Curious Loss of Network Connectivity

Discussion in 'Server Networking' started by ODBMusic, Oct 10, 2007.

  1. ODBMusic

    ODBMusic Guest

    Four workstations (XP Pro) lose network connectivity to the server (Server
    2003 R2 SP2) each evening between 6:30 and 8:00.

    Other network workstations do not exhibit this problem. There are no
    differences in software running between the workstions that lose connectivity
    and the workstations that don't.

    The only thing in common among these four workstations is that they were all
    purchased at the same time from the same manufacturer.

    This problem only manifested after the server OS was upgraded to SP2.

    I have removed and reinstalled AV software, with no effect. The NICs are not
    going to sleep. I have left and rejoined the domain. There are no "timed"
    programs running. There are absolutely no software differences between these
    four and the other workstations that function properly.

    Thanks in advance.
     
    ODBMusic, Oct 10, 2007
    #1
    1. Advertisements

  2. Hi,

    Here are a few questions that may help to troubleshoot:

    Have you checked the event logs on the clients and the server during this
    period? What events occur?
    What devices are between the clients and the server?
    Do the clients maintain connectivity to these intermediate devices?
    Do the clients maintain connectivity to other servers on the same network?
     
    Greg Lindsay [MSFT], Oct 10, 2007
    #2
    1. Advertisements

  3. ODBMusic

    ODBMusic Guest

    [ Have you checked the event logs on the clients and the server during this
    period? What events occur?]

    I found the following events:

    The time provider NtpClient is configured to acquire time from one or more
    time sources, however none of the sources are currently accessible. No
    attempt to contact a source will be made for 479 minutes. NtpClient has no
    source of accurate time.

    The Security System detected an attempted downgrade attack for server
    cifs/SERVER. The failure code from authentication protocol Kerberos was
    "There are currently no logon servers available to service the logon request.

    The Security System could not establish a secured connection with the server
    cifs/SERVER. No authentication protocol was available.
     
    ODBMusic, Oct 11, 2007
    #3
  4. Hi,

    It seems to me that if the server became unavailable, you might get these
    events on the client, so they may not be a cause but rather symptoms of the
    problem. What kind of services is the server running? Is it a DC? When the
    clients lose connectivity, do you lose connectivity to the netbios name of
    the server, the FQDN of the server, the IP address of the server, or all of
    these?

    I found this link that describes several situations that can lead to the
    error event you are seeing:
    http://www.eventid.net/display.asp?eventid=40960&eventno=787&source=LsaSrv&phase=1. I
    don't know if these will help, but some of the scenarios might sound
    familiar to you.
     
    Greg Lindsay [MSFT], Oct 12, 2007
    #4
  5. ODBMusic

    ODBMusic Guest

    [It seems to me that if the server became unavailable, you might get these
    events on the client, so they may not be a cause but rather symptoms of the
    problem.]

    *** Yes, but the problem is only manifesting on FOUR workstations.

    [ What kind of services is the server running?]

    *** The following services are run on the server:

    Application Experience Lookup Service
    Application Layer Gateway Service
    Automatic Updates
    Background Intelligent Transfer Service
    Backup Exec Agent Browser
    Backup Exec Device & Media Service
    Backup Exec Job Engine
    Backup Exec Remote Agent for WIndows Servers
    Backup Exec Server
    COM+ Event System
    Computer Browser
    Cryptographic Services
    DCOM Server Process Launcer
    DHCP Client
    Distributed File System
    Distributed Transaction Coordinator
    DNS Ckient
    DNS Server
    Error Reporting Service
    Event Log
    File Replication Service
    File Serer for Macintosh
    Help and Support
    Intel PDS
    Intersite Messaging
    IPSEC Services
    Kerbos Key Distribution Center
    Logical Disk Manager
    MSSQL$BKUPEXEC
    MSSQL$BKUPEXECDLO
    Net Login
    Network Connections
    Network Location Awareness
    Plug and Play
    Print Spooler
    Protected Storage
    Remote Access Connection Manager
    Remote Procedure Call
    Remote Registry
    RevUDFService
    Secondary Logon
    Security Accounts manager
    Server
    Shell Hardware Detection
    Symantec Antivirus
    Symantec Antivirus Definition Watcher
    Symantec Event Manager
    Symantec Settings Manager
    Symantec System Center Discovery Service
    System Event Notification
    Task Scheduler
    TCP/IP NetBIOS Helper
    Telephony
    Terminal Services
    UPS Service
    Windows Audio
    Windows Defender
    Windows Firewall/Internet Connection Sharing
    Windows Management Instrumentation
    WIndows Time
    Wireless Configuration
    Workstation

    [Is it a DC?]

    *** Yes

    [When the clients lose connectivity, do you lose connectivity to the netbios
    name of
    the server, the FQDN of the server, the IP address of the server, or all of
    these?]

    *** All of them

    As I stated before, the problem began immediately after applying the Service
    Pack 2 update, and is only occurring on four workstations.
     
    ODBMusic, Oct 15, 2007
    #5
  6. Hi,

    What I meant below was not that the server is becoming globally unavailable,
    but that from a client perspective, whatever is causing this problem may be
    producing the events you see. Something else to check is whether or not
    there are tasks set up in scheduled tasks.

    Network monitor may tell you something. I suggest running it on one of the
    clients that lose connectivity and also the server, and perhaps a client
    that doesn't lose connectivity. A test you might also consider is to connect
    one of the clients on the same side of the router as the server, and test
    connectivity from client to client and client to server.

    --
    Greg Lindsay [MSFT]

    Disclaimer: This posting is provided "AS IS" with no warranties, and confers
    no rights.

     
    Greg Lindsay [MSFT], Oct 19, 2007
    #6
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.