Strange Latency? Issues with logging in.

[HodgeHi]

Hello Each,

 

A slight issue has appeared on my network. when users log in they get the loading your personal setting and then the applying your personal settings but then that dialog box disappears leaving them with a blank blue screen.

 

It seems as though explorer just seems to forget to start.

 

I have redirected the desktop and re-directed the folders my documents and the start memu. All pupils use the same mandatory profile but only on average of around 25 pupils log on at one time.

 

I can't understand this issue as if you restart the machine it then logs on fine. This follows a problem where some pupils logged in and got the redirected desktop but failed to get all the shortcuts, although the policys were being applied successfully. I have only got one server one the domain at the moment and am wondering if this coould be the problem.

 

The server shouldn't be stretched thoughas it is a brand new dual-core 3Ghz proliant ml150 g3. It has 1Gb or RAM as well as 3 HDDs one for each part of the operation e.g, profiles stored on one witha partition for the AD DB and a drive for the OS and also a drive for the apps.

 

Any ideas on how to troubleshoto or even what would cause these drop-outs?

[HodgeHi]

This is really getting on my nerves now.

 

There are some machines that log onto the domain in under around a minute and some still dawdle along taking their time.

 

But i also have issues where the policys for some users doesn't apply at all. This is due to the users picking age old shares for their re-directed folders (such as dekstop) instead of the one specified. Some users are not picking up the shortcuts on the re-directed dekstop, as if the mapped drive to the apps hasn't been mapped. This results in some users having to re-log back in and if it takes the dawdle method, obviously they get annoyed.

 

I have checked the DNS and cannot see any real problems and some machines log in fine so surely they would all be the same. I can't think of anything else that might be causing this problem. I have run GPO wizard to check the policies and no errors are called. The users are all in the same groups and as i said most pick up the correct settings and log in fine.

 

PS the profiles are all mandatory yet some pick up old shares for re-direction as stated.

[SteveT]

I recently had this sort of problem and it was most definitely a DNS issue.

 

Solved by removing machines from network then rejoining them. Think it was borked sids on machines.

[HodgeHi]

i recently set up secure dynamic dns for the AD as this was set to unsecure and secure. Would this have an effect on the machines registering their dns with the active directory?

[Geoff]

If you have secure DNS and the machines secure channel/domain trust/etc fails it'll be unable to update it's DNS records.

[HodgeHi]

So is it best to leave it as unsecured?

[Geoff]

Well it's best to fix your clients. You're treating the symptoms rather than the cause otherwise. Even if you switched to unsecured DNS you'd hit other problems. For example GPO's not applying correctly.

 

You need to find out what's wrong with these client machines. Netdiag is your best bet for this.

[HodgeHi]

Thanks for that i will try netdiag tomorrow. I understand what you are saying about the curing the causes, its just difficult to do anything when everyones moaning about log in time but then won't leave the clients alone long enough to repair them. I was hoping that it was something i could do at the server end to resolve the issue. i know that machine is free.

[Ric_]

almost definately DNS issues... don't forget to run dcdiag on your DCs.

 

check that your clients are looking at the right DNS servers (i.e. yours and not county ones for instance - your DNS servers should forward up to these servers)

 

it might also be worth re-installing dns... drastic but there might be a deep rooted problem.

[Geoff]

You should also think about using some network monitoring tools if you aren't already. Cacti and Nagios are idea for spotting long term trends and the occasional hiccup that might upset things.

[HodgeHi]

There is probably a underlying DNS issue as before i got here the servers were migrated from one domain to a new domain name and the dns still holds the old domain name entries. There is a reverse lookup for the external range that the main server used to forward requests to the router. This was used as the gateway.

 

I do think that a fresh dns database is needed but am unsure about how i would install dns fresh without upsetting the active directory as it is integrated. Would it be just a case of uninstall and re-install?

 

One other thing that is bugging me is when i ping an unknown computer name (one that i know doesn't exist) i get a response from an external ip of 212.227.34.3 everytime. This suggests to me a dns issue also, but there is only one dns server online that forwards requests to the censornet box for external addresses.

[HodgeHi]

OK. Ihave managed to run the netdiag tool on a client and the server.

 

The server just states a couple of errors regarding the netBT but on a search these seem to the norm (about a workstation service and a messenger service not running).

 

The client on the other hand fails the kerberos test with the following:

 

Kerberos test. . . . . . . . . . . : Failed

[FATAL] Kerberos does not have a ticket for host/ICT-01.CRONEHILLS.SANDWELL.CO.UK.

 

 

I have tried a search but can only find things that point to ruuni9ng win2000 server under a 2003 domain. But i ain't doing this?

 

I have just run it on a second client with the same output. I am now trying each client.

[Geoff]

Does KB 870692 apply to you?

[HodgeHi]

No it doesn't really apply to me. I type the pevious response incorrectly it should have been the other way around as per the KB article.

 

I have since removed the computer from the domain and the re-joined it to find that the kerberos has passed but the dns has now failed saying it is wrong on all dc's.

[Geoff]

I have since removed the computer from the domain and the re-joined it to find that the kerberos has passed but the dns has now failed saying it is wrong on all dc's.

 

Ok, rejoining the domain fixing the client seems to point to my original suggestion that the secure channel had failed. What's wrong with the DNS specifically? SRV records perhaps?

[HodgeHi]

There is currently only one server now that should be listed as an srv record as the other two DCs have recently been demoted ready for -reinstall.

 

I can't confirm at the moment as i am not at work (not in the building anyhow). But the DNS on this machine just points itself and then the forwarder is to the censornet box. Does the censornet box run its own dns?

 

I have set the dns settings on the censornet external connection set to the router to deal with and it seemsto be working ok. Clients access the interent ia the censornet box and everything gets resolved internally. One problem i have though as mentioned 5 posts ago is the pinging resolutions.

 

Is there any other information that is needed to help me resolve these issues? I have run nsloolkup with regards to the srv records and it resolves i think correctly with the response of one record which is the main controller.

[tosca925]

Has you are from a Sandwell address why don't you get Broadband Sandwell in to have a look at it. I think Keith is the contact you will need to speak to. From what i hear from other Sandwell techies Keith knows his DNS.

[HodgeHi]

I have called K. Chandler in to have a look at the issue that i was getting as the clients were getting the router address for dns entries instead of the dns for the main server. This was leading to the machines obviously failing to log in correctly. I tracked down the issue before he arived which ended up being that the censornet had been turned off and restarted during the hols because the pat testing had been completed. I DID NOT know about that!!

 

But i still have issues with the clients failing the kerberos test during the net diag. I asked Keith Chandler and his response was that he didn't know. So my question is, does any one else?

 

My clients log in fin enow but still when the room logs in there seem sto be the issue where some clients end up with just a blue screen for ages. but when restarted they seem to be fine. Is it a case of the server being bogged down with too many requests at once?