cluberti

Lines beginning with a semicolon ( ; ) will be ignored.

I've seen some reports of this going around - the question becomes, what do you have installed on the machine? The update seems to have issues with Antivirus and Firewall products that use kernel hooks that are not documented, like Tiny's personal firewall (that's the one I'm aware of for certain that has issues after the patch). What do you have installed on this machine?

In an AD environment, both of the nodes must be DNS servers and Global Catalog servers. Also, FSMO roles MUST be on one server and one server only, so this will have to be an active/active cluster. If one of the cluster nodes fails, and that DC is holding a domain FSMO role (and in your case, one or both of the nodes WILL hold at least one of the FSMO roles), these roles may have to be yanked away to the running node if/when this happens. Follow KB255504 if this is necessary. However, if there is time to transfer the roles before a server node holding FSMO roles fails completely, follow KB255690. 281662: Windows 2000 and Windows Server 2003 cluster nodes as domain controllers http://support.microsoft.com/default.aspx?...kb;EN-US;281662 223346: FSMO placement and optimization on Active Directory domain controllers http://support.microsoft.com/default.aspx?...kb;EN-US;223346 255504: Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller http://support.microsoft.com/default.aspx?...kb;EN-US;255504 255690: How to view and transfer FSMO roles in the graphical user interface http://support.microsoft.com/default.aspx?...kb;EN-US;255690 834231: When a Windows Server 2003 cluster node is a domain controller, you may receive an error message when you add domain users to the cluster file share http://support.microsoft.com/default.aspx?...kb;EN-US;834231 898634: Active Directory domain controllers are not supported as Exchange Server cluster nodes http://support.microsoft.com/default.aspx?...kb;EN-US;898634 Note that this is NOT a recommended configuration - Domain controllers by default have very high fault tolerance already built-in to the AD roles other than the FSMO roles, and as such are quite redundant already without cluster. Also note that if these are busy DCs, and you are also running a clustered application, you will have to plan hardware accordingly for both nodes. If this is an x86 (32bit) set of servers, I would HIGHLY recommend 4GB of RAM and at least 2 processors for each node - lsass.exe will be quite busy, and with the added load of a clustered app or two, any crash or overload of lsass.exe, csrss.exe, or winlogon.exe will BUGCHECK AND CRASH YOUR BOX. Keep that in mind (hopefully you can at least see the pitfalls of clustered DCs by now!). Edit - fixed link for 898634.

221833: How to enable user environment debug logging in retail builds of Windows http://support.microsoft.com/default.aspx?...kb;EN-US;221833

Computer Configuration > Administrative Templates > Network > Network Connections > Windows Firewall I found this by using the terms "windows firewall group policy" in google. The first 8 links were 100% relevant. http://www.google.com/search?q=windows+firewall+group+policy

Are you an administrator on the machine in question?

That error maps to "ERROR_SXS_XML_E_INVALID_VERSION", and since the extension on the file giving the error is .com, that means it's running 16bit code. I'd say either run it in application compatibility mode with a previous version of Windows selected, or update the application to a 32bit version. I second the notion that this may not work properly under XP since it's a 16bit app.

Not a problem. B)

292438: Troubleshooting journal_wrap errors on Sysvol and DFS replica sets http://support.microsoft.com/default.aspx?...kb;EN-US;292438 You're going to need to stop the FRS service before setting the values, and for a brief time your DC may become unavailable to clients while the FRS store is reinitialized. Set the following registry values: Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters Value: Enable Journal Wrap Automatic Restore Type: REG_DWORD Data: 1 Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore/Process at Startup Value: BurFlags Type: REG_DWORD Radix: Hexadecimal Data: D2

Why not just use the delprof.exe reskit utility? http://www.microsoft.com/downloads/details...;displaylang=en

Replied to your email with ftp instructions. You might want to zip that .dmp file up before uploading .

If you run regmon and filemon (from sysinternals.com) when installing the app, do you see any access denied errors around the time the install fails?

That error message means one of two things when run by msoobe.exe - either it's trying to connect to a machine that isn't listening (NMERR_REMOTE_NOT_A_SERVER) or it couldn't find a module needed to complete the operation it was running at the time (ERROR_MOD_NOT_FOUND). I'd say it's likely the latter, but a network trace should show you what it's trying to do over the wire if you're that interested in tracking it down - a second machine attached to the same hub (not switch!) should show you what is happening over the wire.

You can also disable error reporting (and the Error Reporting service) to keep this from coming back. http://www.windowsnetworking.com/articles_...erver-2003.html

http://www.jsifaq.com/SF/Tips/Tip.aspx?id=4705

That is correct - once you've got a full dump, go ahead and set it back if you'd like. Since your box shouldn't be crashing regularly, and a complete dump is a much better troubleshooting option than a kernel or minidump in almost all scenarios, I'd suggest leaving it as-is, but that is of course up to you.

Also, the bugcheck or STOP code on the screen will likely tell you the actual image name that caused it, if you don't have the thing set to automatically reboot. That'd take the guesswork out of it...

All of the above suggestions are very good, but I would instead suggest that we do NOT change anything, except configuring the machine for a complete memory dump rather than a minidump. There is so much information missing from a minidump as to make troubleshooting with one of these nigh impossible. Mr. Snrub is correct, when csrss.exe (or any critical system process) crashes, it causes a bugcheck by design. Also, these things DO NOT crash on their own, and csrss.exe is going to be the victim here, not the cause. I would strongly suggest following the instructions below, reboot, then provide us the full memory.dmp file (I can give you FTP if you need it) to review when it happens again. We should be able to look at that and see which driver caused the error. 1. Right-Click on the "My Computer" icon on the desktop and select "Properties"; this will open the "System Properties" window. Go to the "Advanced" tab and click "Performance Options". Click "Change" under "Virtual Memory". Set the pagefile to be located on the partition where the OS is installed, and set it to be equal to Physical RAM + 50 MB. 2. Also in the "System Properties" window, click on the "Advanced" tab, then click "Startup and Recovery". Make sure "Complete Memory Dump" is selected (see 2a if this is not in the list). You can change the location of the memory dump file to a different local partition if you do not have enough room on the partition where the OS is installed. 2a. If the "Complete Memory Dump" option in step 2 is not available, you will need to manually set this registry value: Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl Value: CrashDumpEnabled Type: REG_DWORD Value: 1 3. You will need to reboot for these changes to take effect.

Never tried, but it is possible. Since NT4 isn't technically supported anymore, I don't even know how much it was tested. It won't hurt anything to try . Obviously you'd need the AD client installed on the NT4 machine, as well, for this to have any meaning (I'm assuming this is the case).

900617: "ESENT" and "Groveler" events are logged in the Application log when you use the Remote Installation Services component in Windows Server 2003 http://support.microsoft.com/default.aspx?...kb;EN-US;900617

http://support.microsoft.com/kb/203607/EN-US/

Have you considered using the ISA server logging to see if your Offer requests are hitting the default deny rule? Honestly, it's likely the ISA firewall is likely blocking the requests once they hit the interface. Why are you running any services on a firewall, btw? It would be easier and safer to run network services on another server, not to mention reduce the attack surface of the ISA box...

Yes, but your processor supports and implements hardware DEP - and on Windows XP and 2003 x86 versions, this automatically enables the PAE kernel, as this is the only way for x86 versions of Windows XP and 2003 to be able to utilize the hardware DEP capabilities of the processor. Disabling PAE also disables the capabilities of the OS to use the hardware DEP functionality, and to truly disable PAE on the OS with a processor that implements hardware DEP, you should use the /noexecute=AlwaysOff and /nopae boot.ini options. This should disable PAE (but also disable DEP).

I think this is what you're looking for: http://www.petri.co.il/enable_themes_on_windows_2003.htm

You could probably have better luck with 3rd party utilities, because although you can set some quota policies in a GPO, there's no real easy way to "roll back", nor limit users to specific areas of the disk (short of locking the box down tight with NTFS permissions, which usually ends up breaking applications). DeepFreeze comes immedately to mind for this scenario...