Curious Loss of Network Connectivity

Four workstations (XP Pro) lose network connectivity to the server (Server
2003 R2 SP2) each evening between 6:30 and 8:00.

Other network workstations do not exhibit this problem. There are no
differences in software running between the workstions that lose connectivity
and the workstations that don't.

The only thing in common among these four workstations is that they were all
purchased at the same time from the same manufacturer.

This problem only manifested after the server OS was upgraded to SP2.

I have removed and reinstalled AV software, with no effect. The NICs are not
going to sleep. I have left and rejoined the domain. There are no "timed"
programs running. There are absolutely no software differences between these
four and the other workstations that function properly.

Thanks in advance.

Hi,

Here are a few questions that may help to troubleshoot:

Have you checked the event logs on the clients and the server during this
period? What events occur?
What devices are between the clients and the server?
Do the clients maintain connectivity to these intermediate devices?
Do the clients maintain connectivity to other servers on the same network?

--
Greg Lindsay [MSFT]

Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.

"ODBMusic" <(E-Mail Removed)> wrote in message
news:772751D2-F60A-47F2-87AA-(E-Mail Removed)...
> Four workstations (XP Pro) lose network connectivity to the server (Server
> 2003 R2 SP2) each evening between 6:30 and 8:00.
>
> Other network workstations do not exhibit this problem. There are no
> differences in software running between the workstions that lose
> connectivity
> and the workstations that don't.
>
> The only thing in common among these four workstations is that they were
> all
> purchased at the same time from the same manufacturer.
>
> This problem only manifested after the server OS was upgraded to SP2.
>
> I have removed and reinstalled AV software, with no effect. The NICs are
> not
> going to sleep. I have left and rejoined the domain. There are no "timed"
> programs running. There are absolutely no software differences between
> these
> four and the other workstations that function properly.
>
> Thanks in advance.

[ Have you checked the event logs on the clients and the server during this
period? What events occur?]

I found the following events:

The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible. No
attempt to contact a source will be made for 479 minutes. NtpClient has no
source of accurate time.

The Security System detected an attempted downgrade attack for server
cifs/SERVER. The failure code from authentication protocol Kerberos was
"There are currently no logon servers available to service the logon request.

The Security System could not establish a secured connection with the server
cifs/SERVER. No authentication protocol was available.
------------------------------------

[What devices are between the clients and the server?]

There is a Linksys router between the clients and server
------------------------------------

[Do the clients maintain connectivity to these intermediate devices?]

Yes
------------------------------------
[Do the clients maintain connectivity to other servers on the same network?]

There are no other servers on the same network

Hi,

It seems to me that if the server became unavailable, you might get these
events on the client, so they may not be a cause but rather symptoms of the
problem. What kind of services is the server running? Is it a DC? When the
clients lose connectivity, do you lose connectivity to the netbios name of
the server, the FQDN of the server, the IP address of the server, or all of
these?

I found this link that describes several situations that can lead to the
error event you are seeing:
http://www.eventid.net/display.asp?e...LsaSrv&phase=1. I
don't know if these will help, but some of the scenarios might sound
familiar to you.

--
Greg Lindsay [MSFT]

Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.

"ODBMusic" <(E-Mail Removed)> wrote in message
news:116B1499-102A-4372-9BBF-(E-Mail Removed)...
>[ Have you checked the event logs on the clients and the server during this
> period? What events occur?]
>
> I found the following events:
>
> The time provider NtpClient is configured to acquire time from one or more
> time sources, however none of the sources are currently accessible. No
> attempt to contact a source will be made for 479 minutes. NtpClient has no
> source of accurate time.
>
> The Security System detected an attempted downgrade attack for server
> cifs/SERVER. The failure code from authentication protocol Kerberos was
> "There are currently no logon servers available to service the logon
> request.
>
> The Security System could not establish a secured connection with the
> server
> cifs/SERVER. No authentication protocol was available.
> ------------------------------------
>
> [What devices are between the clients and the server?]
>
> There is a Linksys router between the clients and server
> ------------------------------------
>
> [Do the clients maintain connectivity to these intermediate devices?]
>
> Yes
> ------------------------------------
> [Do the clients maintain connectivity to other servers on the same
> network?]
>
> There are no other servers on the same network

[It seems to me that if the server became unavailable, you might get these
events on the client, so they may not be a cause but rather symptoms of the
problem.]

*** Yes, but the problem is only manifesting on FOUR workstations.

[ What kind of services is the server running?]

*** The following services are run on the server:

Application Experience Lookup Service
Application Layer Gateway Service
Automatic Updates
Background Intelligent Transfer Service
Backup Exec Agent Browser
Backup Exec Device & Media Service
Backup Exec Job Engine
Backup Exec Remote Agent for WIndows Servers
Backup Exec Server
COM+ Event System
Computer Browser
Cryptographic Services
DCOM Server Process Launcer
DHCP Client
Distributed File System
Distributed Transaction Coordinator
DNS Ckient
DNS Server
Error Reporting Service
Event Log
File Replication Service
File Serer for Macintosh
Help and Support
Intel PDS
Intersite Messaging
IPSEC Services
Kerbos Key Distribution Center
Logical Disk Manager
MSSQL$BKUPEXEC
MSSQL$BKUPEXECDLO
Net Login
Network Connections
Network Location Awareness
Plug and Play
Print Spooler
Protected Storage
Remote Access Connection Manager
Remote Procedure Call
Remote Registry
RevUDFService
Secondary Logon
Security Accounts manager
Server
Shell Hardware Detection
Symantec Antivirus
Symantec Antivirus Definition Watcher
Symantec Event Manager
Symantec Settings Manager
Symantec System Center Discovery Service
System Event Notification
Task Scheduler
TCP/IP NetBIOS Helper
Telephony
Terminal Services
UPS Service
Windows Audio
Windows Defender
Windows Firewall/Internet Connection Sharing
Windows Management Instrumentation
WIndows Time
Wireless Configuration
Workstation

[Is it a DC?]

*** Yes

[When the clients lose connectivity, do you lose connectivity to the netbios
name of
the server, the FQDN of the server, the IP address of the server, or all of
these?]

*** All of them

As I stated before, the problem began immediately after applying the Service
Pack 2 update, and is only occurring on four workstations.

Hi,

What I meant below was not that the server is becoming globally unavailable,
but that from a client perspective, whatever is causing this problem may be
producing the events you see. Something else to check is whether or not
there are tasks set up in scheduled tasks.

Network monitor may tell you something. I suggest running it on one of the
clients that lose connectivity and also the server, and perhaps a client
that doesn't lose connectivity. A test you might also consider is to connect
one of the clients on the same side of the router as the server, and test
connectivity from client to client and client to server.

--
Greg Lindsay [MSFT]

Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.

"ODBMusic" <(E-Mail Removed)> wrote in message
news:F117061F-3688-43EA-B273-(E-Mail Removed)...
> [It seems to me that if the server became unavailable, you might get these
> events on the client, so they may not be a cause but rather symptoms of
> the
> problem.]
>
> *** Yes, but the problem is only manifesting on FOUR workstations.
>
> [ What kind of services is the server running?]
>
> *** The following services are run on the server:
>
> Application Experience Lookup Service
> Application Layer Gateway Service
> Automatic Updates
> Background Intelligent Transfer Service
> Backup Exec Agent Browser
> Backup Exec Device & Media Service
> Backup Exec Job Engine
> Backup Exec Remote Agent for WIndows Servers
> Backup Exec Server
> COM+ Event System
> Computer Browser
> Cryptographic Services
> DCOM Server Process Launcer
> DHCP Client
> Distributed File System
> Distributed Transaction Coordinator
> DNS Ckient
> DNS Server
> Error Reporting Service
> Event Log
> File Replication Service
> File Serer for Macintosh
> Help and Support
> Intel PDS
> Intersite Messaging
> IPSEC Services
> Kerbos Key Distribution Center
> Logical Disk Manager
> MSSQL$BKUPEXEC
> MSSQL$BKUPEXECDLO
> Net Login
> Network Connections
> Network Location Awareness
> Plug and Play
> Print Spooler
> Protected Storage
> Remote Access Connection Manager
> Remote Procedure Call
> Remote Registry
> RevUDFService
> Secondary Logon
> Security Accounts manager
> Server
> Shell Hardware Detection
> Symantec Antivirus
> Symantec Antivirus Definition Watcher
> Symantec Event Manager
> Symantec Settings Manager
> Symantec System Center Discovery Service
> System Event Notification
> Task Scheduler
> TCP/IP NetBIOS Helper
> Telephony
> Terminal Services
> UPS Service
> Windows Audio
> Windows Defender
> Windows Firewall/Internet Connection Sharing
> Windows Management Instrumentation
> WIndows Time
> Wireless Configuration
> Workstation
>
> [Is it a DC?]
>
> *** Yes
>
> [When the clients lose connectivity, do you lose connectivity to the
> netbios
> name of
> the server, the FQDN of the server, the IP address of the server, or all
> of
> these?]
>
> *** All of them
>
> As I stated before, the problem began immediately after applying the
> Service
> Pack 2 update, and is only occurring on four workstations.