All Win98 Clients Losing Drive Mappings

Something very strange happened in my office starting around Dec 1.
All our Win98 clients started losing their drive mappings. None of the
XP or W2K systems lost theirs. We have a W2K domain with Active
Directory. When we go to command line and ping by name, the name is
translated just fine. When we do Start, Run, \\<server name>, it
cannot find it. We reboot and still the same problem. We do winipcfg,
release all, renew all, and then reboot, and the same problem occurs.
However, we can do Start, Run, \\<ip addr> and it finds it just fine.
We then tried to do a command line net use statement to map the drives
by server name, but that command failed to find the server because it
couldn't translate it. Our event logs on the domain controllers don't
appear to show any problems with WINS or DNS. When we check the DNS
entries, we see the servers in there under forward lookup and reverse
lookup. The WINS entries are there too. About the only clue going on,
and it might not be a clue, is that we've had some master browser
elections going on with our network. We've also had some spyware
issues that we've treated by either reformatting/reinstall, re-service
pack to the hilt, or we just put Spybot on to remedy the situation --
depending on how severe the problem.

Another odd thing about this is that initially the drive mapping
problem was not all Win98 systems, but some of them, but finally now
the problem shows up on all of them. And the problem is only for two
servers, but going to other servers by name seems to work just fine.
Again, the W2K and XP systems don't have this problem.

The quick fix was to implement hosts and lmhosts files on these few
Win98 systems to do the translations for us. The long term fix is that
we will expunge the remnants of Win98 from our network very soon and
have started the process of migrating those users to XP w/ SP2.

I do realize that a LOT of hackers want to hack us because we are a
profitable industry working with paychecks and taxes, but I thought we
were locked down fairly well and in more than one place. We also have
warehouse rooms in two cities where we have data security teams
analyzing our intranet and Internet traffic to stop embezzlement and
hacking.

Still, however, I'd be curious to know what's going on. Is this some
sort of known virus issue going around? If so, how come the major news
sites don't show any mention of this?

The browser elections will certainly upset W98 clients finding LAN
resources. Any idea what is causing that? Any multihomed or remote access
enabled DCs?

"Google Mike" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) om...
> Something very strange happened in my office starting around Dec 1.
> All our Win98 clients started losing their drive mappings. None of the
> XP or W2K systems lost theirs. We have a W2K domain with Active
> Directory. When we go to command line and ping by name, the name is
> translated just fine. When we do Start, Run, \\<server name>, it
> cannot find it. We reboot and still the same problem. We do winipcfg,
> release all, renew all, and then reboot, and the same problem occurs.
> However, we can do Start, Run, \\<ip addr> and it finds it just fine.
> We then tried to do a command line net use statement to map the drives
> by server name, but that command failed to find the server because it
> couldn't translate it. Our event logs on the domain controllers don't
> appear to show any problems with WINS or DNS. When we check the DNS
> entries, we see the servers in there under forward lookup and reverse
> lookup. The WINS entries are there too. About the only clue going on,
> and it might not be a clue, is that we've had some master browser
> elections going on with our network. We've also had some spyware
> issues that we've treated by either reformatting/reinstall, re-service
> pack to the hilt, or we just put Spybot on to remedy the situation --
> depending on how severe the problem.
>
> Another odd thing about this is that initially the drive mapping
> problem was not all Win98 systems, but some of them, but finally now
> the problem shows up on all of them. And the problem is only for two
> servers, but going to other servers by name seems to work just fine.
> Again, the W2K and XP systems don't have this problem.
>
> The quick fix was to implement hosts and lmhosts files on these few
> Win98 systems to do the translations for us. The long term fix is that
> we will expunge the remnants of Win98 from our network very soon and
> have started the process of migrating those users to XP w/ SP2.
>
> I do realize that a LOT of hackers want to hack us because we are a
> profitable industry working with paychecks and taxes, but I thought we
> were locked down fairly well and in more than one place. We also have
> warehouse rooms in two cities where we have data security teams
> analyzing our intranet and Internet traffic to stop embezzlement and
> hacking.
>
> Still, however, I'd be curious to know what's going on. Is this some
> sort of known virus issue going around? If so, how come the major news
> sites don't show any mention of this?

Microsoft provided us with a solution. First, we had to disable the
multihoming in the PDC and BDC. We didn't need that for them, anyway.
The multihoming we had on our network was so that the backup jobs could
run on an isolated hub, not disturbing client traffic as much. Second,
Microsoft pointed to a KB article and said that we had to stop the
Computer Browser service on all multihomed servers that exist in the
same domain as the PDC. As soon as we did this, the rapid fire Browser
errors in the System Event Log stopped happening. Meanwhile, our Win98
complaints stopped. (Meanwhile, we're going to migrate off the
remaining Win98 systems very, very soon.) So that wrapped it up. Hope
this helps you, everyone!