XP Workstations disconnect from network repeatedly.

[Phil79]

Hi,

We have a network on one subnet with 2 Windows 2000 servers and 50 ish workstations (approx 10 WinXP / 40 Win2000). Last year we had a problem with the XP workstations disconnecting from the network, where the affected workstations suddenly brought up the offline files dialogue and would no longer open files from the network. This was usually triggered by opening a file from the offline files cache. Having purged the offline files cache and then rebuilt it, the problem still occurred.

Following an article from Technet, I then discovered that disabling SMB signing in the registry on the servers and the workstation resolved this problem. This worked fine for about the last six months and then has suddenly started to happen again. All of the affected workstations are XP and all of them have SMB signing disabled.

Does anyone have any suggestions about the best way for me to proceed with this problem?

I have also tried:

Reinstalling an XP workstation - Problem still occurs.
Disabling offline files - Problem doesn't occur
Checking event viewers on Server + WS - No errors reported.

Any ideas?

 

[x508]

Maybe this is completely off the topic...

A while ago we had a worm that targeted an exploit in XP, it kep messing around the network by sending data(packets) like mad....Whenever we had more than 6 PC's on the network, lets say 10...after a few minutes 4 of them would lose their connection....

Sorted it out with "Stinger", I think it was from Trend...


*****************************************
May the Code Be With You...
----------
x50-8 (X Fifty Eigt)

 

[Phil79]

Thanks for the suggestion, but I'm confident that the security systems that we have in place are sufficient to cover us from the threat of any viruses.

 

[x508]

Not a virus...a worm...that was not picked up by antivirus software....but then again, back then the little bugger was still quite new...

Hope you get the prob sorted out, and do post whenu have so we can all learn

*****************************************
May the Code Be With You...
----------
x50-8 (X Fifty Eigt)

 

[noellees1]

I would definately run Spybot Search and Destroy and Adaware to fix any possible worm / trojan issues.
Make sure that the XP Pc's are registed on the domain server as a user that has full access to the offline file cache.
Try removing the other registry key in this folder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RemoteComputer\NameSpace\{2227A280-3AEA-1069-A2DE-08002B30309D}

 

[Phil79]

All of the computers already have Ad-Aware on them and we run McAfee E-policy Orchestrator on the network. All of them have come up clean from scans on both, but I will install Search and Destroy and report back. It doesn't feel like a virus though. The workstations disconnect usually when accessing a file set to be available offline, although they can open many offline files before it happens. I suspect that it may be something similar to the packet signing problem that we had before.

The users already have full rights to all of the necessary foldes and files.

 

[Curiousintel]

Are the workstations attached to the domain or are they only input as a workgroup. If as a workgroup you need to go to the services and disable computer browser as each of the xp machines could be trying to provide to provide a list of users to the servers.

 

[Phil79]

They are all attached to a domain. They do not seem to have any errors or conflicts in the DHCP/TCPIP/DNS settings, and there are no errors in the event log.

 

[noellees1]

Have you tried assigning them another IP adress, are the IP ranges you have set applicable.

 

[Phil79]

Yep. They're assigned by DHCP.

They all reconnect straight away when the connection is broken, but it's enough to upset things like Outlook (where their mailbox is stored on a server) and our CRM package.

 

[bcastner]

Have you made an server exception list in Offline Files, Advanced setting, specifying that the workstation is never to go offline?

 

[Phil79]

Unfortunately yes. The elation i felt when I found that setting was only outweighed by the dispair when it didn't work!

 

[bcastner]

Just to check, you entered the server names and specified the client behavior in detail?

Second question: have you modified the autodisconnect timer values as of yet?

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q138365

http://support.microsoft.com/?kbid=297684

Third question, if you would continously ping a server from a troubled workstation, would a disconnect appear over time? Are the network adapters set to Automatic for the autonegotiation of speed and duplex? Have you tried manual entry of speed and duplex settings?

Fourth question, have you done the checklist to check for opportunistic locking issues, as well as SMB signing:

http://support.microsoft.com/default.aspx?scid=kb;en-us;814112

Fifth question, are you licensed for enough seats on the servers?

Sixth question, have you considered possible high collision rate issues on your LAN?

http://support.microsoft.com/?kbid=315237

Seventh question, is there sufficient disk space for the offline cache on the workstations?

 

[Phil79]

Question 1:
Sorry, I don't understand. Can you clarify what you're asking please?

Question 2:
No, they are set at 15 minutes, which I presume is the default. Would changing it to the maximum be detrimental to performance in any way?

Question 3:
No, I have continuously pinged from an XP workstation and all off the packets responded as expected.

Question 4:
No, but there is no file access problem. The computer goes offline and then reconnects again straight away.

Question 5:
Yes, definately. We have 47 free seats.

Question 6:
Not particularly. I ran some diagnostics on several of the workstations and servers and everything appeared to be running as per normal.

Question 7:
Yes, thay all have 10-20GB free and are only using 250Mb ish of offline files.

 

[bcastner]

Q1. My question was directed to doing more than clicking the radio button, but taking the additional step of specifying the server name, and for each specifying the behavior of not disconnecting.

Q2. The autodisconnect timeout does not effect performance; it is designed to alllow a stretching of connection limits on the server over a larger number of possible seats.

Q4 & Q6. These are related to your group policy settings and the default responses by the XP client if it feels it has deteted a "Slow" link.

As a new question, when you earlier fixed SMB signing issues, did you apply:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q329170

 

[traycee]

I do want to mention that neither ad aware nor spy bot can get rid of all spyware. Some must be manually removed. Ran into this just the other day. Tried three separate anti spyware programs, which included the two listed above. None could remove the browser hijackers that was in my system. In the end, I had to manually remove it from msconfig, c: drive and registry.

 

[Phil79]

bcastner - Actually no, I read a differant article to that (which I now cannot find!) It instructed me to change two registry setting on the server (which is Windows 2000 - Sorry, forgot to mention that earlier) and also on the workstations, which was:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanserver\parameters

Two values -
enablesecuritysignature - 0
and
requiresecuritysignature - 0

This initially fixed the problem, so the setting is applied on all of the XP computers on the network. I will try applying the patch and report back. The problem is that the disconnection appears to be random and to date we have not discovered how to replicate it at will.

Also, do you believe that it is possible that the Windows 2000 systems may be experiencing the same problem, but not reporting it in the same way (or not reporting it at all)

traycee - I have checked msconfig on the XP workstations and none of them appear to have anything untoward in them.

I'm leaning towards bcastner's theory about network speed. The server which has all of the offline files stored on it has twinned network cards and never appears to be under any undue stress, but I'll have a look.

 

[bcastner]

Some reading:

. Review the link again for my original question #4, as it summarizes all KB articles for SMB signing and op lock issues.

.

http://www.jsiinc.com/SUBL/tip5800/rh5874.htm

.

http://www.brienposey.com/kb/XP_Network_Problems.asp

. This thread should ring a bell:

http://www.tek-tips.com/viewthread.cfm?SQID=438573&SPID=779&page=1

. Apply the patch, even if it does not by its description seem applicable:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q329170

 

[screach]

Phil,

I to have run into this problem recently. About 2 weeks ago our network (2 servers 1-W2k3 Ent, 2-W2k Standard) 40 Windows 2k Pro Machines and 4 Windows XP Pro machines.

The problems started one week after installation of a new T1 connection (so immediately I was looking at the router, which we have acting as DHCP and DNS servers for our network , long story as to why).

Suddenly my Windows XP Pro machines started disconnecting from the network about 8 times per day or so. After a week of trouble shooting, patching etc... I was able to determine that the disconnects come at exactly the same time as the lease expiration.

Still no solution has been found other than putting a batch file on the users desktop which releases IPCONFIG and then Renews it.

Really wondering if it is some sort of virus....I run Symantec Corporate Edition (all PC's and Servers up to date). I have also installed Panda and AVG to double check the network and still no viruses found..

If anyone else is having this problem I am really intersted in finding out whats up. I will post anything new I find.

Screach.....the sound of your world coming to an end at the sight of the dreaded BSOD!

 

[bcastner]

screach,

You will go absolutely insane if you try to use your router firmware to handle DHCP and DNS in a Windows 2003, Windows 2000 server setting.

The problems started one week after installation of a new T1 connection (so immediately I was looking at the router, which we have acting as DHCP and DNS servers for our network , long story as to why).

This is not tenable. This is not going to work for you well now, and shortly not at all.

See the links in my note of a looong time ago when XP clients were first being introduced into Win2k AD Domains: faq779-4017

Time and tide waits for no man, and you need to move as soon as possible to DNS and pure TCP/IP.

I honestly mean not soon, I mean now.