XPP SP2 + Sysprep - Limited or no Connectivity

[_jd_]

Little things seem to keep me from building an SP2 image...

Last week I started getting "limited or no connectivity" messages on my master workstation while sysprep was running. At that point, sysprep just quits. No errors or other messages. I thought it was tied to the PC I was using as my master workstation, like a failing ethernet adapter, but i've since tried two other models of PC's, switched ethernet cables, switched data jacks and switched to another VLAN. Same problem. I've even rolled back my base unattended to a version that was previously working. Same problem. I spoke with one of our network admins and there have some recent changes to our DHCP config re: min/max timeouts, but it was simply moving the values from being a global setting to a per subnet setting. The workstation still shows a 24 hour lease. One of point of interest is that the three systems i've tried to use as master workstations all use the same Broadcom 57xx ethernet adapter... I can probably find a system that uses Intel Pro 100 but it will be a touch slower.

Any other thoughts?

[_jd_]

I ran this through again w/ sysinternals filemon, regmon and tdimon capturing in the background. I'm just collecting the enormous log file and will see what I see...

I will also note that the PC is lost when this occurs.

[_jd_]

Ok. I watched the sysprep process, which isn't terribly exciting, and at 6:15 sysprep just quit and the "limited or no connectivity" message appeared. I'm just skimming through the logs...

I imported the FileMon logs (from 6:15:00 to 6:15:59) into Excel and sorted it by the status looking at anything that wasn't a SUCCESS. Right off the hop there are a few "BUFFER OVERFLOW" results around the same time, one of which relates to a "QUERY" call made by IPCONFIG.EXE @ 6:15:00 for "FileNameInformation" for "C:\WINDOWS\system32\ipcnofig.exe". Hmm. The other "BUFFER OVERFLOW" results are from CSRSS.EXE (Microsoft Client/Server Runtime Server Subsystem), one from WMRUNDLL.EXE and one from SVCHOST.EXE... more "QUERY" requests for either "FileNameInformation" or "FileAllInformation" for varies policy files.

Moving to the TDIMon logs I can see IPCONFIG fire up at 6:15:01... SVCHOST.EXE appears to initiate some DHCP related traffic at 6:15:03... also at that time the "System" process returns with a result of 0xC0000141 (NT_STATUS_INVALID_ADDRESS). By 6:15:08 i'm seeing "HOST_UNREACHABLE" results, which i'm going assume is when the system reports "limited or no connectivity".

I still have no idea what's causing this... and I really don't want to call M$.

[cluberti]

If you uninstall the Novell client (and any other Novell related software) and sysprep again, do you get the same behavior? It sounds like the WMRUNDLL.EXE binary could be the root cause, but note that buffer overflow errors when viewing filemon logs are fairly common.

It's actually the fact that the csrss.exe binary showing up before wmrundll.exe leads me to believe that it's likely the Novell client binary is attempting to use the Workstation or Server service, which run inside svchost.exe, to make an outbound or inbound connection somewhere (possibly the DHCP connection is being hijacked or monitored), and it's failing after sysprep.

Edited October 6, 2006 by cluberti

[_jd_]

I removed the -quiet switch from the call to sysprep and I got an error message, which was something to go on... I ended up tracking it down to some custom entries in sysprep.inf re: mass storage drivers that are required to support a specific controller. Doh.

[cluberti]