Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a (rather old) Windows Server 2003 which since last week shows some odd behaviour.

It decided that all local administrators and local system are no longer allowed to do anything, including creating event triggers or killing tasks (except via Task Manager).

The problem goes away after a reboot.

What could cause such behaviour?

Update:

This also affects VBS scripts, like the clusweb.vbs script used to control IIS from Cluster Services.

This line:

set objWmiProvider = GetObject("winmgmts:/root/cimv2")

causes this error:

Generic Script <IIS>: Script Error: Line=50, Character = 4 
Generic Script <IIS>: Source: SWbemServicesEx 
Generic Script <IIS>: Description: Access denied 
Generic Script <IIS>: Error: 2147749891 (0x80041003) - Description: Access denied  (Source: SWbemServicesEx) 

On a test server the line works, whether run by an administrator or non-administrator.

Update:

It appears the problem also causes cluster resources to become degraded and fail over. I experimented a bit with leaking memory in the nonpaged pool in a test system to see if I would get the same (catastrophic) results, but they are not quite the same (there is no "access denied" at any point, programs just don't start).

Any ideas what could cause all this?

share|improve this question

1 Answer 1

This sounds a lot like the downadup virus has infected your server. I had a very similar issue on a DC; once it was rebooted it worked fine. But after a short time, the server service (amoungst others) would stop and the server would become unusable.

Would recommend the obvious scans/updates etc.

Apologies for using the answer, but I can't add any comments yet...

HTH, James

share|improve this answer
    
Not quiet. The symptoms are somewhat different still. For example, Windows Defender etc were not disabled. Anyway, we have replaced the servers by now. –  Andrew J. Brehm Aug 12 '13 at 8:21
    
Yeah, sorry, I only saw how old the post was once I replied. I would've just commented, but I can't do that until I get to 50. Did you ever find the root cause? –  Zoidberg Aug 14 '13 at 10:48
    
We never did find the root cause. We had a ticket open with Microsoft but they never found anything either. –  Andrew J. Brehm Aug 14 '13 at 12:58
    
Oh well, at least it works now. –  Zoidberg Aug 20 '13 at 10:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.