Win 7 - DHCP/Netlogon/Firewall - Microsoft Confirm a Bug

[teckedd]

Hi,

 

To stop anyone else having the same 'fun' as me, I thought I would share my Windows 7 problem that has resulted in many hours spent testing different DHCP servers, routers, NICS and reviewing packet logs!

 

This problem seems to occur if you have all of the following:

• Using a DHCP reply to forward DHCP requests (e.g. using VLANs and an IP helper on the router to forward DHCP requests)
  
• Windows 7 clients
  
• Windows Firewall Public Profile turned on (default configuration - all profiles)
  
• DhcpConnForceBroadcastFlag = 0 (Default for Windows 7)
  

 

Symptoms

• NETLOGON event ID 5719 in system event log
  This computer was not able to set up a secure session with a domain controller in domain due to the following: There are currently no logon servers available to service the logon request.
  
• Group policies inconsistently applying on start-up
  
• Event ID 50024 logged in the Microsoft-Windows-DHCP Client Events/Operational event log (you need to enable this event log as its disabled by default)
  Ack Receive Timeout has happened in the Interface Id xx
  

 

 

Background

 

By default Windows 7 request for its DHCP reply's to be a uncast responses.

 

If you are using a Windows DHCP server and your client is on the same broadcast domain (not accessing the DHCP server via a DHCP reply) the DHCP server receives the request but ignores the clients request for a uncast response, and reply's in a broadcast. In this situation everything works.

 

The problem occurs when your client has to access the DHCP server via a DHCP relay, such as a router or switch and the DhcpConnForceBroadcastFlag registry key is still set to the default(0). In this situation, the client sends out a broadcasts requesting an IP address, the DHCP relay forwards the request to the DHCP server, the DHCP server sends the reply(ACK reply) to the relay and the DHCP relay sends a uncast reply to the client. If the Public profile is turned on in the Windows Firewall (on by default) then the ACK reply is dropped by the firewall and is never passed to the DHCPclient.dll

 

 

 

Conclusion

 

I passed my findings and research to Microsoft support and after more packet logs and deep Microsoft DHCP\Firewall traces, they have concluded it's a bug! they have now created an internal KB for this problem. This has now been passed to the developers and I am awaiting an acceptable workaround and Microsoft to release a patch.

 

I will post the workaround and a link to the patch when I get more information from Microsoft.

 

Hope this helps,

Edd

Edited July 19, 2010 by teckedd

[spy]

Hi Edd

 

I am experiencing the issues you describe in your post “Win 7 - DHCP/Netlogon/Firewall - Microsoft Confirm a Bug” and have the exact environment you describe. I find that disabling the Windows Firewall or setting the DhcpConnForceBroadcastFlag to 1 works around the issue.

 

Could you give me Microsoft internal KB number as this would be useful opening a support case with Microsoft? Also have they given you any indication of when a patch will be released?

 

Many Thanks,

 

Simon

[teckedd]

Hi Simon,

 

This issue is currently with the debug team... progress is very slow and they have not given me an expected release date. The workaround is to disable the public profile (you don’t need to disable the whole firewall) or change the DhcpConnForceBroadcastFlag to 1. Setting the global broadcast flag works, but you need to delete the DhcpConnForceBroadcastFlag on each NIC, as the local one will override the global one! This would involve a script as each NIC is listed in the registry by its GUID. I personally did not want to do this as I believe increasing broadcasts is rarely a good thing and Microsoft firewall should work!

 

I have requested the internal KB number and will post it when I get it.

 

I hope finding this post saved you a lot of time

 

Thanks

 

Edd

[teckedd]

Hi Simon,

 

As this is with the debug team there is currently no number but if you say you are experiencing a similar problem to case number: 110070944106368 and I have been working with Kapil Thacker that should point them in the correct direction.

 

Thanks

Edd

[teckedd]

Hi,

 

Microsoft have found the location of the bug, but now require a business case to fix it! If you are experiencing this problem please send me a private message with your contact details on so I can try and get Microsoft to produce a hotfix.

 

Thanks for your help,

Edd

[stewie]

Edd,

 

I have this exact same problem on my entire campus. 2 seperate domains, several Windows 7 images, deployed to students, staff and faculty. All of the machines show the same NETLOGON error in the event log. I have worked with the Networking group here to get resolution and the only other solution we have come up with aside from what you wrote above is to use a static IP instead of using DHCP. I was thinking about call Microsoft myself to report your findigns and mine but I just haven't had the time yet.

 

Let me know what more you may need to support the business case to get Microsoft to create a hotfix.

 

Thanks

[teckedd]

Hi Stewie,

 

Thanks for you post. What problem is this causing you? I know that sounds like a stupid question but this is the information MS are asking me for. The main problem I have seen is inconsistent application of GPOs.

 

Thanks

Edd

[stewie]

Edd,

 

So what we are currently seeing are Time-Service events and NETLOGON events flooding the events logs. I also have machines losing their domain memebership due to the fact that the machine passwords after sometime get out of sync because they can't talk to the DC's. I've also experienced GPO's issues, the machines most effected are the public labs and classrooms where I apply quite a bit of Group Policies. Also I personally don't like having any events logged in the events database as it makes troubleshooting other anomolies difficult to resolve.

 

Thanks

[SYNACK]

My question is why are you using the public profile inside the domain network, do you have some kind of special requirements?

[stewie]

Synack,

 

I'm not using the Public firewall, the machines are using a Domain firewall. The problem exists with the Domain connected firewall also.

Edited October 2, 2010 by stewie
misunderstood question

[teckedd]

Hi Synack,

 

We are using the domain profile but the firewall starts in the public profile until the domain controller can be contacted, it then switches to the domain profile. Hence the DHCP problem occurs in the public profile.

 

Thanks

Edd

Edited October 4, 2010 by teckedd

[teckedd]

Hi Stewie,

 

It sounds like you are experiencing even more severe problems than we have seen. It would be very helpful if you created a support case with Microsoft and inform them you are experiencing a similar problem to case number: 110070944106368. I have been working with Kapil Thacker.

 

If they are happy you have the same problem I would hope this would be enough of a business case.

 

 

Thanks

Edd

[SYNACK]

Hi Synack,

 

We are using the domain profile but the firewall starts in the public profile until the domain controller can be contacted, it then switches to the domain profile. Hence the DHCP problem occurs in the public profile.

 

Ah that makes sense, thanks for the clarification. I think that I may have actually seen this behaviour on a couple of our latest machines with the newest intel chipsets. They would not pick up DHCP after a reboot but it was fixed by using the latest intel drivers. As the drivers fixed it I assumed it was their fault given the 'quality' of some intel drivers for Windows 7 so never tried disabling the firewall. Given the presentation though it may well have been related to the same issue.

[spy]

Hi Edd

 

Yes, the post did save me a lot of time especially as it‘s very detailed!

 

My colleague has logged a case with Microsoft and linked it to yours, our engineer at Microsoft will be contacting Kapil soon.

 

Simon

[keatho]

Hi Edd,

 

I am also experiencing a very similair problem with Windows 7 clients. I have two 2003 SP2 DC's and one 2008 R2 DC.

 

Here's the events i get on startup.....

 

Netlogon 5719 - This computer was unable to set up a secure session with a domain controller in domain [Domain] due to the following: There are currently no logon servers available to service the logon request.

 

GroupPolicy 1055 - The processing of Group Policy failed. Windows could not resolve the computer name.

 

Time-Service 129 - NtpClient was unable to set a domain peer to use as a time source because of discovery error.

 

 

As you have mentioned above, disabling the Windows Firewall 'Public Profile' resloves the errors i am getting on startup. I haven't tried the DhcpConnForceBroadcastFlag workaround yet.

 

I haven't logged a job with Microsoft yet but i plan to so it will hopefully speed up the hotfix.

 

I've got one question for you. Are you experiencing these problems on wired and wireless networks?

When i am on a wired network setting a static IP resolves the problem, but on my wireless network setting a static IP does not resolve it. I am going to look into the wireless network here to see what is causing it.

 

Thanks alot for your post, as it has saved me alot of time troubleshooting even further !!

 

 

keatho

[teckedd]

Hi Keatho,

 

Sounds like you could have the same problem!

 

I am getting this problem on both our wireless and cabled network however I have disabled the public profile on all computers until I have a satisfactory fix. A static IP should resolve this problem as this only occurs when using DHCP so you could have two problems.

 

If you log this with Microsoft please can you log the problem the normal way and work with Microsoft to fix it as this will help build weigh to get it fixed. They have had several calls asking for more information but people have not been willing to work with Microsoft to help resolve it so a case does not get logged.

 

Thanks

Edd

[edutech4schools]

I am getting these ID errors when the teachers try to vpn in from home (open vpn AS). Their laptops also slow right down to the point that its unusable. All works fine if the Win7 laptop has never joined the school domain.

 

I have setup synctoy until I can get vpn working.

[keatho]

I have resolved the Group Policy errors i was getting by enabling the following option and setting the wait time to 20 seconds....

 

 

Computer Configuration/Administrative Templates/System/Group Policy/StatupPolicyProcessingWaitTime

[teckedd]

Hi Keatho,

 

Setting that key should resolve the GPO errors however the netlogon errors should still persist, that key only tells the Group Policy engine how long to wait for network before timing out and the cause is down to the computer not getting a DHCP ACK in a timely fashion. I am yet to try this workaround on a laptop; my concern is it will make the laptop wait 20 seconds (or whatever you set) to process GPOs when it’s not connected to the network e.g. home

 

Have you logged a case is Microsoft?

 

Thanks

Edd

[StueyMonster]

Hi,

 

Symptoms

• NETLOGON event ID 5719 in system event log
  This computer was not able to set up a secure session with a domain controller in domain due to the following: There are currently no logon servers available to service the logon request.
  
• Group policies inconsistently applying on start-up
  
• Event ID 50024 logged in the Microsoft-Windows-DHCP Client Events/Operational event log (you need to enable this event log as its disabled by default)
  Ack Receive Timeout has happened in the Interface Id xx
  

 

Edd

 

I have this exact same issue, with all the above appearing in the logs. All 500 of my PCs are set to a Domain as their network location and I can confirm that disabling the Public profile of the firewall solves the problems. For me the problem manifests itself by inconsistent application of Group Policy which means software is impossible to deploy via AD.

 

I recently started managing the Windows Firewall via Group Policy, as until recently I did not need to have any inbound exceptions on the Domain profile, so the defaults were working fine. I'm wondering if it is enabling this policy (Computer Config>Policies>Windows Settings>Security Settings>Windows Firewall with Advanced Security) that causes this abvious (and Microsoft have now admitted) bug?

 

Anyway, may I just say thanks to Teckedd for pointing me to a workaround for now.

 

Stu

[loadme77]

Hi @ all!

 

I have exact the same Issue!

 

Is a MS Hotfix now available? Or is the Business Support Case still missing?

[teckedd]

Hi,

 

Unfortunately it is still with the product group and I am waiting for them to determine if it’s worth fixing. If you have the problem I would suggest logging a support case and this will build an increasing case for it to be resolved.

 

Thanks

Edd

[McBridge]

Hi,

 

I seem to be getting the above error however I have the windows firewall turned off.

 

Could I still be afected?

 

Thanks

[teckedd]

Hi McBridge,

 

If you have all profiles disabled within the Microsoft firewall then I think you probably have a different problem.

 

Thanks

Edd

[simon636]

Teckedd, I too have the same issue using Cisco ip-helpers, 2008R2 DHCP Servers, and Win 7 clients on both wired and wireless. Are you saying that Win 7 on startup is requesting and expecting back a Unicast DHCP Offer by default, and even though it gets a Unicast offer back, it still drops it, and that this is the Microsoft Bug, which only occurs in the Public firewall profile before it transitions to the Domain profile, and that the Domain profile doesnt drop the Unicast offer that it asked for.