- This topic has 27 replies, 5 voices, and was last updated 6 years, 7 months ago by .
-
Posts
-
Hi,
on our Domain controllers (not the other servers) with Windows Server 2012 R2 i get very often Error 2 when trying to search for new updates or doing other things that need the execution of the BatchPatchAgent.
After a reboot of the DC all is ok, and then after some time the issue is up again.
What can be wrong?
thx.
rgds.
Michael
Do you have any kind of anti-virus or host intrusion prevention software running on this DC? It sounds like the BatchPatchRemoteAgent.exe is getting deleted on the DC before BatchPatch is able to execute it, and anti-virus or host intrusion prevention software would be the likely culprits in this case.
The normal process that BatchPatch follows is:
1. Connect to remote computer
2. Put BatchPatchRemoteAgent.exe on remote computer
3. Remotely execute BatchPatchRemoteAgent.exe and retrieve its output
4. Delete BatchPatchRemoteAgent.exe
5. Close connection to remote computer
Exit Code 2 likely means that BatchPatchRemoteAgent.exe is being deleted by the remote computer as soon as BatchPatch puts it there, so then when BatchPatch tries to execute BatchPatchRemoteAgent.exe, the file doesn’t exist and so it throws error 2.
If you watch the C:Program FilesBatchPatch directory on the target computer when you execute the BatchPatch “Check for available updates,” you should be able to confirm that this is what’s happening. When you execute “Check for available updates” I would expect that we would see the BatchPatchRemoteAgent.exe appear for just a moment and then disappear, and then BatchPatch throws the Error 2. Is this what is happening? Are you able to determine what program on the DC is deleting the file?
I hope this helps. Please let me know what you find.
Thanks,
Doug
OK – It’s hard to say exactly what is happening here. What we SHOULD see is when the BatchPatchRemoteAgent.exe starts executing, it creates a number of .log files. However, those files are not getting created, which indicates that it is not getting executed properly in the first place. The only other place where there could be a problem is with PsExec. When execution begins you should see in Task Manager list of processes the PSEXESVC.exe. Perhaps that is what is actually getting killed by your AV software or by something else on the machine?
You could try a test to run at the cmd prompt on the BatchPatch computer: “psexec \targetDomainController notepad.exe”
This should spawn a notepad.exe process (hidden) on the target computer. In Task Manager on the target computer we should see both PSEXESVC.exe and notepad.exe. They would both stay there indefinitely or until you manually kill notepad.exe. After you kill notepad.exe, the PSEXESVC.exe process should disappear on its own.
In any case, given the fact that all of your other computers work, and given the fact that this DC does sometimes work right after it is rebooted leads me to believe that the issue is still something specific to the DC. I don’t think this is an issue with BatchPatch per se. Perhaps you can try to evaluate what else on the DC is different from your other computers? Is there anything different at all? Is there anything that happens on the dc after some period of time? Since BatchPatch works properly after a fresh reboot, does something change on the DC after it is online for a certain period of time?
There is no debug mode for the remote agent, but it doesn’t seem like it’s crashing. As you pointed out, if it were crashing, we would expect to see something in the event log to indicate the crash. It seems like it’s somehow getting killed by the DC. To date, we have zero reports of the remote agent ever crashing for any customers. The code for that exe is very clean, and this really seems like something that the DC is doing. I just don’t know what or why. I’m sorry I don’t have any better suggestions at the moment.
Let me know how it goes.
-Doug
Michael – next time when the problem manifests, can you check to see if the services console (start > run > services.msc) still contains the psexesvc service? Normally what should happen is psexec will automatically clean up after itself, and the psexesvc.exe process along with the psexesvc service will both disappear automatically. However, if the issue is that it’s failing to clean up after itself, then we should see psexesvc service still exist in the services.msc console. If that’s the case, instead of rebooting you can try running on the domain controller the following commands to manually clean up the service. See if that works and if you can successfully use BatchPatch after you do that.
sc.exe stop psexesvc
sc.exe delete psexesvc
(or I think you should be able to run this remotely with “sc \targetDC delete psexesvc”
You can see a bit more info at this forum: http://forum.sysinternals.com/delete-psexecservice-on-the-remote-computer_topic10926.html
However, I don’t know if it’s safe to call this a “bug” with PsExec. It seems to be more of a failure, that may occur in certain cases. I don’t know what those cases are. It clearly only happens in certain situations, such as in your case on just your DC sometimes. Personally, I have never experienced it in testing or in production, and I use PsExec a LOT, on thousands of computers. Overall, considering how widely PsExec is used, I think it’s probably a relatively rare situation. That said, considering that it only happens on one of your machines, and that in the world of IT it’s probably relatively rare seeing as though PsExec gets TONS of successful use all over the world, I would still think that there is likely *something* happening on that DC that is somehow not compatible. I don’t know what it could be or why it would continue to happen intermittently on that one computer in your environment. Unfortunately I don’t think we are going to see a fix or code change in PsExec that will address the issue.
Anyway, I would definitely be curious to know if using the SC.exe commands works for you. I realize it’s not a solution for the cause of the problem and is instead just a fix/workaround, but it would still be helpful to know if that works in your situation.
I’m sorry that I don’t have any better thoughts or ideas on the subject.
-Doug
Hi Michael – all I meant when I said I’m not sure that it’s a “bug” per se is that it clearly only happens on a very limited number of computers. A “bug” implies that there is a problem with the code that prevents it from working properly, and that the code could somehow be “fixed” to prevent the problem. However, I tend to think that since it happens so rarely in the world of computers, that it might not be a problem with the code, but rather there might be something with the particular computer that causes the issue. This is just speculation on my part since of course I’ve never seen the code for PsExec.
-Doug
I thought you were only seeing it on your domain controller and not on any other computers? I have so far not been able to reproduce it. What installation media are you using? Is this the English version of Windows? Are you only seeing it on Windows 2012 (non R2) ? What roles are you installing?
One thing you might try as a test is download the program called “paexec” which is an alternative to PsExec and is also free. Replace psexec with paexec (and rename paexec to psexec) and see if it has the same problem.
-Doug
It’s probably the same error just being reported slightly differently, especially if you notice that the paexec service doesn’t get removed properly either. I wonder if there is some sort of 2012 DC incompatibility with these apps. While I’ve certainly tested all Windows OSes, I have not specifically tested a 2012 DC, so I’ll see if I can reproduce on a fresh test 2012 DC.
-Doug
OK – I see now that you’re saying that BatchPatch is giving you “error -2” when you try to substitute paexec for psexec. I had thought that you meant that when you ran paexec at the cmd prompt that it would give error -2.
I just installed a fresh 2012 (non-R2) domain controller (I just built it from scratch with nothing but AD and DNS), and I am able to use it as a BatchPatch target without any problems. It works flawlessly. I’ll test a 2012 R2 domain controller next to see what happens, but I suspect it will behave properly just as as all of my other 2012 R2 (non-dc) tests have. I’ll let you know. I still believe that the issue you are experiencing is unique to your particular domain controller.
I’m going to email you directly regarding the error -2 because that is a separate issue that has to do with the BatchPatch configuration for paexec.
-Doug
I also had the same issue and found that when the PSExec service was removed from the affected server and also update the PSExec version to v2.1 (http://technet.microsoft.com/en-us/sysinternals/bb897553) It solved the issue.
Did you find solution on this?
I read this thread and I am experiencing same issue as mstenz. Target server is Windows Server 2008 R2 and when PSEXEC command is executed, I see PSEXESVC.EXE on C:Windows directory.
And neither I am able to delete PSEXESVC file manually from target server, or able to stop/delete service using SC.exe
Note
-This is only server having reported issue
-There are other servers from same domain controller running Win 2008 R2 have no issue.
Definitely bug in PSExec but do not know why it is happening on only one server and how to fix?
If you aren’t able to delete the psexesvc or stop/delete the service, then it sounds like maybe the psexesvc.exe process is still running! Check that first. If that process is still running/hung, then there is your problem.
-Doug
To be specific; psexesvc remains for almost 2-5 mins on target server. Running any of following command on target server I get an error “OpenService failed 1060”
sc query psexesvc
sc stop psexesvc
sc delete psexesvc
If PSEXESVC.exe manually deleted from windows explorer it appears again.
I understand it sounds like; PSEXESVC handle is not released by system or it is still running. But how? as PSEXEC on local server completes execution within few seconds.
I have to wait for 2 to 5 minutes before executing next PSEXEC command.
Appreciate doug your quick response.
Running all above commands as an Admin
And I am using PSExec 2.11 version
When you run “sc query psexesvc” then if it exists you should not get “OpenService FAILED 1060” because that means that the specified service does not exist as an installed service. You would normally only receive 1060 after the service is removed (it removes itself when it is done). That said, it’s really unclear what is happening on your machine. What you are describing doesn’t really make much sense to me. Do you have some type of Anti-Virus or other security related software such as Host Intrusion Prevention Software or similar that is placing a lock on the file? I’m not sure what else could be happening. Did you try the free paexec instead of psexec? I would give that free paexec a shot (rename it to psexec and delete all copies of psexec) to see how it goes. Maybe it will give you better/different results. Maybe not.
Agree with you doug, on this.
Good luck. Let me know how it goes.
-Doug
I’ve run across something similar to this. It only happens on one server but the error 2 occurs from just about any command that I try to execute via BatchPatch. For this particular example I “Checked For Available Updates” and got the error “Windows Update: Error 1611:2”. My server lists are setup by hostname. I found that if I used the IP address of this server instead of it’s hostname, the command executed flawlessly. Actually, every command runs flawlessly if I use the IP address. I deleted the server from my list and added it back again by hostname. The error returned. I then added the server back “from Directory” and the error still occured. I added the host from directory and checked the box to “Append DNS suffix to hosts” and voila! There’s no more error. In short, by IP address or added from directory with DNS suffix appended works flawlessly. Again, this is the only server (out of 13 that I manage) that I have to do this for. I know how to get around the issue, but it would be great to know why this is an issue. Any help would be appreciated.
If IP and FQDN work fine but host name without FQDN does not work, then you’re dealing with an issue in your environment, not really a BP issue per se. My guess is it’s something in your environment probably with DNS (or possibly NetBIOS, though less likely). For DNS, some quick guesses are that it could be an improper DNS suffix being appended by your network interface, or an invalid PTR record or a missing A record in the DNS zone on the server. I can’t guarantee that one of these is the issue, but they would be the first things that I would look at.
-Doug
- You must be logged in to reply to this topic.