Possible Network Security Issue (Windows Server 2000)

I have an interesting problem that I could really use being guided in a direction with. It's somewhat complicated, but I'll do my best to describe it clearly here. Here's the breakdown:

First, we're dealing with a network in which three servers are pertinent to the issue. There's DATASERV, which holds K:, L:, and M: drives that everyone on the network has access to. Access to these drives is through another server called MSERV, so when MSERV is down, no one can access the K:, L:, and M: drives.

The problem we're having is that MSERV keeps shutting itself down. It looks like it may be an issue with the power supply, but we are not yet sure. So this issue is two-prong. First, we're trying to figure out exactly why MSERV is shutting itself down, and second, we're trying to establish a backup server for when it does.

HPSERV is the server that's meant to take over when MSERV goes down so users can still access the three drives. So far, this has been successful with other applications, however, users still cannot access the K,L,M drives when MSERV is down. HPSERV should be adequately taking over in this regard when MSERV goes down, so the question that arises is if there's a security issue we've overlooked that's prventing HPSERV from granting the access to these drives that MSERV would otherwise do.

Did everyone follow that? :)

So, all I need is a direction to start in, because this is all still very much new to me. Where do I need to look to find out if there's a security policy issue, and what else should I consider? What steps can I take to determine for certain if we are having a power supply problem with MSERV?

the OS of these machines would REALLY help
geez
pro,server,advanced,sbs,enterprise etc
do you have all the service packs\hotfixes installed.on all machines..????

How exactly do you access the DATASVR???

through authentication, mapped drives???

Are there any messages in the event log of the machine shutting down?

Possible UPS shutdown??

You might try looking in my subject line for the OS. Just a thought. :)

I am currently trying to install service packs, but that brings up another interesting problem -- that MSERV keeps shutting itself down before Windows Update completes. As for the others, I'm currently in the process of getting them all updated.

Windows 2000 is a little broad........
are they actually servers???

Is MServ a domain controller? Because you might have problems connecting to another computer by share names if your DNS server is down. Do you have a backup domain controller? If not you might want to consider making HPSERV a backup domain controller so that when MSERV shuts down, everything goes to the backup system.

Windows 2000 is broad, but Windows Server 2000 is a little more specific. Gotta pay attention to those subject lines. ;) Yes, all three are actually servers.

You access DATASERV through a program called Terminal Services Client, and users access the K,L,M drives by mapping to them.

I've been scanning the event log, but haven't found anything on it shutting down yet. However, when the computer shuts itself down, the past couple of times I've actually had to disconnect and reconnect the power cable twice before it would even come on again.

....and I am not sure this really is a security issue???

One thing is to make sure all "servers" are running at the same service pack level......

When you say shut down....does it just reboot..or turn itself off

I would start disabling all 3rd party services...and see if it happens then.

Get your updates.

Look at the event log to try and determine what is happening before the shutdown occurs.

I had a bad UPS shut down my server a couple of times..was fixed by disabling that service and then replacing the UPS.

As far as the server shutting off I had the same issue and it turn out to be the motherboard.
The best way to check to see if it's the psu is to switch it out with one you know works. From my experience when a psu goes, its dead and you wouldn't be able to boot up at all.
Please correct me if I'm wrong.

Yes, in fact MSERV and HPSERV are both domain controllers. The idea is for HPSERV to take over as the backup controller when MSERV is down, but that hasn't quite worked yet. When MSERV is down, HPSERV is succesful in part because users can get to DATASERV through Terminal Services Client, but at the same time they can only access K,L,M when MSERV is up -- HPSERV still won't take over with that part yet.

Wow, I'm getting respones faster than I can post replies! Thanks everyone for the input...

All servers may not yet be running on the same service pack, so that's a good issue to bring up. I'm working on getting them all updated.

When it shuts itself down, it shuts down completely, as in even the green light on the back goes off. And like I said above, you actually have to mess around with the power cable until it will even come on again.

Thanks...

Quote:

---

Originally posted here by AngelicKnight
Wow, I'm getting respones faster than I can post replies! Thanks everyone for the input...

All servers may not yet be running on the same service pack, so that's a good issue to bring up. I'm working on getting them all updated.

When it shuts itself down, it shuts down completely, as in even the green light on the back goes off. And like I said above, you actually have to mess around with the power cable until it will even come on again.

Thanks...

---

Sounds like it could be a bad power supply. I have had this happen once or twice on home computers and a new power supply fixed the problem. (I believe the power supply was creating too much heat)

I found this cool little tester for power supplies http://www.directron.com/tester1.html
Thought you may be interested.

Is MSERV a PDC.... or is the PDC another server ( PDC = Primary Domain Controller )

A couple things, the try adding HPSERV as a second dns server(it is running DNS isnt it, with an active directory integrated zone for the domain name of Active Directory?) for all the client machines, hopefully through dhcp, but anyway.

DNS may be your issue with the authentication

As for the fail over as mapped drives, are you using distributed file system?

I'm actually not sure if it's the PDC or not -- I've just recently been brought on this network so I'm learning crash-course style as I go along (thank goodness for AntiOnline!). However, I do think it is the PDC, nearly certain. How do I check?

The DNS possibility is interesting. What steps would I take to troubleshoot that?

Run srvmgr.exe from run cmd line under this application you should select "View" then select servers, under servers you will see which server is the PDC...it will list as primary, also you should see which is a bdc (backup domain server).
srvmgr.exe is located under server tools under i386 dir on server cd or resorce cd if it isnt on the main 2000 server..... but it should be so all you need to do is run that from the run line

Okay, MSERVER is the PDC and HPSERV is the BDC then.

Okay guys, they've decided to buy a new server to replace this one. So, now my assignment is to demote MSERVER so that is no longer the PDC. Then I'm supposed to remove it from the network as a controller. How do I do that?

Quote:

---

Access to these drives is through another server called MSERV, so when MSERV is down, no one can access the K:, L:, and M: drives.

---

Why/how is that? If it is the primary domain controller thats going down it may be as CXGJarrod mentioned a resolution problem. Try setting up the PDC as a Primary WINS server and the BDC as a secondary WINS, so if the PDC goes down the clients can still resolve NetBios shares through the BDC.

-Maestr0

OK, a windows 2000 pdc(bad name for it, as there really isnt a primary / backup with active directory all domain controllers are equal, except for certain limited roles) Runs active directory, in order to remove it,

Have another server running active directory, make sure it is running AD integrated dns for the domain name

on the server you wish to demote, go to start, run

and in the box type

dcpromo

and hit ok. That should bring up the wizard for removing Active Directory and demoting the domain controller, make sure you already have another domain controller in the Domain.

You can add a domain controller to the domain using the dcpromo command as well, on the server you wish to promote.

Ok ..good technically when the PDC goes down the BDC is supposed to kick in and run as PDC until the PDC server is back up , in a W2K enviroment there are no pdc or bdc just DC Domain controlers, therefore when the main DC fails anoth DC should still be able to authenticate users and profiles, this will give you the ability to repair the main DC and still have users log onto the network. one more question is the DNS and WINS and DHCP server all on the main DC machine.

In Short either way you look at the network you will need some downtime to further troubleshoot the server crashes. It would make life easier if there was another dc on the network so that users will not fail to authenticate...but not knowing totally how the servers are set up it would be safer to schedule downtime maintenance in an non-peak hour and apply the maintenance to the server that is faulting out. Got another Question, Have you viewed the event log on the server in question for any events that flag or pertain to the crashes on the server.

here is an helpfull link in the meantime ..... maybe this site has a direction you can pursue.
http://www.labmice.net/troubleshooting/default.htm

As everyone says, make sure they are all on the same SP with the same hotfixes. Also, check the replication of AD. It sounds almost as if the AD permissions on the two DCs are not exactly in sync.

If AD replication is the problem, I'd also consider setting up an alternate NIC on each server to handle AD replication. If they are physically close enough, use a crossover cable. That way even if the net fails, AD can still replicate.

Why not just make all 3 servers AD domain controllers and use DFS (distributed file system) in conjunction with Terminal Services? Are there security or data integrity issues preventing this, or is the third server a NAS or SAN device?

As for DNS, one of them is obviously a DNS root server. You can use the nslookup command to find out which one. If the other isn't runnung DNS, set it up as a backup DNS and have the primary replicate to it. You can also troubleshoot DNS with the dcdiag.exe tool from the Windows 2000 resource kit (it's still available from Microsoft's website, last time I checked).

Just a thought.

Another bit of information which may be usefull is the mark of the servers and their type. One of the first things i would do when i have a server doing strange things is to connect to the support site of the maufacturer. Another good site to check out is microsofts technet site.
It is true that the problem does look like a power supply problem or an problem of overheating. Is your server in a well ventilated area?
As for the problem your users have with connecting to the shares on the server I have a couple of questions you may ask yourself.
1) what are the differances between the two servers use to connect.
2) How are the shares connected when the users logs on?
3) Is the problem the same for everyone. ie Do you have the same problem when you log on the second server as the administator as a user does?
4)Have you noticed any error messages. The present of errors will depend largly on how the shares are connected.
6) What are the reasons ,security or otherwise, for this system of file sharing?
7) what are the results when you create a new shares on the file server with no security restrictions! Can you user connect to it?
8) what events do you get when you put a security audit in place on the file server? I would audit connexion succes and failur for certain shares.
9) Is the file server visiable from the second server. if not a problem with the DNS is a good bet.
I would think that you have a problem of authentification between you connexion server and your file server.
hope some of these points help

P.S. on a more personel note I would agree with what you said about the community. i havent been a member long but i am more than impressed by the attitude of the people who are present on this site. My only regret is i didnt find it sooner, like when i was having major problems with a dr watson, network connections and intels landesk manager, ah well such is life.

Okay, we're finally coming to some solutions over here, among which we're going to replace this darn server. But that brings up a new question that I'm researching -- How do you move the global catalog and operations master roles to one of the other DCs? I'm sure that's done through either Active Directory or MMC, but I don't what steps to take. However, we need to do this when we demote this server and remove it.

Single master operations roles can be moved using warious mmc AD utils... you may need to install the schema snapin for mmc, I do not think it installs by default..

http://www.microsoft.com/technet/tre...rFSMOroles.asp

how to move the global catalog..
http://support.microsoft.com/?kbid=313994

to install the schema snapin if you havent already, go here...
http://www.microsoft.com/windows2000...all_Snapin.htm

for more info about master roles...
http://www.microsoft.com/technet/tre...ag_ADFSMOs.asp

I believe most of the single master roles will automatically transfer when you demote a domain controller, not sure about the global catalog.

I had a domain controller die completely on me once, and had to sieze all of those roles forcefully using ntdsutil from the command line. That wasnt much fun...

tabich is right, you'll have to install schema snapin. As for the global catalog, if AD replication is configured on the DC's, they should all contain a pretty close copy of the global catalog. If you downgrade the first DC on the domain, it should force an enterprise-wide AD replication of the entire AD schema, including master roles, global catalog, and any other AD dependants to occur before it completes the demotion process.

Thanks, that helped a lot. So how do I find out which operation master roles the server currently has (and thus needs to transfer)?

i am running a windows 2003 Domain so for a Windows 2000 domain these steps migth be a little different.
the procedure to find out the operations masters in a AD is the following :

for the global catalog
open active directory site and services
if you have a site set up go to the site folder
expand the server to see the icon NTDS Settings
right click on the icon and go to properties
check to see if the box it ticked

for the other roles (RID, PDC, INFRASTRUCTURE)
open active directory users and computers
right click on your domain and go to the item operations masters( in 2k this might be higher in the structure right at the root i.e active directory users and computers).
the first area has the DNS name of the current operations master. the second is the name of the current server on whiched you are logged. to change operations master these need to be different.
hope this helps

Thanks, I believe that answers all my questions! We'll be ready to go through all the proper steps now once the new server comes in.