38ff4cb646._msdcs.domain.com > > > > The server guid referenced here is one of the other domain controllers, > that > > at this point in time, is scheduled to be rebuilt. (FSMO roles have been > > moved, etc etc) > > > > The Exchange server event log just shows that it cannot contact any > global > > catalog server and lists the 3 dc's that we have which are all global > > catalog servers. > > > > During the duration of this "outage" this specific dc cannot be accessed > > either remote desktop, or direct on the console, but the other dc's are > > accessible as well as the Exchange server, albeit very slow response. > > > > I have Googled,looked at EventID.net and Microsoft on this, and have come > up > > with very little. Did find a MS KB article that recommended making a > > registry change on the DC's to make the RPC call timeout at least 45 > > minutes, this was done last week, and the DC's were rebooted over the > > weekend to apply this registry change, but, today it happened again, so > that > > didn't work. Found some other MS KB articles that were not applicable > but > > did reference that event. > > > > Windows 2003 server, SP2. My question is, what the heck is replicating > once > > a week that could be causing RPC to time out like this and basically > bring > > the domain to a halt for 10 - 15 minutes? As I stated, this DC is going > to > > be rebuilt, it just annoys me that I cannot find the reason for it, and a > > solution other than the rebuild. > > > > TIA, > > -- > > Sherry Abercrombie > > > > "Any sufficiently advanced technology is indistinguishable from magic." > > Arthur C. Clarke > > > > ~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK Test! > ~ > > ~ <http://www.sunbelt-software.com/product.cfm?id=400> ~ > > -- > Sent from my mobile device > > ~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK Test! ~ > ~ <http://www.sunbelt-software.com/product.cfm?id=400> ~ > -- Sherry Abercrombie "Any sufficiently advanced technology is indistinguishable from magic." Arthur C. Clarke Sent from: Haslet TX United States. ~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK Test! ~ ~ <http://www.sunbelt-software.com/product.cfm?id=400> ~
