Strange DNS Issues

[tg12]

Hi all,

 

Throwing this out there on behalf of my employer who are starting to see a strange issue popping up on several of our sites now, wondering if anyone had any ideas.

 

We've got some Win 10 clients that will spend up to 30 to 40 minutes trying to log using domain credentials then report back that the domain is not available. Local logins work, the network status shows a status of no internet but the client's IP address in the correct range, and can ping server IP addresses, gateways etc. However, trying to ping hostnames, domain names or web addresses fails, suggesting this must be a DNS issue.

 

Things that have been tried so far are things like reinstalling LAN drivers, setting manual IP addresses and DNS settings, resets of the network stack, flushing the DNS cache and trying plugging into different ports of the switch.

 

Any resets of networking on the client end up in it getting a self assigned IP address in the 169. range

 

Any ideas would be appreciated!

 

Thank you

[Sheridan]

What happens when you run an nslookup for a server name, do you get a pretty instant response?

 

The last time I had some dns weirdness was quite a few years ago but it ended up being the arp cache on the switch(s) so I ended up rebooting those as well

[Oaktech]

Turn it off and on again, no really.

 

ALL OF IT

 

Including the switches. As @Sheridan suggests, I'd lay money on an arp issue. We had one recently but it was restricted to our voip vlans so not horrific, we restarted all the phones and switches one evening and the problem hasn't reoccurred.

[mavhc]

nslookup is an entirely separate implementation of dns from the rest of the computer

 

If DHCP fails then I'd suspect ethernet drivers, perhaps they've updated via WU, compare versions to devices that work.

 

Is it always the same devices? Same model? But the computer next to it works fine? Does it start working after a while, or always fail?

 

Could be AV or virtualisation messing with the network stack. netsh show helper

[BKGarry]

Some questions to try and help:

Are there any VLANS?

Are you using RADIUS/NPS at all?

Are all the client devices the same type of network card?

Has there been any firmware updates to the switches?

[RobD]

All the subnets setup correctly in sites and services so the clients know which site they're in and subsequently which DC to auth against?

[Matthewj]

Can you see if this patch is on your servers KB4580390 I've also seen this as multiple sites and we are narrowing it down to a patch.

[tg12]

Can you see if this patch is on your servers KB4580390 I've also seen this as multiple sites and we are narrowing it down to a patch.

 

Aha, this may well be the answer. Our senior tech seemed to narrow it down to patches too, with positive results having removed this one. Think they're currently checking if there's any other patches causing this issue too!

 

Thanks all!