Zoom7000 Posted October 21, 2017 Posted October 21, 2017 Yesterday, I noticed that I couldn't connect to certain PCs anymore using AB Tutor. I called support who asked me to ping and telnet to the PCs and realised I couldn't ping them at all. First things first, Windows Firewall is switched off in GPO. Doubled checked on the PCs themselves and yes, it's still switched off. Also, the domain controller can ping all the PCs, just the PCs can't ping each other. Another thing that is weird is that the ipconfig command is now showing the IPv6 address as the main address instead of the IPv4 address. What gets even weirder is that I have an NPLS link between my 2 sites and PCs at my 2nd site, running the same build of Windows and same setup, can ping my PCs at the 1st site, but my PCs at the 1st site can't ping each other! Any ideas what could be causing this and any ideas why they would now be displaying IPv6 by default and how I can switch it off remotely on all PCs?
Geoff Posted October 21, 2017 Posted October 21, 2017 (edited) You really shouldn't disable the firewalls on clients if you can help it. This smells like a routing issue. Is you default gateway correct on these machines? Do they have the right subnet set? Is your router working and configured correctly? The following powershell will disable IPv6 on all interfaces except the loopback adapter. New-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\' ` -Name 'DisabledComponents' -Value '0xffffffff' -PropertyType 'DWord' You will need to reboot for this to take effect. Edited October 21, 2017 by Geoff
Zoom7000 Posted October 21, 2017 Author Posted October 21, 2017 You really should disable the firewalls on clients if you can help it. It is disabled on all clients via GPO. I've logged on to the PCs and confirmed that it is indeed disabled.
Arthur Posted October 21, 2017 Posted October 21, 2017 You really should disable the firewalls on clients if you can help it. Shouldn't that be enable rather than disable? 🤔
MatZeRO Posted October 21, 2017 Posted October 21, 2017 Shouldn't that be enable rather than disable? [emoji848] I’d have thought enable!
MatZeRO Posted October 21, 2017 Posted October 21, 2017 Is you DC pinging the IPv4 address or IPV6 address when it works? Are you pinging by it’s name or by IP?
sparkeh Posted October 21, 2017 Posted October 21, 2017 Or rather, being a little pedantic You really shouldn't disable the firewalls on clients if you can help it
Zoom7000 Posted October 21, 2017 Author Posted October 21, 2017 (edited) I mean't shouldn't. You mean "meant" Okay, well, I'll take that in to account. I was told I had to disable it in order for SOLUS to work properly, but I'll investigate that further. Is you DC pinging the IPv4 address or IPV6 address when it works? Are you pinging by it’s name or by IP? @MatZeRO - The DC is pinging to PCs using IPv4 and using the host name. Connectivity seems to be fine as I can ping, connect via VNC and RDP to the PCs from the DC with no issues. But I can't VNC, ping or RDP to the PCs from my PC or from selected other PCs that are affected. I can't see any differences between affected and unaffected PCs. Edited October 21, 2017 by Zoom7000
DJ-1701 Posted October 21, 2017 Posted October 21, 2017 (edited) Okay, well, I'll take that in to account. I was told I had to disable it in order for SOLUS to work properly, but I'll investigate that further. Horse hockey... I don't know who told you that but the workstations just need ports 52965:TCP (SIMS Solus-3-DS), 52966:TCP (SIMS Solus-3-Agent) and 8739:TCP (SIMS Solus-3-Agent-UI) for Solus. Edit: Adding C:\Program Files\Solus3\AgentService\Sims.Solus3.Agent.UI.exe helps too. Edited October 21, 2017 by DJ-1701 1
Arthur Posted October 21, 2017 Posted October 21, 2017 I don't know who told you that but the workstations just need ports 52965:TCP (SIMS Solus-3-DS), 52966:TCP (SIMS Solus-3-Agent) and 8739:TCP (SIMS Solus-3-Agent-UI) for Solus. Don't forget WMI too.
chrisakak9 Posted October 22, 2017 Posted October 22, 2017 I'd be looking DNS and client isolation settings on your switches/router
mrwoberts Posted October 23, 2017 Posted October 23, 2017 @Zoom7000 could you confirm if you are trying to ping a wireless device? If you are attempting to ping a wireless device, the 'problem' may be down to settings in your wireless management. Some wireless config settings can be block communication between wireless clients, including pings.
Zoom7000 Posted October 23, 2017 Author Posted October 23, 2017 @Zoom7000 could you confirm if you are trying to ping a wireless device? If you are attempting to ping a wireless device, the 'problem' may be down to settings in your wireless management. Some wireless config settings can be block communication between wireless clients, including pings. No, they are all wired devices.
mrwoberts Posted October 23, 2017 Posted October 23, 2017 No, they are all wired devices. Thanks for confirming that. Has anything changed on the switches, and when was the last time you remember being able to successfully ping between PCs? On one of the affected PCs, is it possible to temporarily switch off IPv6 in the NIC properties, and then try to ping the IP and hostname, including a FQDN address.
Zoom7000 Posted October 23, 2017 Author Posted October 23, 2017 Nothing has changed on the switches as far as I'm aware. They're unmanaged Netgear switches, so they're pretty basic in that sense. I remember being able to ping the devices the day before I started this thread. I only noticed it because I couldn't see the PCs in AB Tutor, then I did some further investigation which led to this.
mrwoberts Posted October 23, 2017 Posted October 23, 2017 Okay, any other changes to your network recently? If the DC is pinging happily at the moment, could that be because it hasn't been rebooted yet, whereas the desktop PCs may have been - I'm not saying to reboot the DC by way. Since the site-site ping works, it is beginning to sound more DC/DNS/switch related.
Zoom7000 Posted October 23, 2017 Author Posted October 23, 2017 Okay, any other changes to your network recently? If the DC is pinging happily at the moment, could that be because it hasn't been rebooted yet, whereas the desktop PCs may have been - I'm not saying to reboot the DC by way. Since the site-site ping works, it is beginning to sound more DC/DNS/switch related. Yeah, I'm thinking of doing full reboots on everything (switches, all PCs, DC etc) but I'm on annual leave now, so I might pop in on my last day just to get some testing in before the staff return from half term.
Arthur Posted October 24, 2017 Posted October 24, 2017 Connectivity seems to be fine as I can ping, connect via VNC and RDP to the PCs from the DC with no issues. But I can't VNC, ping or RDP to the PCs from my PC or from selected other PCs that are affected. I can't see any differences between affected and unaffected PCs. In Windows Vista onwards I think Microsoft prevent you from RDPing and pinging when the Windows firewall is switched off... https://superuser.com/questions/137930/ The fix might be as simple as enabling the firewall.
Zoom7000 Posted October 24, 2017 Author Posted October 24, 2017 In Windows Vista onwards I think Microsoft prevent you from RDPing and pinging when the Windows firewall is switched off... https://superuser.com/questions/137930/ The fix might be as simple as enabling the firewall. That's weird because the firewall has always been off and it's always worked. I'll give that a try and see how it goes.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now