[SDP3][07d378dd-c97f-4184-8067-18138066e0b6] Windows Server Remote ServerCore Diagnostic

Windows Server 2008 R2 ServerCore installation option as well as Windows Server 2012 ServerCore installation option do not offer support for running SDP Diagnostics directly on the local machine.This specific diagnostic package to allow collecting diagnostic information from a Windows Server ServerCore machine via a remote machine.

From a machine runing the full Windows Operating System (Windows XP or newer operating system) and connected to the Internet, start the diagnostic package execution by following the instructions sent to you. In order to run this diagnostic on a ServerCore computer the machine used to start the diagnostic package must have network connectivity to the ServerCore machine that is being diagnosed. In addition, the user account needs to be administrator of the remote ServerCore machine.

Start the diagnostic package execution from the remote machine. You will be prompted the name of the ServerCore computer. Please type the name of the Server and then click 'Next'.

The diagnostic package will connect to the remote ServerCore R2 machine, install the prer-requisites (PowerShell and .NET Framework) and then execute the diagnostic package. After the execution finishes, the diagnostic package will collect the information from the remote machine and show the option to upload results.

Information Collected

Additional Information

Applied Security Templates

Audit policy

Best Practices Analyzer

Boot Information

DCDiag

Devices and drivers

DHCP Client

Directory Services related registry keys

Distributed File System Replication (DFSR) Information

DNS Client

Domain Controller Promotion Logs

Driver Verifier Information

Event Logs - Failover Cluster

Event Logs - General

Event Logs - Networking

Event Logs - PrintService

Failover Cluster Feature

File Version Information (Chksym)

Firewall

FSMO role owners

Functional Levels and Group Membership Information

General information

General Information

General Performance Information

General Registry Data Collection

Group Policy and User Environment

Hyper-V role

IPsec

IPv6Check

IPv6To4Check

iSCSI Information

KList utility output

Memory Dump Information and Files

Netlogon Logs

NetSetup Log

Power Settings

Print Drivers and Printers information

Print Registry

Registry Information

Replication Diagnostics Tool

RPC

Secure Channel Info

Server manager and server roles information

Servicing and related Logs

SMB Client

SMB Server

Storage Information

Storage related event logs on System log

System Performance Monitor

System Security Settings

TCPIP

Terminal Services Best Practices Analyzer

Terminal Services Query Results

W32Time

Winlogon Log

WINS Client

In addition to collecting the information that is described earlier, this diagnostic package can detect one or more of the following symptoms:

• Processes using a high number of handles
• Kernel Memory performance related problem
• ow System PTEs
• ow Virtual Memory
• Memory Dump Configuration Issues
• Detect if machine is a Virtual Machine running in Microsoft Azure
• Best Practices Analyzer errors or warnings
• Check pool memory allocated for 'D2d' tag
• Check pool memory allocated for RxM4 and SeTI tag
• Check pool memory allocated for 'SslC' tag
• Check pool memory allocated for 'Toke' tag on terminal services
• Check for Broadcom Advanced Server Program driver information
• Detect memory consumption of Mountmgr.sys driver
• Detect Pool Memory Allocation for ALPC and Power Management
• Check if registry key HKLM\CurrentControlSet\Services\Eventlog\Parameters exists
• Check if cluster groups are in Offline or Failed state
• Check for errors gathering cluster information via Get-ClusterNode cmdlet
• Check if the state of one or more cluster nodes is down or paused
• Check if Cluster service is not running or offline
• Check if Cluster Shared Volumes is configured to Redirected access
• Check if Cluster Shared Volumes is configured for Local Access
• Check if Cluster Shared Volumes is configured to Maintenance Mode
• Check if Cluster Shared Volumes is configured to Network Access
• Check if there are any virtual machine with High CPU utilization
• Check if Dynamic Memory is enabled to one or more Virtual Machines
• Check if Dynamic Memory is enabled on one or more Virtual Machines with old Integration Services
• Check for version mismatches of Integration Services
• Check if one or more Virtual Machines have virtual hard drives located on an disk with Advanced Format Drives (512e disks)
• Check for ephemeral port usage
• Detect Advanced Format Drives
• Detect Native 4K drives on the system
• Check if KB982018 is not installed or files are outdated
• Check for Symantec Endpoint Protection MR1/MR2
• Check for Evaluation Media
• Check if Page Heap is enabled to one or more processes
• Check if driver verifier has been enabled for at least one driver.
• Check if the Cluster Name Object (CNO) exists and it is enabled in Active Directory
• Check for LmCompatibilityLevel setting
• Check firewall rules on cluster nodes with IPv6 enabled
• Detect if there are no orphan resources
• Check if FailoverCluster Crypto resource exists
• Check for FailoverCluster missing dependent resources
• Detect if Cluster nodes have the correct CAU WMI namespace registered
• Detect if Cluster nodes have the correct MSCluster WMI namespace registered
• Check for large number of Inactive Terminal Services ports
• Checking if Registry Size Limit setting is present on the system
• Check PoolUsageMaximum Setting
• Checking for shared PST files
• Check for terminal services licensing binary versions for Windows Server 2003
• Check RPC settings for allowing unauthenticated sessions
• Check for Performance counters to see if there is an issue with NTFS metafile cache memory consumption
• Check for ProcessorAffinityMask setting for multiprocessor Windows Server 2003 machines
• Check for ClearPageFileAtShutdown setting which may cause slow shutdown
• Check for NMICrashDump setting on HP ProLiant DL385 G5
• Check the state of Application Compatibility Engine
• Check pool memory usage from Citrix XTE process
• Check if Users group have permissions under HKCR\CLSID
• Check HeapDecommitFreeBlockThreshold registry value
• Check for specific version of wsftpsi.dll known to cause Explorer crashes
• Detect Netapi32.dll version
• Check for missing registry keys that can cause issues with Component Services
• Check for 3GB and PAE settings in boot.ini
• Check the state of DCOM and DTS service and if RPC port range is configured
• Check if EMC Replistor Software is on machine but KB 975759 is not installed
• Check for unsupported versions of Windows Vista or Windows Server 2008
• Check if DEP and PAE is enabled on a 32-bit system
• Check if Telnet service is running under System account
• Check for known issue with BIOS version of PowerEdge R910, R810 and M910
• Check the value of 'SystemPages' in Memory Management registry key
• Detect Windows XP End-of-Support
• Possible startup performance problems on Hyper-V Servers due to a large number of orphaned registry keys
• Check Xeon Processor 5500 Series processor erratum related with Hyper-V (KB 975530)
• Check if update KB2263829 is installed on Hyper-V on Windows Server 2008 R2 Service Pack 1 systems
• Check if Tunnel.sys driver is missing a Windows Server 2008 R2 Server Core installation option
• Check for event ID 21203 or 21125 in the Microsoft-Windows-Hyper-V-High-Availability/Admin event log over the past 15 days.
• Check for event 602 on PrintService/Admin Event Log (KB2457866)
• Check for KB 982728 when Kyocera print driver is installed
• Check if print driver may fail to download from a Print Server due Point and Print Restrictions
• Check if HP Port Monitor HPTCPMON is installed
• Check if HP Print Services 'Net Driver HPZ12' or 'Pml Driver HPZ12' are installed
• The print spooler may crash or hang due to OEM HP print driver
• Checking for the presence of Zenographics Device Manager User Interface
• Check if HP Universal Print Driver was upgraded from 5.2 to 5.3
• Check for orphaned print jobs in Spooler folders
• Check for the number of subkeys under DevModes2
• Detect the presence of set*.tmp files in system32 folder
• Check the for Zenographics version 6.21 known for causing spooler problems
• Check for Print Update Rollup for Windows 7 and Windows Server 2008 R2
• Check the size of Client Side Rendering Print Provider settings
• Check if the binary version of win32spl.dll is older than required version.
• Check if Group Policy Printers are enabled and if application event 4098 is present
• Check for Active Directory replication failures
• Check if it has been too long since this domain controller replicated
• Active Directory replication is failing for one or more partitions: Status -2146893022 The target principal name is incorrect
• Active Directory replication is failing for one or more partitions: Status 1127 - While accessing the hard disk, a disk operation failed even after retries.
• Active Directory replication is failing for one or more partitions: Status 1256 - The remote system is not available
• Active Directory replication is failing for one or more partitions: Status 1396 - Logon Failure: The target account name is incorrect
• Active Directory replication is failing for one or more partitions: Status 1722 - The RPC server is unavailable
• Active Directory replication is failing for one or more partitions: Status 1753 - There are no more endpoints available from the endpoint mapper
• Active Directory replication is failing for one or more partitions: Status 5 - Access is denied
• Active Directory replication is failing for one or more partitions: Status 8452 - The naming context is in the process of being removed...
• Active Directory replication is failing for one or more partitions: Status 8453 - Replication Access Was Denied
• Active Directory replication is failing for one or more partitions: Status 8524 - The DSA operation is unable to proceed because of a DNS lookup failure
• Lingering objects have been detected
• Active Directory replication is failing for one or more partitions: Status 8451 - The replication operation encountered a database error
• Active Directory replication is failing for one or more partitions: Status 1818 - The remote procedure call was cancelled
• Active Directory replication is failing for one or more partitions: Status 8456 or 8457: The source or destination server is currently rejecting replication requests
• Active Directory replication is failing for one or more partitions with status 8589
• Active Directory replication is failing for one or more partitions with status 8333 - Directory Object not Found
• Active Directory replication is failing for one or more partitions: Status 8446 - The replication operation failed to allocate memory
• Active Directory replication is failing for one or more partitions: Status 8240 - There is no such object on the server
• Active Directory replication is failing for one or more partitions: Status 1783 - The stub received bad data
• Check for potentially risky audit failure settings (CrashOnAuditFail)
• Check for a possible STOP error caused by audit failure
• Check for High CPU usage by Local Security Authority Subsystem Service (LSASS)
• Check if either SYSVOL and/or NETLOGON shares are missing on domain controller
• Check for domain controller missing Rid Set reference attributes in Active Directory
• Check if DC is pointing to itself for DNS exclusively
• Check for USN Rollback
• Check state of Intersite Messaging service.
• Check if DFSR UpdateWorkerThreadCount setting is lower than 64
• Detect if IPv6 was disabled on a domain controller
• Detect Win32time configuration for time skew
• Detect MaxConcurrentApi NTLM bottlenecks or delays
• Detect Certificates with Weak RSA Keys
• Trusted Root Certificate Authority List Size Problem
• Check DNS Zones for top level CNAME records
• Windows Firewall start mode check
• Windows Firewall Running check
• Check if more than 32GB of Physical Memory and Operating System is Windows 2008 R2 Standard Edition
• Check if PMTU has been disabled on machine
• Check for unexpected TcpIp registry settings (KB 967224)
• Check for excessive number of 6to4 adapters which may result in decreased startup and logon performance
• Check for problem related Microsoft DHCP Relay Agent which may cause slow boot (KB2459530)
• Check HTTP Redirection on TSGateway
• Check if the SMB2 Client driver has been disabled.
• Check if the SMB2 Server driver has been disabled.
• Check if Opportunistic Locking has been disabled
• Check if InfoCacheLevel setting is configured to enable caching for all files and folders
• Check for the presense of HKLM\Components registry keys which indicate a recente component installation
• Check for the presense of Pending.XML in WinSxS folder
• Check if SYSTEM permissions in usbhub.sys
• Run DISM to check servicing corruption
• Check for Event ID 5 from Windows Backup (KB 2182466)
• Check the number of entries in FilesNotToBackup registry key
• Check for Bitlocker Drive Encryption Fixed Data Drive Read-Only Policy
• Detect the presence of vLite sofware though registry key
• Check state of 'Application Compatibility Engine' policy

References

For more information about the Microsoft Automated Troubleshooting Services and about the Support Diagnostics Platform, please open the following Microsoft Knowledge Base article:


2598970 Information about Microsoft Automated Troubleshooting Services and Support Diagnostic Platform