Saturday, July 18, 2009

Stop SBS from Shutting Down

We are currently migrating a client from SBS 2003 to SBS 2008. We've joined the new computer to the the domain, and run DCpromo on the SBS 2003 computer to remove the DC status. However, after seven days, SBS 2003 will start giving an error stating that it needs to be a DC and will shut down every 60 minutes (http://support.microsoft.com/kb/555087)! We need another few days to work on the migration.

The Microsoft recommended solution for this is to insert disc 1, run setup, and remove the SBS 2003 component. This will leave a plain Win 2003 server without the shutdown issue. However, when I attempted to do this, setup errored out indicating that I was trying to upgrade to an older version which was not possible. Removing service packs may have worked, but here is a faster work around taken from a guy named Alan (http://social.microsoft.com/Forums/en-US/whssoftware/thread/af4fc3b4-bb50-4c5e-b09a-72ef2c3ac687)

I've found a slightly more elegant solution to this problem rather than just
aggressively killing the process until Windows gives up trying to start it
again, and I'd like to share it in the hope that Google will re-index and pick
it up for others to use. You may have noticed this service cannot be disabled
via the MMC snap-in.

My search term on google was: how to stop the SBCore
service. Anyway, down to business…

- Tools you'll need – Process Explorer from http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx

As you probably know, you have a service called SBCore or "SBS Core Services",
which executes the following process: C:\WINDOWS\system32\sbscrexe.exe. If you
kill it, it just restarts – and if you try and stop it you are told Access Denied.

If you fire up Process Explorer, you can select the process and Suspend it, now we can start to disable the thing. Run regedit and expand the nodes until you reach the following hive /key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SBCore Right click this, hit permissions and give the "Administrators" group on the local machine full access ( don't forget to replace permissions on child nodes ). F5 in regedit and you'll see all of the values and data under this key.

Select the "Start" DWORD and change it from 2 to 4 – this basically sets the service to the "Disabled" state as far as the MMC services snap-in (and windows for that matter) is concerned.

Next, adjust the permissions on the file C:\WINDOWS\system32\sbscrexe.exe so that EVERYONE account is denied any sort of access to this file. Then go back to process explorer, and kill the sbscrexe.exe process, if it doesn't restart – congratulations!

Load up the services MMC snap-in and you should find that "SBS Core Services" is stopped and marked as Disabled.

Enjoy,
Alan :)


Note: When you run Process Explorer through Terminal Services, you are unable to suspend the process. I had to go on site to perform this process.

29 comments:

  1. Dude, you are a genius! Thanks for this!

    ReplyDelete
  2. Kudos. This is an excellent workaround.

    ReplyDelete
  3. Thanks Byron, indeed a computer geek. The shutdown process is in reverse of the startup process since the start up sequence after the basic bits of windows OS loads, the server starts them up by going through the list of services alphabetically. Most services that has dependencies are linked together for force starting.

    ReplyDelete
  4. Byron,

    thanks for sharing!

    Our SBS2003 started the shutdown behavior exactly six days after migration started. Not seven as MS states in the KB.

    We also just need a few more days to copy files and move software/services.

    Now that hunger for memory 4GB+ rises and/or hardware gets old, more and more costumers are willing to migrate to 64-bit SBS2008 or R2.

    So, once again - thank you very much for sharing!

    Best regards from Germany,
    Dark.

    ReplyDelete
  5. Thanks! this gives me more time.

    ReplyDelete
  6. Thanks - this was driving me up the wall!

    ReplyDelete
  7. I will be trying this tomorrow, And thanking you I am sure

    ReplyDelete
  8. I was actually able to uninstall the SBS components successfully but it still left the Core Services service enabled and running. The "Alan" registry fix is pure genius.

    ReplyDelete
  9. THANK YOU! Very easy, gives the few extra days I need.

    ReplyDelete
  10. THANK YOU!!!!!!!!!!!!!!!!!!!!
    My migration failed and I was not able to stop the old box from rebooting. You saved me.
    Thanks again.

    ReplyDelete
  11. Thank you - This is awesome - Helps us so much -

    Can I ask how long this disabled this for ?

    ReplyDelete
  12. Because the service is stopped, there is no time limit. It is permanent.

    ReplyDelete
  13. Hi Alan thank you very much for you post. One question what does mean "adjust the permissions on the file C:\WINDOWS\system32\sbscrexe.exe so that EVERYONE account is denied any sort of access to this file." I must leave all the user in te security tab o must deny all the permision to the file W-R-E-D

    ReplyDelete
  14. Hi Manolo,

    On the Security tab, add the Everyone group and assign Deny Full Control. That should be enough.

    ReplyDelete
  15. Thank you Alan, you are a crack. All go fine

    Saludos from Spain

    ReplyDelete
  16. Very helpful. Much appreciated! I was counting on the 21 days that I was told by Microsoft.. 6-7 days and I was in a bind.

    ReplyDelete
  17. done! thanks for the info!

    ReplyDelete
  18. Can I just check. Do the SBS related components such as WSS3 still work ok ?

    ReplyDelete
    Replies
    1. I can confirm that SharePoint functions properly with the SBSCore service stopped. It has been a while, but I don't recall any services being negatively affected.

      Delete
  19. Simply Awesome!

    May the gods shine upon you Bryon :)

    ReplyDelete
  20. Alan,
    awesome, this was really helpful, one small addition:

    You mentioned:
    "Note: When you run Process Explorer through Terminal Services, you are
    unable to suspend the process. I had to go on site to perform this process."

    Actually this is not needed. Just edit the .rdp file (open with, select notepad), add the following two lines, save the file and reconnect to the server.

    administrative session:i:1
    connect to console:i:1

    This causes that your session on the server is changed to a 'console session' similar to working directly on the server.
    Martin

    ReplyDelete
    Replies
    1. Excellent idea. Connecting to the console session didn't occur to me at the time. There are also command line switches to connect to the console session when running mstsc.

      Delete
  21. Hello there!
    Is this suitable for Migration sbs2008-> sbs20011


    ReplyDelete
    Replies
    1. I think this is only required for SBS 2003. I don't recall any SBS 2008 servers ever starting to automatically shut down. They were quite happy to coexist with a new SBS 2011 install.

      Delete
    2. Thanks a lot, Byron !!!

      Delete
  22. Hi!

    Thanks for your tutorial, I found a faster way:
    1. add Everyone Full Access denied to c:\windows\system32\sbscrexe.exe
    2. Kill sbscrexe.exe in Windows taskmanager
    3. Edit Registry as stated in your tutorial

    done

    Regards

    Marco

    ReplyDelete