Strange problem in my network

Hi,

In one of my site, I got this strange problem, and I really don't know what
it could be. The problem that I'm having might be multiple problems. Here's
pretty much of what I know about it:

- All my workstations in this site are frozen: Actually, Explorer.exe is
using all the CPU resource, and the workstation becomes inoperative. This
will last for about a minute to 5 minutes.

- Strangely, I ran a Wireshark on my workstation, and during the period
where the Explorer.exe was going wild, no TCP packet were coming through.
Others protocols were going in, but not TCP.

- An other oddity, this network freeze seems to happen only between 10:30
and 11:00. Not everyday, but most likely Tuesdays and Wednesdays. I've looked
everywhere for tasks that might be running during this period of time, and
found nothing.

- I've looked all my network infrastructure and everything is running fine.
No tasks running on that side either.

- My main file server, is acting weird. When browsing the file system on
that server, their allways a short lapse of time where the click on a folder,
is not responding.

I'm running Windows 2003 enterprise server R2 on the file server, and all
others servers are running Windows 2003 standard.

I don't have any clues of what my problem might be. Their's no messages in
the event viewer of any of my servers or workstations.

Thank you a lot

Hello,

can you check:
Windows update (hour to install, how often to check)
antivirus settings (scheduled scan from server console or on client)
run windows defender and or spybot
eventlog (error, running things)


--
Cordialement,
Mathieu CHATEAU
http://lordoftheping.blogspot.com


"r14edge" <(E-Mail Removed)> wrote in message
news:EEE1BF85-044E-481C-9759-(E-Mail Removed)...
> Hi,
>
> In one of my site, I got this strange problem, and I really don't know
> what
> it could be. The problem that I'm having might be multiple problems.
> Here's
> pretty much of what I know about it:
>
> - All my workstations in this site are frozen: Actually, Explorer.exe is
> using all the CPU resource, and the workstation becomes inoperative. This
> will last for about a minute to 5 minutes.
>
> - Strangely, I ran a Wireshark on my workstation, and during the period
> where the Explorer.exe was going wild, no TCP packet were coming through.
> Others protocols were going in, but not TCP.
>
> - An other oddity, this network freeze seems to happen only between 10:30
> and 11:00. Not everyday, but most likely Tuesdays and Wednesdays. I've
> looked
> everywhere for tasks that might be running during this period of time, and
> found nothing.
>
> - I've looked all my network infrastructure and everything is running
> fine.
> No tasks running on that side either.
>
> - My main file server, is acting weird. When browsing the file system on
> that server, their allways a short lapse of time where the click on a
> folder,
> is not responding.
>
> I'm running Windows 2003 enterprise server R2 on the file server, and all
> others servers are running Windows 2003 standard.
>
> I don't have any clues of what my problem might be. Their's no messages in
> the event viewer of any of my servers or workstations.
>
> Thank you a lot
>

Hi Mathieu,

We use to have a WSUS server in that site and we stop it. Didn't change a
thing, but I'll look at our GPOs for automatics update. Our Antivirus
solution update during the night and the workstations definition should be
update during our lunch time. The Antivirus was one of my first potential
cause. I'll have another look at it. As for windows defender and spybot, my
antivirus software is suppose to take care of spyware and other malwares. For
events, nothing.

Thanks for replying so fast (Merci pour ta réponse)

Fred



"Mathieu CHATEAU" wrote:

> Hello,
>
> can you check:
> Windows update (hour to install, how often to check)
> antivirus settings (scheduled scan from server console or on client)
> run windows defender and or spybot
> eventlog (error, running things)
>
>
> --
> Cordialement,
> Mathieu CHATEAU
> http://lordoftheping.blogspot.com
>
>
> "r14edge" <(E-Mail Removed)> wrote in message
> news:EEE1BF85-044E-481C-9759-(E-Mail Removed)...
> > Hi,
> >
> > In one of my site, I got this strange problem, and I really don't know
> > what
> > it could be. The problem that I'm having might be multiple problems.
> > Here's
> > pretty much of what I know about it:
> >
> > - All my workstations in this site are frozen: Actually, Explorer.exe is
> > using all the CPU resource, and the workstation becomes inoperative. This
> > will last for about a minute to 5 minutes.
> >
> > - Strangely, I ran a Wireshark on my workstation, and during the period
> > where the Explorer.exe was going wild, no TCP packet were coming through.
> > Others protocols were going in, but not TCP.
> >
> > - An other oddity, this network freeze seems to happen only between 10:30
> > and 11:00. Not everyday, but most likely Tuesdays and Wednesdays. I've
> > looked
> > everywhere for tasks that might be running during this period of time, and
> > found nothing.
> >
> > - I've looked all my network infrastructure and everything is running
> > fine.
> > No tasks running on that side either.
> >
> > - My main file server, is acting weird. When browsing the file system on
> > that server, their allways a short lapse of time where the click on a
> > folder,
> > is not responding.
> >
> > I'm running Windows 2003 enterprise server R2 on the file server, and all
> > others servers are running Windows 2003 standard.
> >
> > I don't have any clues of what my problem might be. Their's no messages in
> > the event viewer of any of my servers or workstations.
> >
> > Thank you a lot
> >
>
>

WSUS client can take up 100% cpu (seen as svchost) if update includes office
things.
What about if workstation are powered off during night ?
I guess they got the definition + nightly scan just after powering on.

--
Cordialement,
Mathieu CHATEAU
http://lordoftheping.blogspot.com


"r14edge" <(E-Mail Removed)> wrote in message
news:7EF96B0A-D355-4A5A-8C28-(E-Mail Removed)...
> Hi Mathieu,
>
> We use to have a WSUS server in that site and we stop it. Didn't change a
> thing, but I'll look at our GPOs for automatics update. Our Antivirus
> solution update during the night and the workstations definition should be
> update during our lunch time. The Antivirus was one of my first potential
> cause. I'll have another look at it. As for windows defender and spybot,
> my
> antivirus software is suppose to take care of spyware and other malwares.
> For
> events, nothing.
>
> Thanks for replying so fast (Merci pour ta réponse)
>
> Fred
>
>
>
> "Mathieu CHATEAU" wrote:
>
>> Hello,
>>
>> can you check:
>> Windows update (hour to install, how often to check)
>> antivirus settings (scheduled scan from server console or on client)
>> run windows defender and or spybot
>> eventlog (error, running things)
>>
>>
>> --
>> Cordialement,
>> Mathieu CHATEAU
>> http://lordoftheping.blogspot.com
>>
>>
>> "r14edge" <(E-Mail Removed)> wrote in message
>> news:EEE1BF85-044E-481C-9759-(E-Mail Removed)...
>> > Hi,
>> >
>> > In one of my site, I got this strange problem, and I really don't know
>> > what
>> > it could be. The problem that I'm having might be multiple problems.
>> > Here's
>> > pretty much of what I know about it:
>> >
>> > - All my workstations in this site are frozen: Actually, Explorer.exe
>> > is
>> > using all the CPU resource, and the workstation becomes inoperative.
>> > This
>> > will last for about a minute to 5 minutes.
>> >
>> > - Strangely, I ran a Wireshark on my workstation, and during the period
>> > where the Explorer.exe was going wild, no TCP packet were coming
>> > through.
>> > Others protocols were going in, but not TCP.
>> >
>> > - An other oddity, this network freeze seems to happen only between
>> > 10:30
>> > and 11:00. Not everyday, but most likely Tuesdays and Wednesdays. I've
>> > looked
>> > everywhere for tasks that might be running during this period of time,
>> > and
>> > found nothing.
>> >
>> > - I've looked all my network infrastructure and everything is running
>> > fine.
>> > No tasks running on that side either.
>> >
>> > - My main file server, is acting weird. When browsing the file system
>> > on
>> > that server, their allways a short lapse of time where the click on a
>> > folder,
>> > is not responding.
>> >
>> > I'm running Windows 2003 enterprise server R2 on the file server, and
>> > all
>> > others servers are running Windows 2003 standard.
>> >
>> > I don't have any clues of what my problem might be. Their's no messages
>> > in
>> > the event viewer of any of my servers or workstations.
>> >
>> > Thank you a lot
>> >
>>
>>