our windows xp workstations connected to 2000 servers randomly dont
start several services when logging in.  there are probably 15
services set to automatic not starting.  its like a cascading affect. 
either doing a defrag, manually starting the services, or sometimes
just rebooting fixes for an undermined amount of time.  some
workstations have this problem every day for a while and then dont
have it for a month.  pretty sure not a virus.  what could be the
problem?

---

Request for Question Clarification by cerebrate-ga on 01 May 2004 10:03 PDT

Dear robbiemfg-ga,

A couple of questions:

1. What sort of network are these workstations and servers connected via?

2. Are the services running using local (or built-in) accounts, or are
they running under domain accounts?

3. Are there any messages in the System Event Log concerning these
services not starting (usually from the event source "Service Control
Manager"), and what are they?

Regards,

cerebrate-ga

---

Clarification of Question by robbiemfg-ga on 03 May 2004 07:58 PDT

1. What sort of network are these workstations and servers connected via?

We are using all Cat5/Cat5e Ethernet connected using 3COM 3300 series switches

2. Are the services running using local (or built-in) accounts, or are
they running under domain accounts?

All of the services are set to use the standard credentials (local system)

3. Are there any messages in the System Event Log concerning these
services not starting (usually from the event source "Service Control
Manager"), and what are they?

We get a couple of errors, the first one is associated with DHCP, but
oddly enough, the client machines still get IPs and the DHCP server
still recognizes their lease as valid and starting at the time the
machine started.  The DHCP error is as follows:

Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1003
Date:  4/28/04
Time:  4:26:13 PM
User:  N/A
Computer: EUNICEB
Description:
Your computer was not able to renew its address from the network (from
the DHCP Server) for the Network Card with network address
000102CAB1FD.  The following error occurred:
The semaphore timeout period has expired. . Your computer will
continue to try and obtain an address on its own from the network
address (DHCP) server.
 
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 79 00 00 00               y...    
_____________________________________

We also get an error tht I think is caused by the netlogon service
failing, I am not sure if this error occurs before or after the
failure starts.

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator) 
Event ID: 40960
Date:  4/28/04
Time:  4:28:24 PM
User:  N/A
Computer: EUNICEB
Description:
The Security System detected an attempted downgrade attack for server
LDAP/robbiexch.robbiemfg.com.  The failure code from authentication
protocol Kerberos was "An attempt was made to logon, but the netlogon
service was not started.
 (0xc0000192)".
 
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
________________________________________

Hi,

Let me get this straight.

You have many Windows XP clients.
You run a Windows 2000 Server.
Clients log in to the Domain/Auth server.
Services set to automatic do not start.

Now are these services on the server that are sopose to start? Or
service on the client that do not start?

Are all the services dependencies met?


CIOU

X

This is correct, the client machines are the ones getting the
failures, not the servers.  The failures also seem to be random,
sometimes a reboot of the client machine and the problem goes away and
stays away.  Sometimes a chkdsk c: /f takes it away but it reappears
every time the client restarts.  Sometimes a defrag seems to fix it.
Sometimes a person gets the failure everyday for a week or more and
sometimes it only happens once and they never see it again.

I've seens a similar problem here. In my case, it was linked to HP
print drivers for a network printer but I guess it could come from any
print driver.

The problem is that the spooler service tries to start before the
server servcice and that seems to wreak avok with NT-based mychines
(don't ask me why). The solution that worked for me was to add the
lanmanserver service to the dependancy list of the spooler service.
Once this was done, the problem went away.

MS has a KB article descibing the problem and it's solution. It say it
only applies to Windows NT 4.0 but I've just fixed an XP machine that
had the same problem the same way.

http://support.microsoft.com/default.aspx?scid=kb;en-us;319127

Good luck