Clients hang at logon

[Newton]

Windows 2003 DC with XP clients all about 2 years old and fully service packed and updated, on a single site.

 

When you attempt to log on to a PC, i enter the account details, uname and password click ok, the box goes gray and the pc appears to hang if left long enought..20minutes you either get a blank screen or it goes back to the login screen.

Restart the PC and it will log in fine.

Also when attempting to access a network resource the client will hang.

 

The above happens at random on random PCs there is nothing in the event logs thats relevant on the server or the clients and DNS appears fine.

 

The network traffic on the server does seam very heavey (but this may be a red herring)

 

Does anyone have any ideas??

[BKGarry]

Application Data?

 

We had this once, we redirected to application Data to a new place and it seems to have solved it, although sometimes we have to randomly delete peoples APPDATA.

[elsiegee40]

Sounds like one or more user profiles have become corrupt.

 

Does it happen to some users everywhere, or all users on some machines?

[Newton]

It appears to be all users, everywhere. Its being very ahrd to diagnose, as rebooting the system fixes it for a day. then its goes wired again.

 

APPDATA?? - do you mean the appdata folder in the user profile - can you explan please.

[cookie_monster]

Is it the same if you logon with a user that has no roaming user profile or local user profile?

 

Can you run ipconfig /all on the server and a workstation and post the result?

[HodgeHi]

What AV software do you use.

 

I see a blue screen after logging on and then no further, although it doesn't log back off. Is there a setting thats logs users off after standing idle for so long? Its as if explorer fails to run.

 

My AV is Norton AV and i only see this issue as soon as it is deployed to the clients. I also get RTVScan errors when they log off sometimes as well.

 

Never really looked into it though.

[Newton]

All profiles are local

just noticed it also takes a while at the log off screen (before closing network contections)

 

We use Sophos v6

[ICT_GUY]

Check your DNS settings and servers.

Check your event viewers, on client and server.

[SYNACK]

Could be bad NIC drivers, if the pc has been left on for a while windows may have put the cards into standby/low power mode. If the driver is a bit screwy it will not be able to wake it up properly and hence lock up waiting for network traffic.

 

You could try disabling power save on the cards if you have not already and updating the drivers.

[Newton]

Have already

The event view has nothing relevant and is DNS quite happy

[cookie_monster]

Can you run ipconfig /all on the server and a workstation and post the result?

 

Also get a copy of netdiag and dcdiag and run them on the server then post any errors.

[Guest salan]

Hi All,

This could have nothing to do with it but for what its worth (which is just below zilch!)....

We have just gone from Sophos 6 to 7 and the default changed on me!

What happened was that when people went to log off, the AV was trying to scan to whole network drive! so it stayed on 'saving settings' for ever.

Just wondered if it is something similar happening on start up do to the machine trying to access a network reasource?

 

Might be worth turning off SAV and try it or at least look at what it is set to scan.

 

Alan

[Newton]

More info

just discovered that I can not ping a client PC while it is at the logon screen or hung waiting for me to login. Its listed in DNS and DHCP.

 

EDIT: the PCs was networking quite happily (internet and network drives) before log off)

 

Still on Sophos 6 going to 7 soon - I hope its not doing anything like that

[cookie_monster]

Ok are the trouble PC's in a similar area? Connected to a common switch?

[Newton]

For thouse of you following this with baited breath.....

I was able to log on to a pc with a local user, but could not release or renew the ip address, or access the firewall settings from control panel.

I could ping the server and ping google, not not access the website or ping the client or other clients.

Attempting to stop the windows firewall service did do anything

 

I'm currently disabling windows firewall.

[cookie_monster]

Have you tried netdiag on a PC and the server?

 

How many PC's are you seeing this issue on?

[Newton]

Its difficult to say how many PCs as I'm only on site once a month, and the responce from staff differs. (I was told it was all ok this afternoon first system I used promptly hung - the one next to it fine)

 

They are all on a sinlge switch, getting netdiag now

[Newton]

disabled firewall

disabled power save on the nic

updated to latest driver

feeling happy that the solution was found

netdiag result

 

......................................

 

Computer Name: SERVER

DNS Host Name: server.LEA.local

System info : Windows 2000 Server (Build 3790)

Processor : x86 Family 15 Model 4 Stepping 3, GenuineIntel

List of installed hotfixes :

KB911564

KB921503

KB925398_WMP64

KB925876

KB925902

KB926122

KB927891

KB929123

KB929969

KB930178

KB931768-IE7

KB931784

KB931836

KB932168

KB933360

KB933566-IE7

KB933729

KB933854

KB935839

KB935840

KB935966

KB936021

KB936357

KB936782

KB937143-IE7

KB938127-IE7

KB939653-IE7

KB941202

KB941672

KB943460

Q147222

 

 

Netcard queries test . . . . . . . : Passed

[WARNING] The net card 'Marvell Yukon 88E8050 PCI-E ASF Gigabit Ethernet Controller' may not be working.

 

 

 

Per interface results:

 

Adapter : LAN

 

Netcard queries test . . . : Failed

NetCard Status: DISCONNECTED

Some tests will be skipped on this interface.

 

Host Name. . . . . . . . . : server

Autoconfiguration IP Address : 169.254.113.67

Subnet Mask. . . . . . . . : 255.255.0.0

Default Gateway. . . . . . :

Dns Servers. . . . . . . . :

 

 

Adapter : Curric

 

Netcard queries test . . . : Passed

 

Host Name. . . . . . . . . : server

IP Address . . . . . . . . : XX.XX.60.2

Subnet Mask. . . . . . . . : 255.255.255.128

Default Gateway. . . . . . : XX.XX.60.1

Primary WINS Server. . . . : 127.0.0.1

Dns Servers. . . . . . . . : 127.0.0.1

 

 

AutoConfiguration results. . . . . . : Passed

 

Default gateway test . . . : Passed

 

NetBT name test. . . . . . : Passed

[WARNING] At least one of the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names is missing.

 

WINS service test. . . . . : Failed

The test failed. We were unable to query the WINS servers.

 

 

Global results:

 

 

Domain membership test . . . . . . : Passed

 

 

NetBT transports test. . . . . . . : Passed

List of NetBt transports currently configured:

NetBT_Tcpip_{C0F656BC-0C6B-41F2-9157-8DF9F89D219B}

NetBT_Tcpip_{17A5FE4B-7AEA-4377-94AD-CC14C296129D}

2 NetBt transports currently configured.

 

 

Autonet address test . . . . . . . : Passed

 

 

IP loopback ping test. . . . . . . : Passed

 

 

Default gateway test . . . . . . . : Passed

 

 

NetBT name test. . . . . . . . . . : Passed

[WARNING] You don't have a single interface with the <00> 'WorkStation Service', <03> 'Messenger Service', <20> 'WINS' names defined.

 

 

Winsock test . . . . . . . . . . . : Passed

 

 

DNS test . . . . . . . . . . . . . : Passed

[WARNING] Cannot find a primary authoritative DNS server for the name

'server.LEA.local.'. [ERROR_TIMEOUT]

The name 'server.LEA.local.' may not be registered in DNS.

PASS - All the DNS entries for DC are registered on DNS server '127.0.0.1' and other DCs also have some of the names registered.

 

 

Redir and Browser test . . . . . . : Passed

List of NetBt transports currently bound to the Redir

NetBT_Tcpip_{C0F656BC-0C6B-41F2-9157-8DF9F89D219B}

NetBT_Tcpip_{17A5FE4B-7AEA-4377-94AD-CC14C296129D}

The redir is bound to 2 NetBt transports.

 

List of NetBt transports currently bound to the browser

NetBT_Tcpip_{17A5FE4B-7AEA-4377-94AD-CC14C296129D}

NetBT_Tcpip_{C0F656BC-0C6B-41F2-9157-8DF9F89D219B}

The browser is bound to 2 NetBt transports.

 

 

DC discovery test. . . . . . . . . : Passed

 

 

DC list test . . . . . . . . . . . : Passed

 

 

Trust relationship test. . . . . . : Skipped

 

 

Kerberos test. . . . . . . . . . . : Passed

 

 

LDAP test. . . . . . . . . . . . . : Passed

 

 

Bindings test. . . . . . . . . . . : Passed

 

 

WAN configuration test . . . . . . : Skipped

No active remote access connections.

 

 

Modem diagnostics test . . . . . . : Passed

 

IP Security test . . . . . . . . . : Skipped

 

Note: run "netsh ipsec dynamic show /?" for more detailed information

 

 

The command completed successfully

[cookie_monster]

updated to latest driver

feeling happy that the solution was found

 

Are you saying you think you've solved the issue?

 

-------------------------------------------------------------

 

Is this a multi homed server that's acting as a domain controller?

[Newton]

Nope just tested and that hasn't fixed it (I was being over optmistic)

sorry if it confused

[cookie_monster]

What client OS are the PC's running?

 

Can you post an ipconfig /all from a client as well?

[Newton]

Windows XP sp2

 

ipconfig

(I've hashed out the full IP address, but the xx are the same though out)

 

Windows IP Configuration

 

 

 

Host Name . . . . . . . . . . . . : CLASS04C

 

Primary Dns Suffix . . . . . . . : LEA.local

 

Node Type . . . . . . . . . . . . : Hybrid

 

IP Routing Enabled. . . . . . . . : No

 

WINS Proxy Enabled. . . . . . . . : No

 

DNS Suffix Search List. . . . . . : LEA.local

 

 

 

Ethernet adapter Local Area Connection:

 

 

 

Connection-specific DNS Suffix . :

 

Description . . . . . . . . . . . : Intel® PRO/100 VE Network Connection #3

 

Physical Address. . . . . . . . . : 00-13-20-8D-07-0F

 

Dhcp Enabled. . . . . . . . . . . : Yes

 

Autoconfiguration Enabled . . . . : Yes

 

IP Address. . . . . . . . . . . . : xx.xx.xx.63

 

Subnet Mask . . . . . . . . . . . : 255.255.255.128

 

Default Gateway . . . . . . . . . : xx.xx.xx.1

 

DHCP Server . . . . . . . . . . . : xx.xx.xx.2

 

DNS Servers . . . . . . . . . . . : xx.xx.xx.2

 

Lease Obtained. . . . . . . . . . : 27 November 2007 14:58:52

 

Lease Expires . . . . . . . . . . : 28 November 2007 14:58:52

 

==========================

I've got to leave the site now (sorry to say, dislike leaving stuff half finished).

 

But if you have any more ideas or comments they are very welcome!!

[PEO]

have you checked your switches, duplicate ip addresses etc?

[PEO]

may be worth restarting all the switches areound the school, also if you have installed any recently make sure you havent given a switch the same ip address as another. did that once and it cause all sorts of problems, only found the problem while changing the ip scope

[cookie_monster]

Ok

 

You said the event viewer has nothing relevant, did you check the client as well as the server?

 

255.255.255.128 only gives you 126 usable addresses is there a chance that the DHCP scope is exhausted?