Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Coming into work today, I've found we have a few different computers (different companies/networks/OS versions - all windows based) that are all having the same issue.

1) Network NIC is not able to be viewed from network connections. If you refresh, its saying the service is not started. Services state the service is started and running.

2) USB devices are not recognized when plugged in, scan for hardware changes, etc.

We have managed AV, that is kept up to date, and a managed patch policy that has all these machines at the most recent patch.

I'm just wondering if anyone else has experienced these same symptoms, and what they have done to resolve them.


11:23 AM - The issues are spreading, and things are progressively getting worse. Services are starting to shut down (windows installer, etc), ports are getting blocked. Rebooting into safe mode (w/ networking) still has these issues.

Patches: No patches went through last night.

Managed AV (McAfee): Nothing new from this point. This was un-installed and we still had the issues. No policy changes as far as blocking network access or other have been enabled.

Scanning: We've scanned with malwarebytes, the MS installer service shutdown before we could install any other software. Nothing came up in the scan.

Connections: Netstat showed no outgoing connections to any other machines, other than what was expected.

We are working remotely on a site that is 150 miles away. We have some IT staff on site, but so far nothing. What a great Thursday. :)

share|improve this question
up vote 1 down vote accepted

You didn't say what your AV software is but if you are using SEP11 (Symantec Endpoint Protection) you may have set a policy to disable certain device classes. If you have a different security product it may have similar options. In SEP11 you will find this under Policies->"Application and Device Control" in the Management Console.

share|improve this answer
+1 @Matthew Good thought Have seen that in our test environment. Too agressieve a policy applied and things stopped working – Dave M Mar 25 '10 at 17:39

Have you scanned for malware with Sopybot, Adaware, malwarebytes or other tools?

share|improve this answer
Yes, they resulted in nothing. – MJ. Mar 25 '10 at 16:24

Here are the steps I would take if I had this problem: Check for recent changes - did a patch get applied recently to the OS or other application? Did a configuration setting get changed recently? Check the event logs - any errors, warnings, or new event types start popping up recently? Run spyware scans with multiple products and do manual checking for running programs using HijackThis! or similar.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.