Computer Browser Service

[Brain Ache]

Hi All,

We have had an issue last week where the Computer Browser service had stopped on 5 servers (across different days, no obviosu pattern, both 2000 Pro SP4 and 2003 STD SP1 IBM boxes) - meaning users could no longer access files on these servers. I could ping and RDP onto server, but browser functions weren't working. I went on the server and started the service and it all worked again.

I need to find the cause - each server has been virus scanned and hasn;t picked anything up.

I have done some research about the browser service, but am a little confused. Does the browser master occur on the DC's or randomly on any server that has the Computer Browser service installed (i.e server editions of Windows?)

Can see much from the logs? Any idea where I should start looking?

Any help would be much appreciated!

Thanks

[mcb2001]

first, i would look in the registry database, and check if the services is setup to "run once" or "run" - cause in case they are set to "run once" they wont be restarted on closing.

The idea is, that if the service fails, you can get it up and running again, without manually restarting it.

This is usually alot easier, the only problem is, that you actually dont know that it often fails, until it makes the system reboot.

But most programs fail at some point, and usually a simple restart fixes it.

These can be found by a "startup inspector" program, or by going to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

and then find where the service is started, and posibly move it

if its in CURRENT USER run once, move it to CURRENT USER run

and same for LOCAL MACHINE - just dont move it from CURRENT USER to LOCAL MACHINE, since it will get run by any user logging in...

You can also find the services under "start menu" - "programs" - "administration" - "services"

you might have to set it to visible, by rightclicking the taskbar, go to the "start menu tab", select adjust/setup/whatever its called, and select "show administration".

I would also check the access log, to see if there are any overloads, or high loads. f.x. a D.O.S. attack at the system...

Last thing i would check is wether or not other services also stops - similar services that is.

And last thing, if you can replicate the incident, that would be the easiest, but my guess is that you can't, so hope this helps, and

[cozofdeath]

If it is off you should still be able to map drives, that may help users in case it happens again. But a DC will always be a master browser, if of course there is a domain set up. The rest will probably be elected backups depending on the size of the network.

[Brain Ache]

Thanks everyone.

Looked at all logs and everything that I could think of before I posted.

Also check DC's and WINS servers (2003 domain with NT4, 2000 and XP clients) and couldnt see anything.

Starting the service fixed the problem, but management want to know what happened and how to prevent it happening again.

Does anyone know what things could stop this service on a server (2000 Pro and 2003)

Thanks agan

[ɹəuəllıʍ ʇɐb]

You could check the Event Log Viewer if there is anything in there related to the service; maybe it crashed?

[Brain Ache]

Event Viewer was the first thing I checked. There is no reference to this service, hence why I have posted here.

Does anyone have a good understanding oif this service and what is likely to crash it? Any certain dlls???