I have this older HP ProLiant server that needs to be lifecycled, but there are still some services that are apparently running on it. There are only a few workstations that are being serviced by this particular server, but it not a DC, DNS or DHCP and whenever I shut this thing down, I get calls stating the workstations are bogged down to the point where users cannot even utilize the system whatsoever. So, I turn the server back on and the workstations are back to normal. It is the strangest damn thing I have ever seen. How would I go about troubleshooting this issue? Thanks
closed as not constructive by mdpc, faker, Michael Hampton♦, Alex, Magellan Jan 4 '13 at 17:52
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.
I would bet real money the workstations that are hanging are experiencing RPC call issues with the now missing services being hosted on the HP. You were given good advice earlier to perform a port scan but your next step either in lieu of or immediately after the port scan will be to identify the processes behind those IP services.
From your question, it sounds like a windows applications server since you spent alot of your question describing what the box ISN'T, it isn't a Domain Controller, it isn't a DNS directory or DHCP pool.
Download tcpview from Microsoft Sysinternals at http://technet.microsoft.com/en-us/sysinternals/bb897437
Use the web to glean explanation about port roles or read Microsofts included cheat sheet about TCP ports.
This opens the Unix like config file Windows uses to assign ports to port numbers and protocol types and is the same config used when reassigning standard services to non standard ports.
Then when you've verified which services are still truly necessary, take the stripped down box while still physical and optimize it up and even resize the partition if possible and use disk2vhd.exe or similar and convert that antique into a virtual machine for either immediate usage or archive it off in case you learn months later and several weeks after the drives were wiped and box was sold... we need that server back. You can resurrect the server as a VM as quickly as you want.
I would setup a capture with wireshark or something. Identify what is actually being sent over the network. Shut the machine down, and temporarily assign the IP address to a Linux machine, and run tcpdump and see what requests are being sent to the machine.
Another option would be to make sure you stop every service running on the machine one at a time, kill every process accessing the network. You may find that something was still running.
My guess is that you clients still have a setting to use this machine for something, and when they try to connect they are getting a nice immediate REJECT for the request. When the machine is offline, they are having to wait for the timeout for whatever service/protocol. Wireshark would identify these rejections very easily.
Run a scan against the system. Perhaps an external
Is this a Windows server? Which version of the OS?