Server 2012 R2 loses network connectivity

[ashmelburnian]

Hi Everyone,

I have a Windows Server 2012 R2 virtual server that loses network connectivity almost everyday around the same time for approx. 2-8 minutes.

Once network connectivity is restored ping response times to workstations are high for a few more minutes.

The server is running SAP. All clients get disconnected from SAP during these outages.

Windows is current with Windows Updates.

No scheduled tasks run around this time.

No recurring event logs are written that I can find that match the outages. However I found the following logs from the last outage:

19/09/2019 9:32:13 AM

System Event 1, Kernel-General

The system time has changed to ‎2019‎-‎09‎-‎18T23:32:13.600000000Z from ‎2019‎-‎09‎-‎18T23:31:12.146148900Z.

Change Reason: An application or system component changed the time.

19/09/2019 9:32:45 AM

System Event 7036, Service Control Manager

The Windows Error Reporting Service service entered the running state.

19/09/2019 9:32:47 AM

Application Event 4005, Winlogon

The Windows logon process has unexpectedly terminated.

I am running Microsoft Message Analyzer capture in an attempt to find out if a process causes this outage but am not confident.

Are there any tools that could help me narrow down what's causing this network outage?

Thanks

Ash

[#2]

@ashmelburnian I saw something similar with a virtual server  (but not SAP) doing something similar.  We finally isolated it to a specific user starting the application.   The server in our instance would become unpingable, so users would lose their connection, but it would remain online.  After a short period of time, it would start responding again  - presumably after the user's app had fully initialised.    

We built a new VM and moved the app and the issue was then resolved in our instance.

[#3]

Thanks for your reply. I was actually just thinking we may need to create a brand new VM.

[#4]

19/09/2019 9:32:47 AM

Application Event 4005, Winlogon

The Windows logon process has unexpectedly terminated.

---

This might help.

(Known issues in this update)

https://support.microsoft.com/en-us/help/3179574/august-2016-update-rollup-for-windows-8-1-and-windo...

[#5]

KB2919355 already installed.

[#6]

You'll still want to get to the bottom of the cause of winlogon 4005 event. Other option may be to stand up a new one, patch fully, migrate the SAP application over to it.