Data loss and network issues in Windows Server 2008 R2

Question

System administration

Big problems are found with Windows Server 2008 R2. I must say right away that I don’t understand the matter very well, but someone needs to understand. Invite someone from the outside - there is no possibility (backwoods).

We have a “server” (a more or less powerful computer, it doesn’t smell like server hardware inside), on which the OS is running (see above), on which the terminal server is running, in which users work with 1C (file) and a couple more programs . So does SQL Server 2005 Express. Users in total - no more than 30. All (probably) have statically registered IP, gateway and DNS servers of the provider. All this lies behind the D-Link 2540U ADSL modem, on which ports are forwarded to our expensive server - for working outside.

• So, first the shortcuts in the main menu disappeared, then some of the data on the disk disappeared - that's okay, I restored it.
• Further more. Problems with the network began: after a reboot (before my arrival, Hyper-V was standing - it’s not clear why, I decided to remove it. Now I realized that if something works, it’s better not to touch anything) the network stopped seeing the computer by symbolic name, by IP it pinged normally. But! When trying to "ping" someone from the server, the ping gave out "General error", then "General failure", including pings to 127.0.0.1. Removed the role "Routing and Remote Access" - he saw himself, but otherwise nothing has changed. Well, I put auto-detection of network parameters on the map - pings began to reach and leave, the server appeared on the network. Everything would be fine, but the IP is dynamic, and the modem did not allow setting statics because of the firmware curve - it simply does not save the values ​​​​and that's it (I'll update it when I find the provider's settings). Returned to static in the network, some manipulations achieved from the ping "The specified network is not available." Dropped Arp-s, caches, routes - all the same. I returned it to dynamic, updated RDP files for users, changed port forwarding on the modem. Today the IP has changed - and on a new one ... What to do - I'll never know.
• And after the reboot - the files were missing again, this time the shortcuts and installers were not enough, the 1C bases were rubbed, it began to sin on the hard one - it turned out that this was a hardware Raid 1. In addition to it, there are WDC WD20EARS-00MVWB0 and WDC WD10EALX-009BA0 - I suspect raid includes similar ones.

About the fact that updates are not installed - I am already silent (unknown error code 800070005).

In the process of all this, the following errors occur:

• Timeout (30000ms) while waiting for a transaction response from the "Netman" service
• Timeout (30000ms) while waiting for a transaction response from the "UxSms" service.
• Timeout (30000ms) while waiting for a transaction response from the "SDevOOPNet" service.
• The X.224 component of the RDP protocol encountered an error in the protocol flow and terminated this client.
• WINS encountered a database error. It is not known how serious this error is. WINS will try to eliminate its consequences. You can use the events in the Application Log category of the Event Viewer of the Exchange Component (ESENT) as a source to look for a more detailed description of database errors. If these errors occur regularly over a long period of time (several hours), then you may need to restore the WINS database from a backup copy. The error number is contained in the second DWORD value of the data section.
• The call to ScRegSetValueExW on Start failed with an
  Access denied error.
• Windows update cannot be installed due to error: 2149842967 "" (Command Prompt: ""C:\Windows\system32\wusa.exe" "D:\Install\Venta\inst\Windows6.0-KB958483-x86.msu" ")
• The configuration of the AdminConnection\TCP protocol in the SQL instance SQLEXPRESS is not valid.
• The backup operation started at '‎2012‎-‎09‎-‎13T17:00:30.672000000Z' failed because the Shadow Copy Service failed while attempting to create shadow copies of volumes being backed up. Error code: "2155348129". To find the cause of the error, review the event description and retry the operation after the problem is resolved.
• SQLVDI: Loc=SVDS::CloseDevice. Desc=Abort detected. ErrorCode=(0). Process=1212. Thread=12016. server. Instance=MICROSOFT##SSEE. VD=Global\{859B0FF0-477F-42B0-A123-75A9B8266D3C}1_SQLVDIMemoryName_0.
• Event rejected by VSS Writer with error 0x800423f4, Recurring Writer Error. This error will probably
  occur again when you try to archive again.

I earnestly ask the community to help, and not troll, send to Google, etc. - I was everywhere, maybe I didn’t understand everything. The problem is really serious (for me).
Thank you all in advance for your replies.

Answer 1

All this lies behind the D-Link 2540U ADSL modem, on which ports are forwarded to our expensive server - for working outside.

What ports? And patches cost everything, is the system always updated when updates appear? I hope there is no need to explain that if the system has not seen updates for a couple of years, then even sticking RDP out is deadly?
1) Scan memory, i.e. boot from the disk/flash drive containing memtest86. Let it spin for a couple of hours.
2) Run sfc /scannow

Answer 2

There have been no updates since July - the reason is in the text.

Problems caused by reboot? Deal with them promptly.

Dangerous, but something needs to be done.

VPN (at least SSL, at least IPSec - it doesn’t matter). And nothing else. The server must be another device. For example, you can put ASA5505 between the modem and the server, it costs a penny and is a very good firewall and VPN server. If you are afraid of the console - it has a good gui called "ASDM". If the ASA is still expensive, then at least buy some Mikrotik.
Sticking out a server on which SQL is also spinning is the standard of madness. It had to be redone on the first day.

Answer 3

The first thing I would do is a full backup of the server somewhere on an accessible medium. I'm not sure if Acronis/similar software will remove data from the raid.
Think about buying a normal server and tell the management that if this piece of iron dies, the office will completely become.
And that you warned the management about this - in case of problems - they are to blame.
Check each screw individually, it is possible to recreate the raid.
If a very powerful machine, deploy hyper-v / esxi there, in which to make a separate database server, separate other virtual machines.
with parameters - there are methods for calculating memory for a terminal server and SQL on the network (for RDP, for SQL, there is never a lot of memory)
You have already been told about vpn - it is better to do this on a router or on a separate machine with two ethernet ports (or in a separate virtual machine under Linux)

Answer 4

Write the “server” configuration, processor, memory, motherboard, network.

Answer 5

I would first do this:
1. disable DHTsP on the modem.
2. turned on statics on the server, and turned on the DHTsP and DNS services.
This would at least slightly improve the situation with the network.