Win2K SP4 News; RPC Bug; Print Spooler Problem; and more

Win2K SP4 News
I heard from Tony Pedretti, one of the Windows 2000 Service Pack 4 (SP4) beta testers, this week and wanted to pass along his comments. As of June 18, beta testers are working with the second refresh of the SP4 release candidate. Pedretti is testing the service pack on workstations in a non-Microsoft network environment. Overall, he’s pleased with the current version, giving the update a rating of excellent. According to Pedretti, the second refresh eliminates slow application performance and shutdown problems present in the first cut and said the SP4 beta forum has posted no new bugs during the past few weeks. Even better, he said, “Microsoft has not given us a hard date for release (i.e., The 'It'll be released when its ready' stance). Feedback from the tester’s forum and third-party beta sites like neowin.net are hinting at the end of June as a possible release date.” Let’s hope Microsoft holds to the “release when ready” position so that we don’t have to deal with post-SP3 hotfixes that are incompatible with SP4, security hotfixes that break, and a host of other unnecessary problems such as the remote procedure call (RPC) problem I discuss next. As a point of information, Microsoft has admitted to 45 post-SP4 hotfixes as of today, including the Print Spooler failure I discuss later.

RPC Bug in Hotfixes and IIS Security Rollups

This bug is important for ISPs and Web developers working with Active Server Pages (ASP) code that manipulates COM objects. A bug in how Win2K implements local RPC calls can cause threads that manipulate COM objects to hang. According to Microsoft, the bug occurs when local RPC calls are made from multiple threads, specifically when each thread has a different set of security credentials. There are two symptoms associated with the RPC problem. First, because the thread hangs, http clients time out when accessing ASP pages that manipulate COM objects. Second, two performance counters, Requests Executing and Requests Queued, increase over time and never return to zero, even when the Web server is idle. The bug exists in 11 post-SP3 hotfixes, and according to some news groups, is also present in the Microsoft IIS security rollup "MS03-018: Patch Available for Denial of Service Through FTP Status Request Vulnerability" (http://support.microsoft.com/?scid=317196) that the company released just last week. If your ASP application manipulates COM objects, this bug might explain unexpected behavior. Likewise, this problem will show up after you install any of the patches listed in the Microsoft article "FIX: RPC Bug Causes Threads to Stop Responding in ASP/COM+ Applications" (http://support.microsoft.com/?kbid=814119) and after you install the security hotfixes described in Microsoft Security Bulletin MS03-010 (Print Flaw in RPC Endpoint Mapper Could Allow Denial of Service Attacks) and possibly Security Bulletin MS03-018 (Cumulative Patch for Internet Information Service). This problem might be a packaging matter (e.g., we forgot to put in the latest version of the RPC library) because the release date of the RPC library component that corrects these problems predates several of the hotfixes. Although the documentation doesn't specifically state that the RPC bug is present in the most recent IIS security rollup, a rollup is cumulative, so this update is also suspect. If you’re experiencing problems with ASP pages and COM objects, you might need the new version of the RPC runtime library. Call Microsoft Product Support Services (PSS) and ask for the RPC patch, rpcrt4.dll, with a release date February 3, 2003, and version number 5.0.2195.6661.

Print Spooler Bails Out

Here’s a relatively new print spooler problem that occurs on the server hosting a network printer. If you configure the network printer port to use the RAW data type and you print multiple copies of the file, the spooler might choke and automatically restart. When this happens, you’ll see entries in the System event log with event ID 7031 and a message stating “The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 600000 milliseconds. Restart the service.” According to the Microsoft article "Spooler Service Quits When You Submit a Print Job and an Event ID 7031 Message Is Logged in the System Log" (http://support.microsoft.com/?kbid=820550), the bug is a result of a coding error that occurs when the spooler service needs to allocate a larger buffer; instead of increasing the buffer size appropriately, the code resets the buffer size to zero (tee hee!). The fix consists of three files, localspl.dll, spoolss.dll, and win32spl.dll. All three files have a release date of June 11, and you can get the update only from PSS. This is one of the 46 pre-SP5 bug fixes, and you can install it only on SP3 systems.

When the Keyboard and Mouse Disappear

Have you ever hit the keyboard one too many times or jiggled the mouse repeatedly when waking up a notebook that’s in standby mode? Then, when the system wakes up, you discover that the keyboard and mouse aren't working. This problem is a known bug in Win2K, and a patch is available—a new version of I8042prt.sys with a file release date of April 22. This fix, categorized as a pre-SP5 fix, can be installed only on Win2K SP3 systems. Call PSS and cite reference article "The Keyboard and Mouse Do Not Work When You Resume from Standby" (http://support.microsoft.com/?kbid=818383).