IT

2008 R2 svchost fun / crashing

Leave a comment

Our citrix farm has been displaying interesting performance recently. We’ve deployed xen app on to new servers that sit on an ESX farm. We’ve been having huge issues with random services crashing for no reason, affecting most of the servers. Error messages below are the appropriate ones.

The Windows Management Instrumentation service terminated unexpectedly

The Shell Hardware Detection service terminated unexpectedly.

The User Profile Service service terminated unexpectedly.

The Application Information service terminated unexpectedly

The Application Experience service terminated unexpectedly.

Faulting application name: svchost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7600.16559, time stamp: 0x4ba9b802
Exception code: 0xc000071f
Fault offset: 0x000000000006e51c
Faulting process id: 0x1f3c
Faulting application start time: 0x01cb612b72787ca8
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 3d10f918-cd20-11df-a871-005056b14de0

Faulting application name: svchost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1Faulting module name: ntdll.dll, version: 6.1.7600.16559, time stamp: 0x4ba9b802Exception code: 0xc000071fFault offset: 0x000000000006e51cFaulting process id: 0x1f3cFaulting application start time: 0x01cb612b72787ca8Faulting application path: C:\Windows\system32\svchost.exeFaulting module path: C:\Windows\SYSTEM32\ntdll.dllReport Id: 3d10f918-cd20-11df-a871-005056b14de0

Anyway, this appears to be casued by a bug in the WMI service, that MS have provide a (scolding) hot-fix that is located here http://support.microsoft.com/kb/982293

Hopefully this will be of use to someone! Took a long time for me to find!

Stuff

IAS, 802.1X and Cisco

Leave a comment

This took me hours to fix. I’m so utterly annoyed at myself for not finding the problem out earlier, that I’m going to let you in on what I did.

We have a set up at work of about 100 cisco routers, aironets and other 802.1x devices connecting to a Windows 2008 IAS box for AD RADIUS authentication. Now, this one user was having a problem with them. IAS logs are, as I’m sure you’re aware, impossible to read. I could see something happening in the logs, but the aironet said Station [mac] Authentication failed. Hmm. AD security logs showed he authenticated ok. It took a long time for Windows to give up authenticating, so seemed like a network related issue. This guy was ok at home with his wireless so the laptop was ok. Weird.

Anyway, after a long and hard struggle of no errors being logged, I looked at his “dial-in” tab in AD and lo and behold, it was set to “deny”. Thanks to whomever set his account up, that was a great help. To make it better, that tab doesn’t show in my Win7 RSAT so I had to RDP to a 2k3 box.

Stuff

SSM and AMT

Leave a comment

As you may be aware I’ve been experiementing with SCCM recently. I’m finding it amazing. I’ve not been on a course for this so to say it is daunting is a huge understatement. The myriad configuration options are enough to scare anyone off, but once you grasp the basic concepts of advertisements, packages and collections, life becomes easier. I’d recommend taking it one step at a time. Get one item configured and working before progressing onto the next.

Regarding that, the PC I’m testing on has intels “VPro” architecture. I really had no idea what this was until I had a cause to use it. Basically, for those of you with HP servers, it’s like a very cut down desktop version of an ILO. No remote console viewing or anything fancy. I can reboot the machine (in a hardware way), view some information on the settings and specifiy a boot image for recovery perhaps. I see it being quite useful but it’s a big of a pain to configure initially. Like msot things in SCCM, getting it do thing NOW is quite hard. As its intended to be used in a huge enterprise, everything happens in a scheduled fashion.

With this in mind, here is a basic list of what you will need. I used our own internal CA, to provision it, which makes things a little more difficult. Mainly because I spent a lot of time wondering why it didn’t work. Here;s a hint. If you are using your own internal CA for AMT provisioning, you must go into the AMT screen via ctrl+P (on my HP) and enter the hash (thumprint) of the CA Root certificate. You can USB provison them, you will need to download Intels AMT SDK http://software.intel.com/en-us/articles/download-the-latest-intel-amt-software-development-kit-sdk/and the USB key provisioning tool http://communities.intel.com/docs/DOC-1430 You make the .bin file with the program in the SDK thusly:

usbfile -create c:\setup.bin admin S3curepw! -hash c:\root-ca.cer “MY CAs Hash”

Obviously change the bits above to suit your environment. You can then format the usb key with the tool, give it the .bin file and boot from the usb key to provision the PC. After a while, assuming SCCM has been setup correctly, it will discover the AMT and it will be configured for you to use.

Stuff

SCCM Site Detection

Leave a comment

I’ve been having some fun at work recently with SCCM. Generally got it to work after following most of the articles on-line. It’s a bit of a mammoth program and configuring it takes time, so I’d certainly read everything first. Also, get an Enterprise CA, life is easier.

My first confusion with an SCCM client was when trying to auto-discover the site. It kept failing for no particular reason. Anyway, it turns out that you can’t do it when logged on locally when it’s AD integrated and there’s no WINS (remember that?). Tried it as a domain account and it worked fine. No idea why, one would assume it would use the computer account to connect to the SLP but it appears not to do so when run from the Control Panel

Have Fun!