DC/DNS/DFS/AD Problem???

I started looking after a small network for a small company about 5
weeks ago. I noticed the problem I am going to describe about 2 weeks
but it may have existed longer. The network is a 100 Mb Ethernet with
3 servers and 12 workstations. The workstations are all Windows XP SP2
and the servers are all Windows Server 2003 R2. There is a Web server,
a database server and a domain controller/DNS / File server, AD is
enabled and netbios is disabled. About 2 or 3 weeks ago I noticed
that I could no longer copy files to or from the DC/File server. I
have tried using xcopy/copy from a command prompt and using windows
explorer. Also when I use remote desktops to remote onto the DC/DNS/
File server it is quite slow and quite often it loses it connection.
If I sit at the console of the DC/DNS/File server everything appears to
function at normal speed except for the file transfers. When I remote
onto the web server and the database server I have no problems or
rather they do not behave like the server in question and if I transfer
files between any of the other member machines, servers or
workstations, I have no problems. Since the DNS is on the machine in
question, I thought that might be the problem but when I run DCdiag and
Netdiag, neither complains about any problems or maybe I am not running
the right tests? I have downloaded MS's Network Monitor 3.0, nice tool
and lots of info but I am definitely a nubie when it comes to
interpeting the captures.

What I have noticed from the captures is that in the Command
prompt/xcopy and Windows Explorer captures I have a DFS Protocol with
DFS in the Description followed by an SMB error that has an SMB
protocol with a description of SMB:R; Transact2, Open2 - NT Status:
System Error, Code = (549) STATUS_NOT_FOUND. Unfortunately as I said I
am a nubie when it comes to this I don't know what it's trying to tell
me.

Any and all help gratefully accepted.

In news:(E-Mail Removed) ups.com,
apprentice463 <(E-Mail Removed)> stated, which I commented on below:
> I started looking after a small network for a small company about 5
> weeks ago. I noticed the problem I am going to describe about 2 weeks
> but it may have existed longer. The network is a 100 Mb Ethernet with
> 3 servers and 12 workstations. The workstations are all Windows XP
> SP2 and the servers are all Windows Server 2003 R2. There is a Web
> server, a database server and a domain controller/DNS / File server,
> AD is enabled and netbios is disabled. About 2 or 3 weeks ago I
> noticed that I could no longer copy files to or from the DC/File
> server. I have tried using xcopy/copy from a command prompt and
> using windows explorer. Also when I use remote desktops to remote
> onto the DC/DNS/ File server it is quite slow and quite often it
> loses it connection. If I sit at the console of the DC/DNS/File
> server everything appears to function at normal speed except for the
> file transfers. When I remote onto the web server and the database
> server I have no problems or rather they do not behave like the
> server in question and if I transfer files between any of the other
> member machines, servers or workstations, I have no problems. Since
> the DNS is on the machine in question, I thought that might be the
> problem but when I run DCdiag and Netdiag, neither complains about
> any problems or maybe I am not running the right tests? I have
> downloaded MS's Network Monitor 3.0, nice tool and lots of info but I
> am definitely a nubie when it comes to interpeting the captures.
>
> What I have noticed from the captures is that in the Command
> prompt/xcopy and Windows Explorer captures I have a DFS Protocol with
> DFS in the Description followed by an SMB error that has an SMB
> protocol with a description of SMB:R; Transact2, Open2 - NT Status:
> System Error, Code = (549) STATUS_NOT_FOUND. Unfortunately as I said
> I am a nubie when it comes to this I don't know what it's trying to
> tell me.
>
> Any and all help gratefully accepted.

I believe your SMB not found errors may be due to NetBIOS being disabled.
HOwever, NetBIOS and SMB do use differentg ports, so I am not committing
myself to this suggestion that it will work, but enable NetBIOS and see what
happens.

What I believe may also be happening because netBIOS is disabled, the system
is defaulting to DFS. but don't quote me on that either because I am not
familiar with your network or AD configuration from the limited information
you provided. Is DFS enabled and configured properly? The not found error
kind of bothers me that indicates either DFS is misconfigured or DNS is
misconfigured. The best way to eliminate this issue is to elaborate on your
DFS configuration (if is is being used), and supply an unedited ipconfig
/all from the DC and from a sample workstation.

btw- Why is NetBIOS disabled? There are some niceties that work with it,
such as network neighborhood, network browsing, printer browsing on the
network (not thru AD), mapped drives by single name.

--
Ace
Innovative IT Concepts, Inc (IITCI)
Willow Grove, PA

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Directory Services
Microsoft Certified Trainer

Having difficulty reading or finding responses to your post?
Instead of the website you're using, I suggest to use OEx (Outlook Express
or any other newsreader), and configure a news account, pointing to
news.microsoft.com. This is a direct link to the Microsoft Public
Newsgroups. It is FREE and requires NO ISP's Usenet account. OEx allows you
to easily find, track threads, cross-post, sort by date, poster's name,
watched threads or subject.
It's easy:

How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

Infinite Diversities in Infinite Combinations
Assimilation Imminent. Resistance is Futile
"Very funny Scotty. Now, beam down my clothes."

The only constant in life is change...

In news:(E-Mail Removed) ups.com,
apprentice463 <(E-Mail Removed)> stated, which I commented on below:


To add, when I searched on "System Error, Code = (549) STATUS_NOT_FOUND.", I
found an issue with McAfee.
http://forums.mcafeehelp.com/viewtopic.php?t=56112

What type of antivirus or firewall are you using on the server or
workstations?

Ace

Here is the ipconfig from the server

Windows IP Configuration

Host Name . . . . . . . . . . . . : selene
Primary Dns Suffix . . . . . . . : auroranet.acsnet.ca
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : auroranet.acsnet.ca
acsnet.ca

Ethernet adapter AuroraNet:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast
Ethernet
NIC
Physical Address. . . . . . . . . : 00-0D-88-31-BB-FD
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.6.90
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.6.1
DNS Servers . . . . . . . . . . . : 127.0.0.1
NetBIOS over Tcpip. . . . . . . . : Disabled

Here is the ipconfig for another server in the network.
Windows IP Configuration

Host Name . . . . . . . . . . . . : HELIOS
Primary Dns Suffix . . . . . . . : auroranet.acsnet.ca
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : auroranet.acsnet.ca
acsnet.ca

Ethernet adapter AuroraNet:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Marvell Yukon 88E8001/8003/8010
PCI Gigab
it Ethernet Controller
Physical Address. . . . . . . . . : 00-0E-A6-8B-A9-B8
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.6.92
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.6.1
DNS Servers . . . . . . . . . . . : 192.168.6.90
NetBIOS over Tcpip. . . . . . . . : Disabled

See below for the rest of my reply

Ace Fekay [MVP] wrote:
> In news:(E-Mail Removed) ups.com,
> apprentice463 <(E-Mail Removed)> stated, which I commented on below:
>
>
> To add, when I searched on "System Error, Code = (549) STATUS_NOT_FOUND.", I
> found an issue with McAfee.
> http://forums.mcafeehelp.com/viewtopic.php?t=56112
>
> What type of antivirus or firewall are you using on the server or
> workstations?
>
> Ace
Yes I read the article from McAfee before I posted here.

No software firewalls on the Servers or Workstations except for the
Webserver. All incoming and outgoing traffic goes through a
Checkpoint hardware firewall. For antivirus we use Computer Associates
AV product.

> btw- Why is NetBIOS disabled? There are some niceties that work with it,
> such as network neighborhood, network browsing, printer browsing on the
> network (not thru AD), mapped drives by single name.

My understanding is that only legacy systems pre W2K need netbios and
possibly SAMBA, not sure about SAMBA though. The only other place that
Netbios is required, that I know about, is when creating trusts between
2 forests. If we ever require it then I will reinstate it for creating
the trust. All necessary drives/devices that each user requires are
mapped using login scripts. BTW, I just disabled netbios about 2 days
ago which was prior to our problem... got tired of seeing all the
unnecessary broadcast traffic. Considering what you said though I
believe that I will reinstate it on the DC and a test workstation and
try another capture with it reinstated to see if the SMB error goes
away. I think DNS is configured okay considering the DCDiag and
Netdiag tests but DFS on the otherhand I am not sure about. Is there a
tool that would test DFS because on a scale of 1 to 10 I know about .01

In news:(E-Mail Removed) ps.com,
apprentice463 <(E-Mail Removed)> stated, which I commented on below:
> Here is the ipconfig from the server
>
> Windows IP Configuration
>
> Host Name . . . . . . . . . . . . : selene
> Primary Dns Suffix . . . . . . . : auroranet.acsnet.ca
> Node Type . . . . . . . . . . . . : Unknown
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : auroranet.acsnet.ca
> acsnet.ca
>
> Ethernet adapter AuroraNet:
>
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast
> Ethernet
> NIC
> Physical Address. . . . . . . . . : 00-0D-88-31-BB-FD
> DHCP Enabled. . . . . . . . . . . : No
> IP Address. . . . . . . . . . . . : 192.168.6.90
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 192.168.6.1
> DNS Servers . . . . . . . . . . . : 127.0.0.1
> NetBIOS over Tcpip. . . . . . . . : Disabled
>
> Here is the ipconfig for another server in the network.
> Windows IP Configuration
>
> Host Name . . . . . . . . . . . . : HELIOS
> Primary Dns Suffix . . . . . . . : auroranet.acsnet.ca
> Node Type . . . . . . . . . . . . : Unknown
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : auroranet.acsnet.ca
> acsnet.ca
>
> Ethernet adapter AuroraNet:
>
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . : Marvell Yukon 88E8001/8003/8010
> PCI Gigab
> it Ethernet Controller
> Physical Address. . . . . . . . . : 00-0E-A6-8B-A9-B8
> DHCP Enabled. . . . . . . . . . . : No
> IP Address. . . . . . . . . . . . : 192.168.6.92
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 192.168.6.1
> DNS Servers . . . . . . . . . . . : 192.168.6.90
> NetBIOS over Tcpip. . . . . . . . : Disabled
>
> See below for the rest of my reply
>
> Ace Fekay [MVP] wrote:
>> In news:(E-Mail Removed) ups.com,
>> apprentice463 <(E-Mail Removed)> stated, which I commented on
>> below:
>>
>>
>> To add, when I searched on "System Error, Code = (549)
>> STATUS_NOT_FOUND.", I found an issue with McAfee.
>> http://forums.mcafeehelp.com/viewtopic.php?t=56112
>>
>> What type of antivirus or firewall are you using on the server or
>> workstations?
>>
>> Ace
> Yes I read the article from McAfee before I posted here.
>
> No software firewalls on the Servers or Workstations except for the
> Webserver. All incoming and outgoing traffic goes through a
> Checkpoint hardware firewall. For antivirus we use Computer
> Associates AV product.
>
>> btw- Why is NetBIOS disabled? There are some niceties that work with
>> it, such as network neighborhood, network browsing, printer browsing
>> on the network (not thru AD), mapped drives by single name.
>
> My understanding is that only legacy systems pre W2K need netbios and
> possibly SAMBA, not sure about SAMBA though. The only other place
> that Netbios is required, that I know about, is when creating trusts
> between 2 forests. If we ever require it then I will reinstate it
> for creating the trust. All necessary drives/devices that each user
> requires are mapped using login scripts. BTW, I just disabled
> netbios about 2 days ago which was prior to our problem... got tired
> of seeing all the unnecessary broadcast traffic. Considering what
> you said though I believe that I will reinstate it on the DC and a
> test workstation and try another capture with it reinstated to see if
> the SMB error goes away. I think DNS is configured okay considering
> the DCDiag and Netdiag tests but DFS on the otherhand I am not sure
> about. Is there a tool that would test DFS because on a scale of 1
> to 10 I know about .01

Is the DFS service enabled or disabled?
Was a DFS root configured?

More info on DFS (generic search page):
http://search.technet.microsoft.com/...query=DFS+2003

DFS, whether be used or not, is also related to AD directory replication.
Since you only have one DC, I wouldn't think this is an issue, however the
service needs to be running whether you've configured a DFS root or not.

Here are some issues that can cause slow performance. There were other hits
that related to SQL.

822219 - You experience slow file server performance and delays occur when
you work with files that are located on a file server:
http://support.microsoft.com/?kbid=822219&SD=tech

JSI Tip 0992. SMB message signing will slow network performance.:
http://www.jsifaq.com/SF/Tips/Tip.aspx?id=0992

JSI Tip 9731. You experience slow network performance using ADSL ...:
http://www.jsifaq.com/SF/Tips/Tip.aspx?id=9731

Slow network performance occurs if you copy files to a domain controller
that is running Windows 2000 or Windows Server 2003:
http://support.microsoft.com/kb/321098

Slow network performance occurs when you select a file on a share that uses
NTFS:
http://support.microsoft.com/kb/265396


Is the DHCP Client Service disabled? This is a *necessary* service on a DC
or any machine for that matter and controls the resolver service, whether
the mahcine is a DHCP client or not. It must be enabled.

NetBIOS, although NOT used by AD, is used by other services, such as the
neighborhood, printer browsing, etc. It is also *REQUIRED* by Exchange. Are
you running Exchange?

SAMBA is an SMB to NFS translator to allow UNIX (Mac OSx, Linux, etc) to
coexist and act like a Windows machine and participate with network
browsing, etc.

I would also change the DNS local loopback address to the actual address, in
your case 192.168.6.90. Loopback addresses can cause 41960 errors. I would
also create a reverse zone for 192.168.6.0/24.

Ace

Ace Fekay [MVP] wrote:
> In news:(E-Mail Removed) ps.com,
> apprentice463 <(E-Mail Removed)> stated, which I commented on below:
> > Here is the ipconfig from the server
> >
> > Windows IP Configuration
> >
> > Host Name . . . . . . . . . . . . : selene
> > Primary Dns Suffix . . . . . . . : auroranet.acsnet.ca
> > Node Type . . . . . . . . . . . . : Unknown
> > IP Routing Enabled. . . . . . . . : No
> > WINS Proxy Enabled. . . . . . . . : No
> > DNS Suffix Search List. . . . . . : auroranet.acsnet.ca
> > acsnet.ca
> >
> > Ethernet adapter AuroraNet:
> >
> > Connection-specific DNS Suffix . :
> > Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast
> > Ethernet
> > NIC
> > Physical Address. . . . . . . . . : 00-0D-88-31-BB-FD
> > DHCP Enabled. . . . . . . . . . . : No
> > IP Address. . . . . . . . . . . . : 192.168.6.90
> > Subnet Mask . . . . . . . . . . . : 255.255.255.0
> > Default Gateway . . . . . . . . . : 192.168.6.1
> > DNS Servers . . . . . . . . . . . : 127.0.0.1
> > NetBIOS over Tcpip. . . . . . . . : Disabled
> >
> > Here is the ipconfig for another server in the network.
> > Windows IP Configuration
> >
> > Host Name . . . . . . . . . . . . : HELIOS
> > Primary Dns Suffix . . . . . . . : auroranet.acsnet.ca
> > Node Type . . . . . . . . . . . . : Unknown
> > IP Routing Enabled. . . . . . . . : No
> > WINS Proxy Enabled. . . . . . . . : No
> > DNS Suffix Search List. . . . . . : auroranet.acsnet.ca
> > acsnet.ca
> >
> > Ethernet adapter AuroraNet:
> >
> > Connection-specific DNS Suffix . :
> > Description . . . . . . . . . . . : Marvell Yukon 88E8001/8003/8010
> > PCI Gigab
> > it Ethernet Controller
> > Physical Address. . . . . . . . . : 00-0E-A6-8B-A9-B8
> > DHCP Enabled. . . . . . . . . . . : No
> > IP Address. . . . . . . . . . . . : 192.168.6.92
> > Subnet Mask . . . . . . . . . . . : 255.255.255.0
> > Default Gateway . . . . . . . . . : 192.168.6.1
> > DNS Servers . . . . . . . . . . . : 192.168.6.90
> > NetBIOS over Tcpip. . . . . . . . : Disabled
> >
> > See below for the rest of my reply
> >
> > Ace Fekay [MVP] wrote:
> >> In news:(E-Mail Removed) ups.com,
> >> apprentice463 <(E-Mail Removed)> stated, which I commented on
> >> below:
> >>
> >>
> >> To add, when I searched on "System Error, Code = (549)
> >> STATUS_NOT_FOUND.", I found an issue with McAfee.
> >> http://forums.mcafeehelp.com/viewtopic.php?t=56112
> >>
> >> What type of antivirus or firewall are you using on the server or
> >> workstations?
> >>
> >> Ace
> > Yes I read the article from McAfee before I posted here.
> >
> > No software firewalls on the Servers or Workstations except for the
> > Webserver. All incoming and outgoing traffic goes through a
> > Checkpoint hardware firewall. For antivirus we use Computer
> > Associates AV product.
> >
> >> btw- Why is NetBIOS disabled? There are some niceties that work with
> >> it, such as network neighborhood, network browsing, printer browsing
> >> on the network (not thru AD), mapped drives by single name.
> >
> > My understanding is that only legacy systems pre W2K need netbios and
> > possibly SAMBA, not sure about SAMBA though. The only other place
> > that Netbios is required, that I know about, is when creating trusts
> > between 2 forests. If we ever require it then I will reinstate it
> > for creating the trust. All necessary drives/devices that each user
> > requires are mapped using login scripts. BTW, I just disabled
> > netbios about 2 days ago which was prior to our problem... got tired
> > of seeing all the unnecessary broadcast traffic. Considering what
> > you said though I believe that I will reinstate it on the DC and a
> > test workstation and try another capture with it reinstated to see if
> > the SMB error goes away. I think DNS is configured okay considering
> > the DCDiag and Netdiag tests but DFS on the otherhand I am not sure
> > about. Is there a tool that would test DFS because on a scale of 1
> > to 10 I know about .01
>
> Is the DFS service enabled or disabled?
> Was a DFS root configured?
>
> More info on DFS (generic search page):
> http://search.technet.microsoft.com/...query=DFS+2003
>
> DFS, whether be used or not, is also related to AD directory replication.
> Since you only have one DC, I wouldn't think this is an issue, however the
> service needs to be running whether you've configured a DFS root or not.
>
> Here are some issues that can cause slow performance. There were other hits
> that related to SQL.
>
> 822219 - You experience slow file server performance and delays occur when
> you work with files that are located on a file server:
> http://support.microsoft.com/?kbid=822219&SD=tech
>
> JSI Tip 0992. SMB message signing will slow network performance.:
> http://www.jsifaq.com/SF/Tips/Tip.aspx?id=0992
>
> JSI Tip 9731. You experience slow network performance using ADSL ...:
> http://www.jsifaq.com/SF/Tips/Tip.aspx?id=9731
>
> Slow network performance occurs if you copy files to a domain controller
> that is running Windows 2000 or Windows Server 2003:
> http://support.microsoft.com/kb/321098
>
> Slow network performance occurs when you select a file on a share that uses
> NTFS:
> http://support.microsoft.com/kb/265396
>
>
> Is the DHCP Client Service disabled? This is a *necessary* service on a DC
> or any machine for that matter and controls the resolver service, whether
> the mahcine is a DHCP client or not. It must be enabled.
>
> NetBIOS, although NOT used by AD, is used by other services, such as the
> neighborhood, printer browsing, etc. It is also *REQUIRED* by Exchange. Are
> you running Exchange?
>
> SAMBA is an SMB to NFS translator to allow UNIX (Mac OSx, Linux, etc) to
> coexist and act like a Windows machine and participate with network
> browsing, etc.
>
> I would also change the DNS local loopback address to the actual address, in
> your case 192.168.6.90. Loopback addresses can cause 41960 errors. I would
> also create a reverse zone for 192.168.6.0/24.
>
> Ace

Thanks Ace, I am not the client site right now. So some of these
answers will be from memory. Most of this was in place before I
arrived and as I mentioned before I am new to some of this so I will be
asking some dumb questions. DFS is enabled but I don't think the root
has been configured. I noticed when I sent you the ipconfig print out
that DHCP was disabled on the DC and meant to ask you if the DHCP would
be needed for DC/AD/DFS server.

Thanks for the clarification on SAMBA.

I hope to get back to the site tonight verify some of the other items

A

apprentice463 wrote:
> Ace Fekay [MVP] wrote:
> > In news:(E-Mail Removed) ps.com,
> > apprentice463 <(E-Mail Removed)> stated, which I commented on below:
> > > Here is the ipconfig from the server
> > >
> > > Windows IP Configuration
> > >
> > > Host Name . . . . . . . . . . . . : selene
> > > Primary Dns Suffix . . . . . . . : auroranet.acsnet.ca
> > > Node Type . . . . . . . . . . . . : Unknown
> > > IP Routing Enabled. . . . . . . . : No
> > > WINS Proxy Enabled. . . . . . . . : No
> > > DNS Suffix Search List. . . . . . : auroranet.acsnet.ca
> > > acsnet.ca
> > >
> > > Ethernet adapter AuroraNet:
> > >
> > > Connection-specific DNS Suffix . :
> > > Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast
> > > Ethernet
> > > NIC
> > > Physical Address. . . . . . . . . : 00-0D-88-31-BB-FD
> > > DHCP Enabled. . . . . . . . . . . : No
> > > IP Address. . . . . . . . . . . . : 192.168.6.90
> > > Subnet Mask . . . . . . . . . . . : 255.255.255.0
> > > Default Gateway . . . . . . . . . : 192.168.6.1
> > > DNS Servers . . . . . . . . . . . : 127.0.0.1
> > > NetBIOS over Tcpip. . . . . . . . : Disabled
> > >
> > > Here is the ipconfig for another server in the network.
> > > Windows IP Configuration
> > >
> > > Host Name . . . . . . . . . . . . : HELIOS
> > > Primary Dns Suffix . . . . . . . : auroranet.acsnet.ca
> > > Node Type . . . . . . . . . . . . : Unknown
> > > IP Routing Enabled. . . . . . . . : No
> > > WINS Proxy Enabled. . . . . . . . : No
> > > DNS Suffix Search List. . . . . . : auroranet.acsnet.ca
> > > acsnet.ca
> > >
> > > Ethernet adapter AuroraNet:
> > >
> > > Connection-specific DNS Suffix . :
> > > Description . . . . . . . . . . . : Marvell Yukon 88E8001/8003/8010
> > > PCI Gigab
> > > it Ethernet Controller
> > > Physical Address. . . . . . . . . : 00-0E-A6-8B-A9-B8
> > > DHCP Enabled. . . . . . . . . . . : No
> > > IP Address. . . . . . . . . . . . : 192.168.6.92
> > > Subnet Mask . . . . . . . . . . . : 255.255.255.0
> > > Default Gateway . . . . . . . . . : 192.168.6.1
> > > DNS Servers . . . . . . . . . . . : 192.168.6.90
> > > NetBIOS over Tcpip. . . . . . . . : Disabled
> > >
> > > See below for the rest of my reply
> > >
> > > Ace Fekay [MVP] wrote:
> > >> In news:(E-Mail Removed) ups.com,
> > >> apprentice463 <(E-Mail Removed)> stated, which I commented on
> > >> below:
> > >>
> > >>
> > >> To add, when I searched on "System Error, Code = (549)
> > >> STATUS_NOT_FOUND.", I found an issue with McAfee.
> > >> http://forums.mcafeehelp.com/viewtopic.php?t=56112
> > >>
> > >> What type of antivirus or firewall are you using on the server or
> > >> workstations?
> > >>
> > >> Ace
> > > Yes I read the article from McAfee before I posted here.
> > >
> > > No software firewalls on the Servers or Workstations except for the
> > > Webserver. All incoming and outgoing traffic goes through a
> > > Checkpoint hardware firewall. For antivirus we use Computer
> > > Associates AV product.
> > >
> > >> btw- Why is NetBIOS disabled? There are some niceties that work with
> > >> it, such as network neighborhood, network browsing, printer browsing
> > >> on the network (not thru AD), mapped drives by single name.
> > >
> > > My understanding is that only legacy systems pre W2K need netbios and
> > > possibly SAMBA, not sure about SAMBA though. The only other place
> > > that Netbios is required, that I know about, is when creating trusts
> > > between 2 forests. If we ever require it then I will reinstate it
> > > for creating the trust. All necessary drives/devices that each user
> > > requires are mapped using login scripts. BTW, I just disabled
> > > netbios about 2 days ago which was prior to our problem... got tired
> > > of seeing all the unnecessary broadcast traffic. Considering what
> > > you said though I believe that I will reinstate it on the DC and a
> > > test workstation and try another capture with it reinstated to see if
> > > the SMB error goes away. I think DNS is configured okay considering
> > > the DCDiag and Netdiag tests but DFS on the otherhand I am not sure
> > > about. Is there a tool that would test DFS because on a scale of 1
> > > to 10 I know about .01
> >
> > Is the DFS service enabled or disabled?
> > Was a DFS root configured?
> >
> > More info on DFS (generic search page):
> > http://search.technet.microsoft.com/...query=DFS+2003
> >
> > DFS, whether be used or not, is also related to AD directory replication.
> > Since you only have one DC, I wouldn't think this is an issue, however the
> > service needs to be running whether you've configured a DFS root or not.
> >
> > Here are some issues that can cause slow performance. There were other hits
> > that related to SQL.
> >
> > 822219 - You experience slow file server performance and delays occur when
> > you work with files that are located on a file server:
> > http://support.microsoft.com/?kbid=822219&SD=tech
> >
> > JSI Tip 0992. SMB message signing will slow network performance.:
> > http://www.jsifaq.com/SF/Tips/Tip.aspx?id=0992
> >
> > JSI Tip 9731. You experience slow network performance using ADSL ...:
> > http://www.jsifaq.com/SF/Tips/Tip.aspx?id=9731
> >
> > Slow network performance occurs if you copy files to a domain controller
> > that is running Windows 2000 or Windows Server 2003:
> > http://support.microsoft.com/kb/321098
> >
> > Slow network performance occurs when you select a file on a share that uses
> > NTFS:
> > http://support.microsoft.com/kb/265396
> >
> >
> > Is the DHCP Client Service disabled? This is a *necessary* service on a DC
> > or any machine for that matter and controls the resolver service, whether
> > the mahcine is a DHCP client or not. It must be enabled.
> >
> > NetBIOS, although NOT used by AD, is used by other services, such as the
> > neighborhood, printer browsing, etc. It is also *REQUIRED* by Exchange. Are
> > you running Exchange?
> >
> > SAMBA is an SMB to NFS translator to allow UNIX (Mac OSx, Linux, etc) to
> > coexist and act like a Windows machine and participate with network
> > browsing, etc.
> >
> > I would also change the DNS local loopback address to the actual address, in
> > your case 192.168.6.90. Loopback addresses can cause 41960 errors. I would
> > also create a reverse zone for 192.168.6.0/24.
> >
> > Ace
>
> Thanks Ace, I am not the client site right now. So some of these
> answers will be from memory. Most of this was in place before I
> arrived and as I mentioned before I am new to some of this so I will be
> asking some dumb questions. DFS is enabled but I don't think the root
> has been configured. I noticed when I sent you the ipconfig print out
> that DHCP was disabled on the DC and meant to ask you if the DHCP would
> be needed for DC/AD/DFS server.
>
> Thanks for the clarification on SAMBA.
>
> I hope to get back to the site tonight verify some of the other items
>
> A
Little bit of an update.

The DFS Service was enabled but no root. The DFS Root has now been
defined.
I had seen most of the articles that you spoke of, although I should
mention I tend to steer away from articles that don't refer to windows
XP/2000/2003. I forgot to mention that I had already looked at
kb321098 and when I checked the registry location specified the
TcpDelAckTicks was set to 0 and TcpAckFrequency was set to 1
(kb328890). I tried different values for each of these although I
didn't stray to far from the default settings.

The DHCP client service was enabled on all machines.

I have changed the DNS local loopback address to the actual address as
suggested.

I even enabled netbios on the test workstation and the DC server.

None of the changes have made any difference so far. Unfortunately I
can only work on these problems after hours. I do have all of next
week to work on this problem because this client is shutting down from
Dec 22 to Jan.3. One thing I want to try is a new NIC.

A

In news:(E-Mail Removed) ups.com,
apprentice463 <(E-Mail Removed)> stated, which I commented on below:

> Little bit of an update.
>
> The DFS Service was enabled but no root. The DFS Root has now been
> defined.
> I had seen most of the articles that you spoke of, although I should
> mention I tend to steer away from articles that don't refer to windows
> XP/2000/2003. I forgot to mention that I had already looked at
> kb321098 and when I checked the registry location specified the
> TcpDelAckTicks was set to 0 and TcpAckFrequency was set to 1
> (kb328890). I tried different values for each of these although I
> didn't stray to far from the default settings.
>
> The DHCP client service was enabled on all machines.
>
> I have changed the DNS local loopback address to the actual address as
> suggested.
>
> I even enabled netbios on the test workstation and the DC server.
>
> None of the changes have made any difference so far. Unfortunately I
> can only work on these problems after hours. I do have all of next
> week to work on this problem because this client is shutting down from
> Dec 22 to Jan.3. One thing I want to try is a new NIC.
>
> A

It seems like a setting was changed or altered in the past causing this
problem. I believe you mentioned that LDAP signing was disabled.

Seems like something that we need to take a look, such as remoting in. But
that is up to you and my schedule next week. We'll have to see, if it is ok
with you. If I can't fix it in 15-20 minutes, we'll have to look elsewhere.

Static IP config must be set on a DC, it can't be a DHCP client. But the
DHCP Client service must be running.

And no, I don't think it would be a NIC issue.

Happy Holidays!

Ace

Have your had any luck in resolving this issue?

I am having the exact same thing happen. I did install a hotfix that
came from microsoft to update the tcpip.sys but it doesn't seem to make
much difference.

In my case the server was running great for a day and a half before our
slow downs happened.

Thank,

Mike


Ace Fekay [MVP] wrote:
> In news:(E-Mail Removed) ups.com,
> apprentice463 <(E-Mail Removed)> stated, which I commented on below:
>
> > Little bit of an update.
> >
> > The DFS Service was enabled but no root. The DFS Root has now been
> > defined.
> > I had seen most of the articles that you spoke of, although I should
> > mention I tend to steer away from articles that don't refer to windows
> > XP/2000/2003. I forgot to mention that I had already looked at
> > kb321098 and when I checked the registry location specified the
> > TcpDelAckTicks was set to 0 and TcpAckFrequency was set to 1
> > (kb328890). I tried different values for each of these although I
> > didn't stray to far from the default settings.
> >
> > The DHCP client service was enabled on all machines.
> >
> > I have changed the DNS local loopback address to the actual address as
> > suggested.
> >
> > I even enabled netbios on the test workstation and the DC server.
> >
> > None of the changes have made any difference so far. Unfortunately I
> > can only work on these problems after hours. I do have all of next
> > week to work on this problem because this client is shutting down from
> > Dec 22 to Jan.3. One thing I want to try is a new NIC.
> >
> > A
>
> It seems like a setting was changed or altered in the past causing this
> problem. I believe you mentioned that LDAP signing was disabled.
>
> Seems like something that we need to take a look, such as remoting in. But
> that is up to you and my schedule next week. We'll have to see, if it is ok
> with you. If I can't fix it in 15-20 minutes, we'll have to look elsewhere.
>
> Static IP config must be set on a DC, it can't be a DHCP client. But the
> DHCP Client service must be running.
>
> And no, I don't think it would be a NIC issue.
>
> Happy Holidays!
>
> Ace

In news:(E-Mail Removed) oups.com,
(E-Mail Removed) <(E-Mail Removed)> stated, which I
commented on below:
> Have your had any luck in resolving this issue?
>
> I am having the exact same thing happen. I did install a hotfix that
> came from microsoft to update the tcpip.sys but it doesn't seem to
> make much difference.
>
> In my case the server was running great for a day and a half before
> our slow downs happened.
>
> Thank,
>
> Mike

I don't know if the apprentice fixed this or not. Haven't heard back from
him.

What hotfix was it? Did you have to call Microsoft for it or is there a link
to the hotfix?
For your issue, if you uninstall the hotfix, (if it is uninstallable), does
the problem go away?

Ace