Limited or no connectivity.

Hi.

Does anyone have any idea why 50-70% of the machines in our school starts having the "limited or no connectivity" problem?

Where i have to manually login as local admin on each one, delete the winsock services from the registary then reinstall the TCP/IP driver on each one to get it working again?

I had to manually do over 100 computers this afternoon!

Im pleased ive found a fix, but i'd like to know why it happens.

I dont think its a virus either, as its happened to machines that are with and without virus scanners.

Thanks in advance all.

Did your DHCP go down? Also do all these machines have the same image?

DHCP was up.

As the other 30% of the network was running fine.

All different image, as there were 3 times of machines that had the problem.

Sounds a bit like a little dear has created a loop back on the network perhaps - I had a similar problem recently which ground the system to a complete halt. Turned out to be that both ends of a Cat 5 cable had been inserted into a dual socket creating a loop

Nope. Not a loopback.

Because our switches have spanning tree on all of them, and usually on our network, everything drops off, plus, pings to the servers get very high.

Odd problem.

I wonder if i'll ever find out whats caused it?

Because our switches have spanning tree on all of them

Doesn't always work though.

Doesn't always work though.

True, but trust me, theres no loopbacks.

If there was, it would affect all of our network, and give us very high pings to the DC.

But it only affected some workstations (for example, 25/30 in one of our labs), while the rest functioned correctly.

Plus, bizzarly, if i plug my diagnostic laptop into the same cable thats being used by a broken workstation, it works fine. So i dont think its an infrastructure based problem.

Very odd, i'd like to say virus, but its hard to tell, could be anything really. Unfortunatelly. .

I'd like to find out though.

So any and all suggestions i'll look into.

Upto now:

- Loopbacks: Both diagnostics & physical checking have been done. No loopbacks.

- Viruses: Unknown, no viruses on the main servers will check the workstations when McAfee has been removed from all workstations (dont want 2 AVs on the network at the same time. ).

Sounds a bit like a little dear has created a loop back on the network perhaps - creating a loop

Please remove this post as pupils read this forum

@Grommit

mm - you might want to rethink your post if your really worried about this

(but I don't think that its the worlds greatest secret )

regards

Simon

If there was a loopback, I agree it would stop all the network, not just chunks/percentages of it. With HP switches (and probably other makes too), the LEDs flash red instead of green so you'd know about it!

If it's not a DHCP problem and you're positive workstations are getting an IP, then it really is a strange problem. Have you tried manually restarting all switches one by one?

If there was a loopback, I agree it would stop all the network, not just chunks/percentages of it. With HP switches (and probably other makes too), the LEDs flash red instead of green so you'd know about it!

Didnt know that about the LEDs. Good to know that is.

Is that only on the switch thats got the problem, or does it trace all the way back to the core switch?

If it's not a DHCP problem and you're positive workstations are getting an IP, then it really is a strange problem. Have you tried manually restarting all switches one by one?

The workstations that have the problem have 'limited or no connectivity'. So they see the network card, see a cable plugged in, but wont get an IP.

Plus, when you try to login in, it complains about NETLOGIN service not running.

If i login locally, and try to enable it manually, it doesnt work, bringing up an Error 10106.

Didnt know that about the LEDs. Good to know that is.

Is that only on the switch thats got the problem, or does it trace all the way back to the core switch?

From memory all through the network, as of course all switches are connected together, so the error would affect the whole network.

The workstations that have the problem have 'limited or no connectivity'. So they see the network card, see a cable plugged in, but wont get an IP.

Plus, when you try to login in, it complains about NETLOGIN service not running.

If i login locally, and try to enable it manually, it doesnt work, bringing up an Error 10106.

The Net Logon service should be running on your Domain Controller. I'd try stopping and starting the service, then rebooting a workstation and try to logon again. The Net Logon service authenticates computers logging onto the domain. The Net Logon service should be set to Manual on a workstation, in a stopped state.

From memory all through the network, as of course all switches are connected together, so the error would affect the whole network.

Cool.

Will keep a look out for that in future. .

The Net Logon service should be running on your Domain Controller. I'd try stopping and starting the service, then rebooting a workstation and try to logon again. The Net Logon service authenticates computers logging onto the domain. The Net Logon service should be set to Manual on a workstation, in a stopped state.

If the service has failed on the DC though, would it not affect all workstations?

Plus, that wouldnt stop the workstations geting an IP would it?

As im fairly sure thats the reason for the netlogin error, that it cant connect to the network to get the netlogin info off the DC?

Will check the DC on monday though. .

If the service has failed on the DC though, would it not affect all workstations?

Plus, that wouldnt stop the workstations geting an IP would it?

As im fairly sure thats the reason for the netlogin error, that it cant connect to the network to get the netlogin info off the DC?

Will check the DC on monday though.

The problem could well be intermittent. Services can and do stop for various reasons and this may be happening to you.

Looking at the Service Dependencies, it might be the case you have two problems. No allocated IPs could be down to a problem with DHCP Server (as already mentioned) or you might have run out of addresses?

What's the uptime of your server? Have you tried to reboot completely?

The problem could well be intermittent. Services can and do stop for various reasons and this may be happening to you.

The problem persists though, even when the workstation next to a broken one is working fine. So surely that would indicate a workstation level problem rarther than a server one? As if the problem was intermittant, then a reboot half an hour later of a broken one would surely fix it?

Maybe im being daft here, but if the problem was with an intermittant server problem, then why would the affected workstations keep on erroring on every boot, whilst working ones work fine?

Looking at the Service Dependencies, it might be the case you have two problems. No allocated IPs could be down to a problem with DHCP Server (as already mentioned) or you might have run out of addresses?

We're using, iirc, about 30-35% of our DHCP range at the moment.

What's the uptime of your server? Have you tried to reboot completely?

Uptime? About 2 weeks. The power for the entire school was shut off over half term.

Since then ive had nothing but problems. Most of them have been the kids looping back on the 2-3 hubs we have. But in combination with a few other faults, the last few weeks have been murder for me.

So, for Monday, i have to check:

- DHCP logs.

- Netlogin logs.

I appreciate the input on this everyone.

As I'd like to get down to the bottom of what caused the fault, for future reference, & piece of mind. .

The problem persists though, even when the workstation next to a broken one is working fine. So surely that would indicate a workstation level problem rarther than a server one? As if the problem was intermittant, then a reboot half an hour later of a broken one would surely fix it?

Maybe im being daft here, but if the problem was with an intermittant server problem, then why would the affected workstations keep on erroring on every boot, whilst working ones work fine?

I understand where you're coming from, but it's too coincidental that the same problem is happening across so many machines, which leads me to believe it's something server level, affecting some but not all clients.

Have you tried resetting a computer account in Active Directory and re-joining that problematic workstation to the domain? Might be worth a try. Are all the machines with the fault the same make/model and if so made up from the same image?

I'm interested to see what conclusions you come to as well, as it does seem unusual.

@Mike-j

Are these xp computers does last known config, safemode with networking get you on to the network? also does a sys restore allow you to reconnect to the domain, these steps may help you qualify that its a machine issue.

The last known configuration only works if the user doesn't logon. Boomam logged on locally, so the last known configuration wouldn't make any difference. As for the other two options, they may be worth exploring, but then again I disable System Restore by GPO as it isn't needed. Re-imaging would be more preferable when managing a number of machines.

A couple of other things to try. If you hang on for 30 seconds or so do the clients eventually get an address? See:

http://support.microsoft.com/kb/168455

Also I'm not sure on MacAfee but I've seen similar issues with F-Secure. The firewall component installs a network driver to scan traffic. If this is having problems network connectivity can be hit and miss. Annoyingly removing F-Secure didn't always remove this driver correctly and I had to dig through Device Manager (Click 'View' - 'Show hidden devices' - 'Non plug and play devices') and manually remove it.

I had a similar, but not exactly the same, problem with 10 or so PC's when my Host A listings somehow became corrupt. I removed the offending ones from the list, rebooted the PC's and hey presto they were added back to the list with the correct ip address.

Don't know if you've already checked this but it might be worth a look.

Plus, when you try to login in, it complains about NETLOGIN service not running.

If i login locally, and try to enable it manually, it doesnt work, bringing up an Error 10106.

Netlogin or Netlogon?

Seem to recall Netlogin was a virus.......

Have you tried resetting a computer account in Active Directory and re-joining that problematic workstation to the domain? Might be worth a try. Are all the machines with the fault the same make/model and if so made up from the same image?

I havnt no, as iirc, they wouldnt see the network.

Different makes and models. Some were Dells, some were NECs, some where some RMs(we dont use RM, just some hand-me downs from a college from what i was told). They all have images unique to their HW. So one for Dell D740s, one for NECs, etc;

I had a similar, but not exactly the same, problem with 10 or so PC's when my Host A listings somehow became corrupt. I removed the offending ones from the list, rebooted the PC's and hey presto they were added back to the list with the correct ip address.

Don't know if you've already checked this but it might be worth a look.

I havnt messed with the DNS on our DC much, but i'll give it a look.

What am i looking out for?

Thinking about it, i wouldnt be suprised if it was a DNS problem, as we had DNS problems a week ago when almost all net traffic for us went dead. Took a while to get working for frog (our proxying is done by our VLE).

A couple of other things to try. If you hang on for 30 seconds or so do the clients eventually get an address? See:

http://support.microsoft.com/kb/168455

That sounds familier, spanning tree is on on all of our switches, but its never caused problems in the past?

So:

DNS:

I dont think its a DNS issue anymore. Ive found a computer that still has the problem, and remove its entry from the DNS list. Still has the problem.

There are no errors in the logs, apart from one thats a result of me enabling scaveging this morning.

DHCP:

Cant find the logs for it, although nothing is listed in the general logs as usual for any DHCP errors.

Netlogon:

Again, no errors.

Apart from two authentication errors for this morning for a machines in the library.

And 5 of the machines i fixed on friday have the problem again.

Gonna do a virus scan on the broken one ive got in here with me, see what i find.

This looks more and more like a SID problem. Have you tried removing and re-adding a machine to the domain?

The reason I say this, is because you mentioned machine authentication problems. Re-adding a machine to the domain will re-create a new SID computer account. I'd be interested to see if this solves your problem.

The authentication problem was with one machine, this morning, that works fine?

The test computer is still scanning for virii at the moment...

A few of the fixed ones have dropped off again according to one of the teachers. .

I assume you've checked the event logs locally for the machines, and the DHCP and WINS logs on the DC?

I dont think its a virus either, as its happened to machines that are with and without virus scanners.

Why do you have machines without virus protection?