My E2K3 server hung the other day on restarting, turned out it was a LSASS problem, PSS had to send me a hotfix to repair it. This was after the E2K3 rollup earlier this month, I'm a little suspicious of them at this point.
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Blunt, James H (Jim) Sent: Wednesday, April 28, 2004 1:57 PM To: Exchange Discussions Subject: RE: Exchange 2000 becoming unresponsive You mention a possible problem with LSASS...is it possible your servers have been compromised? Have a look at these links (may wrap): Microsoft Security Bulletin MS04-011 - Security Update for Microsoft Windows (835732) http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx Disable PCT 1.0, SSL 2.0, or SSL 3.0 on IIS http://support.microsoft.com/default.aspx?scid=kb;en-us;187498 Hacktool.THCIISLame http://www.symantec.com/avcenter/venc/data/hacktool.thciislame.html Hacktool.LsassSba http://securityresponse.symantec.com/avcenter/venc/data/hacktool.lsasssb a.ht ml -----Original Message----- From: Miller, Robert [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 28, 2004 1:10 PM To: Exchange Discussions Subject: RE: Exchange 2000 becoming unresponsive Yep - except for the new one released last week on the 20th. We are using Trend Scanmail (6.0). Thanks > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > Behalf Of Pitt, > Jeffrey > Sent: Wednesday, April 28, 2004 2:58 PM > To: Exchange Discussions > Subject: RE: Exchange 2000 becoming unresponsive > > > Have you performed all the sp3 hot fix rollups for Exchange. We had a > similar problem and it helped a little. Also if you are using Symantec > AV make sure to upgrade to the latest version. 8.0 had a memory leak > problem. > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > Tony Hlabse > Sent: Wednesday, April 28, 2004 3:49 PM > To: Exchange Discussions > Subject: RE: Exchange 2000 becoming unresponsive > > You might want to try and disable all services not needed. We had to > do this once. PSS can help with that also. > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > Miller, Robert > Sent: Wednesday, April 28, 2004 3:37 PM > To: Exchange Discussions > Subject: RE: Exchange 2000 becoming unresponsive > > It is sure looking that way...... > > The one possibility I am currently looking into is a memory leak in > the lsass process - KB article 812428.. The problem is I never got the > memory usage for the lsass process before any of the problem servers > rebooted - but if it happens again I will grab it.... > > Thanks again. > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] > > Behalf Of David, > > Andy > > Sent: Wednesday, April 28, 2004 2:04 PM > > To: Exchange Discussions > > Subject: RE: Exchange 2000 becoming unresponsive > > > > > > A call to PSS maybe in order then. > > > > > > -----Original Message----- > > From: Miller, Robert [mailto:[EMAIL PROTECTED] > > Sent: Wednesday, April 28, 2004 11:52 AM > > To: Exchange Discussions > > Subject: RE: Exchange 2000 becoming unresponsive > > > > I did indeed run across this article and checked the GP to make > > certain > > - everything looks good from that angle... > > > > Thanks > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] > > > Behalf Of David, > > > Andy > > > Sent: Wednesday, April 28, 2004 10:38 AM > > > To: Exchange Discussions > > > Subject: RE: Exchange 2000 becoming unresponsive > > > > > > > > > Perhaps: > > > http://support.microsoft.com/default.aspx?scid=kb;en-us;328662 > > > > > > > > > > > > -----Original Message----- > > > From: Miller, Robert [mailto:[EMAIL PROTECTED] > > > Sent: Wednesday, April 28, 2004 11:37 AM > > > To: Exchange Discussions > > > Subject: Exchange 2000 becoming unresponsive > > > > > > All, > > > > > > I have 70+ Exchange 2000 SP3 servers (running on Windows 2000 > > > SP3) around > > > the globe. These servers are also a DC/GC. Average number > > of users per > > > server is about 150. Everything has been running fine for > > months and > > > months > > > - and just recently servers have started to become very > > slow, and then > > > unresponsive. It has happened to 7 servers in the Europe > > region, and 5 > > > servers in north america this morning. users would complain that > > > Outlook was very slow, and then the server would become > > unresponsive. > > > Ping times are > > > normal, and TSE sessions are denied. I can remote to the > > servers via a > > > Compaq ILO and finally logon - takes about 20 minutes. Processor > > > utilization is fine, and memory consumption is a bit high. once > > > the server is rebooted it comes back up fine. The only out of the > > > ordinary log events are: > > > > > > 9074 - The Directory service referral interface failed to > service a > > > client request. > > > 1015 - The timeout waiting for the performance data collection > > > function "Perfproc" to finish has expired 26 - Application popup: > > > cmd.exe - Application Error > > > > > > Has anyone else seen or experienced this behavior. Its like the > > > servers are dropping off 1 by 1. > > > > > > Thanks > > > > > > > > > > > > > > > _________________________________________________________________ > > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > > Web Interface: > > > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&t > > ext_mode=&lang > > =english > > To unsubscribe send a blank email to > > %%email.unsub%% > > Exchange List admin: [EMAIL PROTECTED] > > To unsubscribe via postal mail, please contact us at: Jupitermedia > > Corp. > > Attn: Discussion List Management > > 475 Park Avenue South > > New York, NY 10016 > > > > Please include the email address which you have been contacted with. > > > > > > _________________________________________________________________ > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > Web Interface: > > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&t > ext_mode=& > lang=english > To unsubscribe send a blank email to > %%email.unsub%% > Exchange List admin: [EMAIL PROTECTED] > To unsubscribe via postal mail, please contact us at: Jupitermedia > Corp. > Attn: Discussion List Management > 475 Park Avenue South > New York, NY 10016 > > Please include the email address which you have been contacted with. > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&t > ext_mode=& > lang > =english > To unsubscribe send a blank email to > %%email.unsub%% > Exchange List admin: [EMAIL PROTECTED] > To unsubscribe via postal mail, please contact us at: Jupitermedia > Corp. > Attn: Discussion List Management > 475 Park Avenue South > New York, NY 10016 > > Please include the email address which you have been contacted with. > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&t > ext_mode=& > lang=english > To unsubscribe send a blank email to > %%email.unsub%% > Exchange List admin: [EMAIL PROTECTED] > To unsubscribe via postal mail, please contact us at: Jupitermedia > Corp. > Attn: Discussion List Management > 475 Park Avenue South > New York, NY 10016 > > Please include the email address which you have been contacted with. > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&t > ext_mode=& > lang > =english > To unsubscribe send a blank email to > %%email.unsub%% > Exchange List admin: [EMAIL PROTECTED] > To unsubscribe via postal mail, please contact us at: Jupitermedia > Corp. > Attn: Discussion List Management > 475 Park Avenue South > New York, NY 10016 > > Please include the email address which you have been contacted with. > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&t ext_mode=& lang=english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang =english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
