Chkdsk not working

[Kymera]

I have a Compaq Sever with a shared storage solution that has experienced some corruption. For some reason, the box always blue screens at 5:13pm, and then reboots and comes back with an error that reads something like : There was an internal error and one of the windows you were using has been closed. It is recommended that you save your work and close all programs, and then restart your computer.
And this happens as soon as you log in to the machine. An ideas about this would be greatly appreciated.

[Ya_know]

Event viewer...

You say that Chkdsk didn't work, did you initiate it, and it didn't run, or is it just not fixing this problem even though it seems to go through the motions?

What is the blue screen error? May have to turn off auto reboot in system properties under startup and recovery. If you know when it is going to reboot be there when it happens, and you can get it back online once you record the BS error.

What else is running on the server, application wise?

SP level, hotfixes up to date?

[Ya_know]

And when you say "shared storage solution" what exactly do you mean...?

[Kymera]

Two computers are directly connected to an external array via SCSI. It's a way for them to share the same information in real-time.

[confus-ed]

So what are we concerned about ?

That it always stops at 5.13 or that chkdsk won't run ?

Chkdsk will only run if its only connected to one machine (otherwise its 'in use' & can't be run), why it decides its had enough at 5.13 is another matter - maybe it wants to go home & have a beer !

[Kymera]

Looks like it's the NTFS.SYS that's causing it to blue screen. I have to take the stupid thing down and replace the existing file with a known good one.

[confus-ed]

Looks like it's the NTFS.SYS that's causing it to blue screen. I have to take the stupid thing down and replace the existing file with a known good one.

Errors in ntfs.sys are symptomatic of something else ! e.g corrupted file system, 'dirty' shutdown etc... try adjusting whatever o/s it is (do you say ?) so it just doesn't reboot but gives you the stop condition & look in event viewer. Tell us !

[Kymera]

I've got all that, and it's a stop 0x00000024 error, which points to disk. I know there's corruption since 4/10/03, but that doesn't explain why suddenly this box is rebooting once a day, except for today and weekends, at 5:10-5:13pm. Oh yeah, it's an NT4 box. I guess that's why I've been moved to this section I've already got a priliminary migration plan for this domain to XP/2k3 if I can get some purse strings to loosen around here, but first things first. I gotta stop this rebooting, and then I've got to fix the corruption on the drive.

[confus-ed]

Mmmm methinks we might just go around in ever decreasing circles with this ... 0x00000024 is 'lost handle' where the file system can't find some value it wants - so again that'd be symptomatic of some file system error !

I might just be backing this up, rebuilding & restoring & hoping to goodness that fixed it I dunno ! I'm still stuck on this 5.13 business ...

What has chkdsk got to do with this ?

[CeeBee]

Any scheduled task that runs around that time?
Any scheduled virus scan?
Any schedulled backup job?
Have you tried a chkdsk /f and then reboot?
I have seen such an issue while trying to backup files from a computer - the antivirus running on that machine was protesting to one of the files (although it wasn't infected) and was causing a reboot.

[Kymera]

I've been around the block several times with this and the solution was to replace the ntfs.sys file. It's not been an easy thing and those ilo boards are life savers.

Trust me I went through absolutely everything. The box is clean except for the RPC hotfixes and nothing happens before 8:00pm because we have west coast users. I'm still hung up on the 5:13pm thing myself and why would it suddenly start after running so well for so long?