Share via

2022 Server randomly requires reboot due to "The RPC server is unavailable." error

Anonymous
2024-07-25T16:46:16+00:00

I have a 2022 Server that randomly (usually once daily, no specific time) stops allowing RDP and local logins. It throws an RPC server is unavailable error. Any one still logged in remains in, though they are unable to reset/shut down the server. When attempting to do so via cmd prompt it returns RPC error as well. Any new login get the error after typing in user/PW. Doesn't matter if it's a domain or local account. Only way to get past this is a hard reboot.

After the reboot things return to normal and logins happen just fine. This is a VM running in Nutanix AHV. Things I've tried so far:

Upgrade VirtIO driver

Checked DNS

Checked Time

RPC service is running
Remote Registry isn't running, but it is set to auto start (triggered). Checked other working servers and it was set to this.

Checked this page from MS

https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/not-log-on-error-rpc-server-unavailable

UPDATE:

To save everyone some reading, there appear a common factor between a lot of the community. Sentinel1. Some users are reporting uninstalling it has fixed there issue. Others are downgrading versions.

Windows Server Remote and virtual desktops Session connectivity

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question. To protect privacy, user profiles for migrated questions are anonymized.

0 comments

38 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2024-08-15T13:49:09+00:00

    I'm not so sure it was S1 in my environment. We have over 100 servers running S1 and I've only seen this issue on 2 of em. Funny enough they are a Prod and Dev box running the same things. I'm leaning more towards some piece of software (at least in my case) since it happened to both, and around the same time. It COULD be S1 blocking stuff based on the software being ran on the computers though. I wish I had some way to verify, but when RPC goes down it takes event logging with it. RIP

    I did raise this issue with my SOC when it first started happening as I though it may be DNS being blocked as well. They checked and didn't see S1 doing anything funny on either box.

    0 comments
  2. Anonymous
    2024-08-15T14:14:37+00:00

    On your servers having issues, do you see it killing these services in Event Viewer for the System logs?

    The SysMain service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.

    The Microsoft Defender Antivirus Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service.

    The Local Session Manager service terminated unexpectedly.  It has done this 1 time(s). ( I wonder if this service being terminated is the main culprit)

    0 comments
  3. Anonymous
    2024-08-15T14:25:45+00:00

    When ever we noticed the error I had to hard reboot. Checked event viewer and no errors, but logs just stop at a certain time (presumably when the RPC error happened). The system would be up and running. If anyone was logged in when the RPC error happened they remained logged in. They were unable to perform any sort of login / out operation though. Couldn't reboot the server, couldn't sign out or switch accounts. Even though they system was still operational it was not logging any events. The error seemed to have stopped any logging so it left us in the dark as to what was really going on.

    0 comments
  4. Anonymous
    2024-08-15T14:26:28+00:00

    For sure. We think the local session manager stopping is the main culprit. We've seen this issue on both servers and workstations since about mid July btw. Uninstalling S1 seemed to resolve the issue.

    1 person found this answer helpful.
    0 comments
  5. Anonymous
    2024-08-15T14:35:33+00:00

    Exact issue we are seeing. We have S1 installed on about 1500 endpoints. We have seen this issue on about 15 or so, that we know of.... Still working with our vendor Pax8 and S1 support to gather logs so they can diagnose.

    0 comments