Network Problems 2

[uptime]

I am having a very strange problem. We have a small network with a Win2K SBS and a mix of 2000/XP work-stations. Yesterday one of the users was unable to open mapped drives and requested assistance. I was unable to browse the network however he was able to logon to the domain and his email thru exchange was functioning normally. I took him out of the domain and into a workgroup thinking this might help. Now I can't get him back in the domain. I get the message "an error occured attempting to join the domain. The network path was not found." Looking at the event log there seem to be a number of issues which I will paste below. All other clients are funtioning fine. I am at a loss and any help would be greatly appreciated.

Event ID 2000 - The servers call to a system service failed unexpectedly.

********************************************************

Event Type: Warning
Event Source: DnsApi
Event Category: None
Event ID: 11151
Date: 8/16/2005
Time: 10:03:01 AM
User: N/A
Computer: OFFICE01
Description:
The system failed to register network adapter with settings:

Adapter Name : {10FCA6FB-5B25-4C4D-BADB-60FDCEDE9095}
Host Name : OFFICE01
Adapter-specific Domain Suffix : CHURCHILLCORPO
DNS server list :
10.0.0.80, 10.0.0.13
Sent update to server : None
IP Address(es) :
10.0.0.44

The cause of this DNS registration failure was because of DNS server failure. This may be due to a zone transfer that has locked the DNS server for the applicable zone that your computer needs to register itself with.

(The applicable zone should typically correspond to the Adapter-specific Domain Suffix that was indicated above.) You can manually retry registration of the network adapter and its settings by typing "ipconfig /registerdns" at the command prompt. If problems still persist, contact your network systems administrator to verify network conditions.
Data:
0000: 2a 23 00 00 *#..

*****************************************************

Event Type: Information
Event Source: BROWSER
Event Category: None
Event ID: 8033
Date: 8/16/2005
Time: 9:17:28 AM
User: N/A
Computer: OFFICE01
Description:
The browser has forced an election on network \Device\NetBT_Tcpip_{10FCA6FB-5B25-4C4D-BADB-60FDCEDE9095} because a master browser was stopped.

*****************************************************

Event Type: Error
Event Source: SAM
Event Category: None
Event ID: 12291
Date: 8/16/2005
Time: 8:34:27 AM
User: N/A
Computer: OFFICE01
Description:
SAM failed to start the TCP/IP or SPX/IPX listening thread
Data:
0000: d3 06 00 00 Ó...

 

[markdmac]

When you attempted to rejoin the domain, did you first delete the machine account?

Did you check the local PC DNS dettings and verify that they only list your SBS server?

Run IPCONFIG /FLUSHDNS on the workstation.

I hope you find this post helpful.

Regards,

Mark

 

[uptime]

I had not deleted the machine account. I just tried it though and it didn't change anything. When I attempt to join the domain I get the same message that it is unable to browse the network. The other two suggestions I had done, but I did them again. No luck. Any other suggestions would be greatly appreciated. Very strange because this computer has been on the network from day one without problems and no other workstations are experiencing problems.

 

[DanClark86]

This still sounds like the comptuer account in AD is locked, Go to AD Users and comptuers, do a search for the users computer name and verify that it is not locked or disabled. [right click at the domain (your domain.com|private or what ever it is) level of the AD users and computers choose find, and then type the comptuer name. if not found then unjoin the comptuer from the domain] when the compter is not joined to the domain drop to a dos prompt and type IPCONFIG /FLUSHDNS after this is complete, type IPCONFIG /REGISTERDNS. After this is complete try to login, if you had to unjoin the domian, Rejoin at this time, Everything should work.

Sorry for spelling, I just suck at spelling.

 

[markdmac]

Sidebar for DanClark86. Try using the Google Toolbar. It will add spell check to your HTML forms (like here). then like me you just have to remember to click the spell check button. ;-)

I hope you find this post helpful.

Regards,

Mark

 

[uptime]

I tried that and no luck either. The computer name is not listed in AD coputers since I deleted the account. That is what you meant isn't it?

I did the flush and registerdns on the workstation and tried to join the domain. Same message: "Network Identification - The following error occurred attempting to join the domain "CHURCHILLCORPO": The network path was not found"

I don't care about your spelling. I greatly appreciate the help. Any more suggestions?

 

[DanClark86]

Okay, by chance is this computer getting a DHCP Address? if it is do an IPCONFIG -all and make sure that the First DNS IP Address is the IP Address of your Server, Also make sure that your DNS on your server is running. If this comptuer is a Static IP address then again the first DNS Address needs to be the Server (Domain Controller running DNS) Also another thing that might be throwing this for a loop is do you have more then one network card. if you do, and by chance it is a wireless network card and it is picking up and address from say a neighboring company then that may cause all of these problems too. Last, And it should be first, Make sure you can Ping you domain controller


Sidebar i am using the google tool bar, i lookeded in the options but i don't see anything for spell check.

 

[markdmac]

DanClark86: download the latest copy of the toolbar. it is a new feature and one I have come to love. Just wish it was automatic.

Uptime: All of what Dan has given yuou is great. To add one thing to it make sure that your DHCP Scope has the right DNS servers configured in its options. Also, you might want to try the full domain name such as CHURCHILLCORPO.LOCAL or CHURCHILLCORPO.COM, whatever it actually is in AD.

I hope you find this post helpful.

Regards,

Mark

 

[uptime]

It is getting a DHCP address. DNS is running on the server. Here's the ipconfig/all results:

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : OFFICE01
Primary DNS Suffix . . . . . . . : CHURCHILLCORPO
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : CHURCHILLCORPO

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : CNet PRO200WL PCI Fast Ethernet Adapter
Physical Address. . . . . . . . . : 00-80-AD-75-E3-FA
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 10.0.0.44
Subnet Mask . . . . . . . . . . . : 255.0.0.0
Default Gateway . . . . . . . . . : 10.0.0.13
DHCP Server . . . . . . . . . . . : 10.0.0.80
DNS Servers . . . . . . . . . . . : 10.0.0.80
10.0.0.80
Lease Obtained. . . . . . . . . . : Tuesday, August 16, 2005 12:32:13 PM
Lease Expires . . . . . . . . . . : Thursday, September 15, 2005 12:32:13 PM

The SBS server is 10.0.0.80 so this seems right to me. There is no wireless NIC nor a second NIC in this computer.

Here's the output of ipconfig/displaydns:


Windows 2000 IP Configuration

localhost.
------------------------------------------------------
Record Name . . . . . : localhost
Record Type . . . . . : 1
Time To Live . . . . : 31532784
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . :
127.0.0.1


churchillcorp01.churchillcorpo.
------------------------------------------------------
Record Name . . . . . : churchillcorp01.churchillcorpo
Record Type . . . . . : 1
Time To Live . . . . : 2091
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . :
10.0.0.80


adsubtract.
------------------------------------------------------
Record Name . . . . . : AdSubtract
Record Type . . . . . : 1
Time To Live . . . . : 31532784
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . :
127.0.0.1


1.0.0.127.in-addr.arpa.
------------------------------------------------------
Record Name . . . . . : 1.0.0.127.in-addr.arpa
Record Type . . . . . : 12
Time To Live . . . . : 31532784
Data Length . . . . . : 4
Section . . . . . . . : Answer
PTR Record . . . . . :
localhost

Record Name . . . . . : 1.0.0.127.in-addr.arpa
Record Type . . . . . : 12
Time To Live . . . . : 31532784
Data Length . . . . . : 4
Section . . . . . . . : Answer
PTR Record . . . . . :
AdSubtract


Again, I appreciate the help.

 

[DanClark86]

Long Shot, but try this, Check the Licenseing on the server to make sure you have not ran out of lincess and also is there anything in the event viewer that may shed some light on this? And another long shot, on the local Machine check the LMHost and the Host file Do a seach for them, edit with notepad, and make sure that a virus or spyware has not filled up the file with garbage

 

[uptime]

The server event viewer is pretty clean but I did find this one from yesterday afternoon. This would have been well after the problem started when I was on the workstation trying to diagnose it.:

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10006
Date: 8/15/2005
Time: 5:14:48 PM
User: CHURCHILLCORPO\Administrator
Computer: CHURCHILLCORP01
Description:
DCOM got error "Class not registered " from the computer OFFICE01.CHURCHILLCORPO when attempting to activate the server:
{E205C653-0426-11D2-9A4D-0060081E9D26}

On the workstation I am still getting the following:

Event Type: Error
Event Source: Srv
Event Category: None
Event ID: 2000
Date: 8/16/2005
Time: 2:36:25 PM
User: N/A
Computer: OFFICE01
Description:
The server's call to a system service failed unexpectedly.
Data:
0000: 00 00 04 00 01 00 54 00 ......T.
0008: 00 00 00 00 d0 07 00 c0 ....Ð..À
0010: 00 00 00 00 10 00 00 c0 .......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 1a 03 f0 14 ..ð.

Host files are OK. There are no events regarding regarding running out of licenses, but how can you check for available (not total) licenses in 2K SBS?

 

[DanClark86]

I think it is in the controll panel of the server, it has been a while since i worked with 2000 SBS. Do you have any other workstations that you can join to the domain as a test?

 

[uptime]

For some reason SBS likes to tell you how many licenses you have, not how many are used. Maybe I'll try to join the domain from an old work station.

As a work around to this problem, what would it require to make the server see this computer as a new client? I know it takes more than re-naming but does anyone have a tried and true procedure for turning a troubled client into a new domain client?

 

[DTracy]

You could change the MAC address of the workstation and this will cause the server to think its a new unit.

This is not the solution to your problem and is probably more trouble to do than fixing the original problem.

Regards,
David Tracy.

 

[uptime]

Thanks for the MAC tip. If you have any suggestions to solve the problem I'm more than willing to try. Of course its the bosses computer(isn't it always!) so I need to get it resolved. I would prefer a solution but at this point I'd welcome a work around as well.

 

[teksadat]

Hi Uptime, i think you can try this simple steps may be this may help you. First try pinging to your Domain Controller, if you are able to ping then try this:

My computer - rt click - properties - Network Identification - Properties - More - Primary DNS Suffix

Uncheck Change primary DNS suffix when domain membership changes. click ok. in the "member of" just give the domain name only no need to give the complete name.

Check if the DHCP and the DNS Servers are up and running.

 

[uptime]

That didn't work either but thanks for the help.

Regarding pinging the domain controller:

Server is churchillcorp01
Domain is churchillcorpo
IP of server is 10.0.0.80

I can ping by IP and by FQDN but if I ping just churchillcorpo I get unknown host. That's correct isn't it?

The really stange thing to me is everything was fine up until Monday afternoon and only the one workstation is acting up.

One question: On W2K SBS are the licenses for the number of concurrent users or computers. I would hope the event viewer (server and/or client) would flag a license limitation problem. The reason I ask this is a couple people have started using laptops occasionally in addition to their workstations and there are now nore DHCP leases than licenses. Hopefully unrelated but worth mentioning.

 

[markdmac]

Could very well be a problem. The SBS licensing is not for concurrent use. You may need to pay for the extra licenses. An easy way to test of course would be to pull another PC out of the domain (one of those laptops) and try adding this one back in again.

I hope you find this post helpful.

Regards,

Mark

 

[uptime]

I tested this and its not the issue. I have ordered another 5 licenses as we will be needing them but I'm still looking for suggestions on this problem.

Thanks to all who have offered help.

Rich

 

[uptime]

I finally resolved this. I've been working remotely (Isn't VNC one of the best pieces of software ever?) and finally got in there today. I tried uninstalling/reinstalling MS network client and tcp/ip services with no change. On a hunch I uninstalled Mcafee Firewall (which had been disabled for testing purposes earlier in the process) and upon reboot I was able to re-join the domain without problem. I did get errors and a couple unrequested re-boots during the removal process. I don't know what caused it but the Mcafee Firewall was definitely the underlying issue. I've noticed before with Mcafee products that they often claim to be disabled and it actually continues to run (and cause problems).

Thanks to all who made suggestions. Even if it doesn't directly resolve the issue the dialogue helps to troubleshoot the problem.

Rich