PLEASE help! All phones now unregistered

[semtex65]

Hi Guys,

About 3:30 this morning, my Windows Server 2008R2 decided to install updates and restart. Prior to this, everything was working fine. And then this appeared in the server logs...

http://img26.imageshack.us/img26/23/eventlog.jpg

This morning, I removed the updates that were installed (sorry i forgot to note what they were, though some were .NET), as this is the only thing that had changed - the system was working faultlessly prior to this.

Things have changed a little since then... this is from the event log, having just re-started the server and all phones..

10:46:30.790 [CM504001]: Ext.EndCall: new contact is registered. Contact(s): [sip:[email protected]:40600;rinstance=dc84aa83dc2f8e28/EndCall]
10:46:30.785 [CM504001]: Ext.800: new contact is registered. Contact(s): [sip:[email protected]:40600;rinstance=4b74dbeebdeef6ea/800]
10:46:30.784 [CM504001]: Ext.777: new contact is registered. Contact(s): [sip:[email protected]:40600;rinstance=43e0f163cc8a9f17/777]
10:46:26.960 [CM504001]: Ext.*1: new contact is registered. Contact(s): [sip:*[email protected]:40000;rinstance=88ff44a4bea9a51e/*1]
10:46:26.959 [CM504001]: Ext.*0: new contact is registered. Contact(s): [sip:*[email protected]:40000;rinstance=cbe7614bd0265762/*0]
10:46:26.849 [CM504001]: Ext.*777: new contact is registered. Contact(s): [sip:*[email protected]:40000;rinstance=84fa0c6899f61202/*777]
10:46:21.555 [CM102001]: Authentication failed for SipReq: REGISTER 192.168.51.132 tid=f827636c7a15e80b cseq=REGISTER [email protected]:5488 / 2 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings
10:46:21.206 [EC100007]: External application is connected: application:SVR01:0/QueueManager local:127.0.0.1:5482 remote:127.0.0.1:49238
10:46:18.645 IP(s) added:[192.168.51.100]
10:46:17.778 [EC200005]: Parking Orbit server is connected: application:SVR01:0/3CXParkOrbit local:127.0.0.1:5482 remote:127.0.0.1:49224
10:46:17.594 [CM504008]: Fax Service: registered as sip:[email protected]:5060 with contact sip:[email protected]:5100;user=phone
10:46:17.445 [EC200002]: Media server is connected: application:SVR01:0/MediaServer local:127.0.0.1:5482 remote:127.0.0.1:49223
10:46:17.119 [EC200004]: IVR server is connected: application:SVR01:0/IVRServer local:127.0.0.1:5482 remote:127.0.0.1:49222
10:46:15.056 [EC200006]: Conference server is connected: application:SVR01:0/3CXConferenceRoom local:127.0.0.1:5482 remote:127.0.0.1:49218
10:46:10.207 [CM506005]: Public IP=xxx.xxx.xxx.xxx is used for WAN communications through local interface with IP=192.168.51.100
10:46:08.847 Failed to obtain short path name for [C:\ProgramData\3CX\Bin\Cert]
10:46:08.847 [CM501006]: Default Local IP address: [192.168.51.100]
10:46:08.797 [CM501002]: Version: 10.0.23053.0
10:46:08.797 [CM501001]: Start 3CX PhoneSystem Call Manager
10:46:08.797 [CM501010]: License Info: Load Failed - Error licence Licence: 27 System: 2
10:46:08.650 [CM501007]: *** Started Calls Controller thread ***
10:46:08.627 [EC200001]: Configuration server is connected: application:SVR01:5485/DBProvider local:127.0.0.1:49216 remote:127.0.0.1:5485


As you can see, none of the phones are connecting - there's 10 of them, all runing on extensions 100, 101, 102 etc...

Can anyone shed any light on why this has happened and how to fix? Really need to sort this before the office re-opens on Monday. help!

Thanks in advance to anyone that can help.

 

[semtex65]

OK, we can scrap that one now. Took a configuration backup, uninstalled 3CX, restarted the server, reinstalled 3CX, loaded in the configuration backup and all is working again.

Very strange though, would still like to know what caused it.

 

[jpillow]

The only isssue I could possibly think of is an IP address, was this something your checked in customer parimenters, on all the phones, and the server before restoring the backup?

 

[semtex65]

Yep, I check IP's and that the (Cisco) phones were pulling their configs from the TFTP server, which they were. I'm just completely at a loss as to why it happened, because not even the smallest detail or parameter has changed anywhere on the network.