touchstone_81

yeah i suppose that could happen to people but in m case the exchange is in a seperate domain seperate subnet so we can safely rule that out.Its just that i am finding it difficult to identify whats calling this "svchost - network service" . i mean something i sobviously telling it to go out on the network and do something just cannot figure out what.

For the last couple of weeks my domain account is constantly getting locked out. I used eventcombe and found the source to be a standalone server not part of the domain. after looking at the security event logs on source server " serverA" i found numerous "552 event ID's" these messages suggest process with PID 712 is making several connections to all member servers in the domain. 712 in taskmgr corresponds to "svchost /Network Service" with remote procedure call as its sole child process i have tried numerous things to figure out what is calling this process but no luck so far.Recreated my profile unmapped all network drives checked scheduled tasks, scripts etc. This is really driving me nuts so if somebody can help me out with this i would be eternally gratefull! Event Type: Success Audit Event Source: Security Event Category: Logon/Logoff Event ID: 552 Date: 1/20/2010 Time: 6:04:33 AM User: NT AUTHORITY\SYSTEM Computer: ServerA Description: Logon attempt using explicit credentials: Logged on user: User Name: ServerA$ Domain: WORKGROUP Logon ID: (0x0,0x3E7) Logon GUID: - User whose credentials were used: Target User Name: "my username" Target Domain: "Domain Name" Target Logon GUID: - Target Server Name: Member Server Target Server Info: Member server Caller Process ID: 712 Source Network Address: - Source Port: -

It does but i didnt see any disk errors. These are Dell poweredge 2950 servers.

Recently we had this server that started logging Event ID 55 :" file system corrupt/unusable.please run chkdsk on volume *" well we did run chkdsk and it came back and said corrections were made but only after a day the errors came back. Contacted Dell and they typically suggested that we upgrade the firmware of RAID scsi and whatnot.Since there was nothing else to try we agreed to this but then i noticed that 3 other servers were logging the same event.This led me to belive that it isn't actually a filesystem problem but some process thats setting the corrupt flag. Any thoughts on how to go about this would be appreciated.

Due to shortage of time we have decided not to use any 3rd party software in our DR test.But now the problem is that we are using 64bit win2003 R2 and this is not supported by the dumpcfg.exe (used to change the disk signatures) tool. Read somewhere that the registry can be modified to point to new disk signature .If Cluberti or someone knows which keys to change i would be grateful.

Hi Cluberti thanks for the reply. There are 2 clusters each with 2 nodes and it is in active/active mode because thats a client requirement.The applications are SAP management apps supported on an Oracle database which are administered by the client.

Hi all, As you know in most environments, clusters operate in an active/passive mode – the passive server providing hardware redundancy. In a DR situation, generally only one of the two servers are restored. However, since we operate in active/active mode, required to support the work load, both servers must be recovered. Restoring to unlike hardware (Dell to HP) presents some additional challenges. The recommended approach is to build the systems from scratch. However, based on comments during our weekly meeting that installing the application from scratch would take days, and so is not feasible. Currently we are looking at a software known as Double-Take which is mighty expensive and not sure if this would overcome the disk signature problem. If anybody has any ideas or has been in a similar situation please share your ideas. Thanks in advance.