Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I hope this is the right Exchange to ask this:

On Saturday, our client's dedicated Windows 2003 Web Server suddenly shut down and was down for around ten hours while the hosting company restarted the machine several times, then replaced the power supply and finally put the drives into a new server. Looking through the event logs, it's obvious that someone/thing was trying to RDC into the server, with no luck, but could that actually take down a server? I ask because this isn't the first time this machine has shut down suddenly and with no apparent reason so I thought I'd ask. I don't see anything in the logs that looks odd aside from the constant RDC attempts, which get forcibly closed by the server, and you have to be at a certain IP address in order to have access in the first place, so it's really dumb for them to try.

share|improve this question

3 Answers 3

up vote 2 down vote accepted

The server wouldn't turn back on without swapping out the mobo, processor, RAM, power supplies, and controller (basically everything but the drives)?

I'd say this was a hardware issue, not software.

share|improve this answer
1  
I agree, seems rather cut and dry. You could hammer a server with invalid RDC requests until the end of time, and it isn't going to cause hardware problems. –  DanBig Jun 12 '12 at 18:28
    
I didn't think it could be RDC requests, but good to know. As for the hosting provider, let's say that they aren't ever very forthcoming with causes, it's enough to get then to fix things. Thanks! –  stephmoreland Jun 13 '12 at 13:20

If the hardware is marginally defective (read: preexisting hardware issue) and the usual load on the machine is very low, then the additional load just from the requests COULD push the machine over ther edge. Eg a few Watts of extra power usage finally drive a power supply with weak filter caps into an undervoltage trigger, or a machine running zombie from the cache with a dead hard disk could try and swap out something vital to disk and ... splat.

share|improve this answer

Sounds like the hosting company should explain the root cause. They should also be handling the RDC "acl" on their firewall and not the server itself. This way you won't be getting those events logged at all, as non-approved source IPs will be blocked at the firewall like they should be instead of the server itself.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.