Odd Network Issue - Help!

[maxrebo]

Hi all,

So we had an odd issue in the morning on Tuesday where half of the network couldn't get a IP address upon boot up.

To fix it we have to unplug the Ethernet cable and then plug it back in again, within 5 seconds the connection went from the Globe icon to the Computer icon.

 

What was strange is I had the same issue again overnight (this morning) the PCs would wake on LAN but when they got to the log in screen the NIC almost wasn't active, or couldn't pick up the domain until I unplugged and plugged back in again.

 

Checked both DC's, both online

No pattern to which PCs were offline, different ones the following day.

All scattered around the Network so not linked to a certain Network switch.

 

Check DHCP and there's 46% of IP address free to allocate.

 

I hoping I've fixed it with a server reboot but wont find out until tomorrow.

 

Anyone any ideas?

[AlphamaleZed]

Server reboot should fix it. if not may be a VLAN/Routing issue.

run this on the DCs too.

Get-ADReplicationFailure -Scope Forest | Format-Table Server, FirstFailureTime, FailureCount, LastError

 

Get-ADReplicationPartnerMetadata -Target * -Scope Forest |
Select Server, Partner, LastReplicationSuccess, LastReplicationResult |
Format-Table -AutoSize

 

Get-ADDomainController -Filter * | ForEach-Object {
    Invoke-Command -ComputerName $_.HostName -ScriptBlock {
        Get-SmbShare SYSVOL, NETLOGON -ErrorAction SilentlyContinue
    }
}

 

Resolve-DnsName _ldap._tcp.dc._msdcs.$((Get-ADDomain).DNSRoot)

                                                                                                                         

[Davit2005]

Blooming hate that globe crud.

 

A packet capture might help but you'd want to do that on a mirrored i.e. uplink port to the core switch. Then see what stage end device is failing on a problematic end device i.e. does end device try to discover, does server offer, does end device request, is ack sent?

 

Possibility faulty switch??

 

Network card driver on devices?

 

Seems very wierd, one thing with Win10 and upwards is that they normally only need a eth cable disconnect/reconnect and that forces a DHCP discover so why that fixes the issue could relate to device/switch issue.

 

If it was routing it would not only be issues with DHCP.

 

 

Edited January 21 by Davit2005

[DavR]

Just a thought, but, what is the firewall status on your DCs and/or DHCP servers?

 

Under Control Panel | Network and Sharing Centre, you'll see your NICs and what firewall profile they've got - Domain, Private, or Public.

 

I've had spates of these over the years where Network Location Awareness picks up Public profile after a reboot, which then applies Public firewall, instead of Domain. As a result only certain services work from that server.

 

If your scope is split between two servers, that might indicate why some devices are picking up IP correctly and some not.

[Patrick]

24 minutes ago, DavR said:

Just a thought, but, what is the firewall status on your DCs and/or DHCP servers?

 

Under Control Panel | Network and Sharing Centre, you'll see your NICs and what firewall profile they've got - Domain, Private, or Public.

 

I've had spates of these over the years where Network Location Awareness picks up Public profile after a reboot, which then applies Public firewall, instead of Domain. As a result only certain services work from that server.

 

If your scope is split between two servers, that might indicate why some devices are picking up IP correctly and some not.

 This, I have issues with VM DC's that often do this after a power outage, network outage or a reboot. It can cause all kinds of issues, you can simply disable and then enable the network adapter to force it back to the correct profile. Or physically unplug the network cable. Longer solution is to set the awareness service to delayed start I think? I can't remember off the top of my head. 

[DavR]

1 minute ago, Patrick said:

 This, I have issues with VM DC's that often do this after a power outage, network outage or a reboot. It can cause all kinds of issues, you can simply disable and then enable the network adapter to force it back to the correct profile. Or physically unplug the network cable. Longer solution is to set the awareness service to delayed start I think? I can't remember off the top of my head. 

 

Restarting Network Location Awareness service resolves it, too. It tends to happen if the server can't see a DC during start up, even sometimes if it's the DC itself (annoying!).

 

I have restart NLA as a scheduled task once a week now, just in case.

[Patrick]

It's such a strange bug that causes a whole string of issues. I might do that scheduled task myself. Good idea!

[maxrebo]

Thanks for your help everyone, a Reboot of the DCs seems to have fixed it.

Still a bit a miss as to why it happened, Dcs hadn't rebooted (uptime was 30 or 40 hours).

A service must have stopped somewhere maybe?!.