Event 5000 LsaSrv Problem

[mattjurado]

Have a 2000 SBS box. Working fine until a user printed a 60mb file 10 times. The print jobs failed, when I saw the server, it became much more responsive when I deleted the print jobs (naturally). I still had to reboot, as the problems obvious to the end users were still present: Can't browse the server, can't access anything in AD, and I couldn't login via terminal services (network problem errors). It was shining me on, in terms of offering up anything over the network. At the console, I had full access to the file system, and no evidence of disk or other hardware failure was present.

So, after a reboot, server kicked butt for an hour, then then all access via network connections was unavailable again. I noticed the 5000 error logged in my event log, stating "The security package Negotiate generated an exception..." Searches of google and eventid.net led me to not much information that seemed to be specific about my problem, but article 328948 on Microsoft's site indicates a hotfix that may be relevant. I have applied the hotfix, and time will tell if this will fix it, but I am curious if anyone else has experienced this problem, or if they have any suggestions. Sure feels like lsasrv hits a bug/problem, then crashes. I am SP3, I am avoiding applying SP4, as that would complicate any registry/ad restores that I might have to attempt later.

Matt J.

Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.

 

[aftertaf]

why would SP4 complicate things?

i'd recommend going SP4, even if you need to update your restore strategy as well...

just curious ;-)

Aftertaf
________
Regain control of your PC, at

http://www.debian.org

If you break your hard drive, it'll be DPlank's fault

 

[mattjurado]

It would complicate things because right now I can restore the registry data from a few days ago, and it should be a simple process. If I update to SP4, then I can no longer restore those registry backups, it wouldn't be "clean" to restore a SP3 registry to a SP4 file system. I could try to uninstall SP4 if it doesn't fix it, but I've always found traces of a SP are left over, even after you uninstall it.

Matt J.

Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.

 

[mattjurado]

Well, if anyone is watching this thread...

I performed several steps, and I appear to have regained stability, server has been running fine all weekend.

1. Restored registry from 1 week prior.
2. Removed all traces of antivirus.
3. Removed an instance of an msde engine.
4. Updated to SP4.

I removed the 2 items to reduce the amount of tasks this server was doing (file/print services, msde driven estimating program, msde backup exec, exchange, centralized antivirus). BTW, I did not choose to have this server run so many items, this is what they have chosen to do... I did notice some msde installer errors in my application log after every reboot before I made the changes, now they are gone. I'm going to let them run a day, then put the msde driven estimating program back, and see what happens.

Matt J.

Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.