Network in a Knot -- Need URGENT Help to sort out

URGENT -- Seeking guidance for troubleshooting existing Windows Server
2003, Std Ed, SP1 network configuration; have "operated"
established NT server networks -- newbie to setting one up. Read these
forums and tried things prior to posting, still need help. THANKS!!

Main Problems:
· Cannot browse network objects from server in Network Places.

· Can browse network objects from workstations in Network Places, but
receive error message if try to open workstation not sharing resources
- says "network path not found, may not have permission, access
denied"

· Can only ping (both IP & name) machines sharing resources to the
network but no other machines. Can ping default gateway/router.

· It appears DNS is not working with DHCP -- DHCP audit logs report
"DNS Update Failed" for each workstation over and over.

· Master Browsing is assumed by a workstation, rotating every so
often to another workstation, even though server indicates it is the
Operations Master for PDC, Domain Naming, RID, Infrastructure (Schema
not installed).

Environment:

The network is DSL Modem > Wireless Router > Unmanaged Switch with 2
gigabit ports > to workstations & server.

Wireless Router Settings:

LAN Settings
Default Gateway: 192.168.0.x
Subnet Mask: 255.255.255.0
DHCP Server: OFF

Windows Server 2003 Std Ed, SP1 on one machine, SERVER1, and
approximately 14 workstations all running Windows XP Pro SP2.

Client NIC TCP/IP configuration auto for DHCP and DNS and NetBIOS is
set to Default - a couple of workstations have the DNS server IP
listed as preferred and the default gateway listed.

Server1 in "Manage Your Server" shows: DC (AD), DHCP, DNS, File
Server, Application Server, Remote Access and VPN Server (in past
someone tried to setup VPN), -- elsewhere in Admin Tools see these are
"partially setup & not being used": IIS Manager (not hosting
anything), Cluster Administrator, .NET manager, and Terminal Services
Manger (not using Terminal Services), believe no ISA Server running.

Server1 has 2 NIC's, one disabled. NIC TCP/IP configuration is
static with no external DNS IP references and set to register itself in
DNS.

Server Static IP 192.168.0.y
Subnet Mask: 255.255.255.0
Default Gateway 192.168.0.x
(the router's IP address)
DNS Server 192.168.0.y
WINS Server: (none)
NetBIOS disabled

(note: DHCP Server 192.168.0.y)

DNS settings:
AD Integrated
Replication: All DNS Servers in AD domain
Forwarder's configured in DNS for 2 ISP DNS servers.
One Forward LookUp Zone for mycompany.local
No Reverse LookUp Zone.

Errors couple of months ago show a 4004 and 4015 but not since.
Host (A) records present for current IP addresses being used - see
duplicate IP addresses for some records but with "old/previous"
workstation names.

DHCP Settings:

Edited Scope Options for one Scope that is setup. Scope shows green
arrow as active.
Dynamically updating DNS if requested, with credentials - dedicated
user account setup.

Scope Options are now:
001 Microsoft Disable Netbios Option
002 Microsoft Release DHCP Lease on Shutdown
003 Router 192.168.0.x
006 DNS Server 192.168.0.y
015 DNS Domain Name mycompany.local

> Performed server shutdown after these changes but did not start/stop DNS or DHCP.

Inoperable Folder Redirect object in Group Policy - pointing to
non-existent path as a way to disable this function right now.

Additional intermittent errors on workstations:

1054 Windows cannot obtain domain controller - doesn't exist or
cannot be contacted - group policy aborted.

8021 Browser unable to retrieve list of servers from browse master -
(from a workstation trying to reach a workstation that was turned off
and then this machine elected itself as master browser)

40961 LSASRV SPNEGO - Security System could not establish a secured
connection with the server
ldap/server1.mycompany.local/(E-Mail Removed). No
authentication protocol was available.

IPCONFIG: same from each machine with the exception of its IP and
NIC/MAC description reports all correct IP addresses for DHCP, etc.
Hybrid nodes with WINS Server IP reported same as DNS server. Do not
have WINS configured however, so where does it get this? Report 2 DNS
suffix search list: mycompany.local and mycompany - not sure where
obtaining one w/o " .local"?

NETDIAG from workstations:
Fails WINS test, Redir and BrowserTest (FATAL Cannot sent mailslot
message to '\\mycompany*\mailslot\net\netlogon' via redir. ERROR
BAD NETPATH), and Kerberos test

Passes NetBT test with a Warning - "at least . . . one of names
missing".

NETDIAG from server:
Passes everything except SKIPPED: NetBT transport, name, Redir and
Browser, trust relationship, and IP security.

Noticed in Network Places from a workstation that a AD workstation
description was not available to view but when description was entered
into the workstation's My Computer properties then it could be viewed
in Network Places.

Any ideas?

Regards,

viv

Well, the most obvious problems are:

1. NetBIOS is disabled on the server.

2. DHCP is using undesireable vendor class options.

Try: delete the scope and recreate/activate it with only options 3, 6, and
15 - remove any server level options and make sure the DHCP server is
authorized, disable RRAS, enable NetBIOS on the server, create a reverse
lookup zone in DNS, reboot the server and after starup restart the Netlogon
service. Reboot the clients.

Doug Sherman
MCSE, MCSA, MCP+I, MVP

"Viv" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) oups.com...
URGENT -- Seeking guidance for troubleshooting existing Windows Server
2003, Std Ed, SP1 network configuration; have "operated"
established NT server networks -- newbie to setting one up. Read these
forums and tried things prior to posting, still need help. THANKS!!

Main Problems:
· Cannot browse network objects from server in Network Places.

· Can browse network objects from workstations in Network Places, but
receive error message if try to open workstation not sharing resources
- says "network path not found, may not have permission, access
denied"

· Can only ping (both IP & name) machines sharing resources to the
network but no other machines. Can ping default gateway/router.

· It appears DNS is not working with DHCP -- DHCP audit logs report
"DNS Update Failed" for each workstation over and over.

· Master Browsing is assumed by a workstation, rotating every so
often to another workstation, even though server indicates it is the
Operations Master for PDC, Domain Naming, RID, Infrastructure (Schema
not installed).

Environment:

The network is DSL Modem > Wireless Router > Unmanaged Switch with 2
gigabit ports > to workstations & server.

Wireless Router Settings:

LAN Settings
Default Gateway: 192.168.0.x
Subnet Mask: 255.255.255.0
DHCP Server: OFF

Windows Server 2003 Std Ed, SP1 on one machine, SERVER1, and
approximately 14 workstations all running Windows XP Pro SP2.

Client NIC TCP/IP configuration auto for DHCP and DNS and NetBIOS is
set to Default - a couple of workstations have the DNS server IP
listed as preferred and the default gateway listed.

Server1 in "Manage Your Server" shows: DC (AD), DHCP, DNS, File
Server, Application Server, Remote Access and VPN Server (in past
someone tried to setup VPN), -- elsewhere in Admin Tools see these are
"partially setup & not being used": IIS Manager (not hosting
anything), Cluster Administrator, .NET manager, and Terminal Services
Manger (not using Terminal Services), believe no ISA Server running.

Server1 has 2 NIC's, one disabled. NIC TCP/IP configuration is
static with no external DNS IP references and set to register itself in
DNS.

Server Static IP 192.168.0.y
Subnet Mask: 255.255.255.0
Default Gateway 192.168.0.x
(the router's IP address)
DNS Server 192.168.0.y
WINS Server: (none)
NetBIOS disabled

(note: DHCP Server 192.168.0.y)

DNS settings:
AD Integrated
Replication: All DNS Servers in AD domain
Forwarder's configured in DNS for 2 ISP DNS servers.
One Forward LookUp Zone for mycompany.local
No Reverse LookUp Zone.

Errors couple of months ago show a 4004 and 4015 but not since.
Host (A) records present for current IP addresses being used - see
duplicate IP addresses for some records but with "old/previous"
workstation names.

DHCP Settings:

Edited Scope Options for one Scope that is setup. Scope shows green
arrow as active.
Dynamically updating DNS if requested, with credentials - dedicated
user account setup.

Scope Options are now:
001 Microsoft Disable Netbios Option
002 Microsoft Release DHCP Lease on Shutdown
003 Router 192.168.0.x
006 DNS Server 192.168.0.y
015 DNS Domain Name mycompany.local

> Performed server shutdown after these changes but did not start/stop DNS
or DHCP.

Inoperable Folder Redirect object in Group Policy - pointing to
non-existent path as a way to disable this function right now.

Additional intermittent errors on workstations:

1054 Windows cannot obtain domain controller - doesn't exist or
cannot be contacted - group policy aborted.

8021 Browser unable to retrieve list of servers from browse master -
(from a workstation trying to reach a workstation that was turned off
and then this machine elected itself as master browser)

40961 LSASRV SPNEGO - Security System could not establish a secured
connection with the server
ldap/server1.mycompany.local/(E-Mail Removed). No
authentication protocol was available.

IPCONFIG: same from each machine with the exception of its IP and
NIC/MAC description reports all correct IP addresses for DHCP, etc.
Hybrid nodes with WINS Server IP reported same as DNS server. Do not
have WINS configured however, so where does it get this? Report 2 DNS
suffix search list: mycompany.local and mycompany - not sure where
obtaining one w/o " .local"?

NETDIAG from workstations:
Fails WINS test, Redir and BrowserTest (FATAL Cannot sent mailslot
message to '\\mycompany*\mailslot\net\netlogon' via redir. ERROR
BAD NETPATH), and Kerberos test

Passes NetBT test with a Warning - "at least . . . one of names
missing".

NETDIAG from server:
Passes everything except SKIPPED: NetBT transport, name, Redir and
Browser, trust relationship, and IP security.

Noticed in Network Places from a workstation that a AD workstation
description was not available to view but when description was entered
into the workstation's My Computer properties then it could be viewed
in Network Places.

Any ideas?

Regards,

viv

Thanks for the speedy reply. I will try this recommended course of
action. Before I proceed I had an additional question about NetBIOS.

Is it true that in an exclusively Windows XP Pro client environment
with DNS and DHCP in effect, that:

1) WINS is not needed
2) And that NetBIOS is not used as the protocol? API?
3) And that "Enable LMHOSTS lookup" can be cleared?

Thanks.

Also, with regard to your response when enabling NetBIOS on the server
- should the "Default" option be the one selected over the
"Enabled" option on the NIC TCP/IP properties?

Regards,

viv

Doug Sherman [MVP] wrote:
> Well, the most obvious problems are:
>
> 1. NetBIOS is disabled on the server.
>
> 2. DHCP is using undesireable vendor class options.
>
> Try: delete the scope and recreate/activate it with only options 3, 6, and
> 15 - remove any server level options and make sure the DHCP server is
> authorized, disable RRAS, enable NetBIOS on the server, create a reverse
> lookup zone in DNS, reboot the server and after starup restart the Netlogon
> service. Reboot the clients.
>
> Doug Sherman
> MCSE, MCSA, MCP+I, MVP
>
> "Viv" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed) oups.com...
> URGENT -- Seeking guidance for troubleshooting existing Windows Server
> 2003, Std Ed, SP1 network configuration; have "operated"
> established NT server networks -- newbie to setting one up. Read these
> forums and tried things prior to posting, still need help. THANKS!!
>
> Main Problems:
> · Cannot browse network objects from server in Network Places.
>
> · Can browse network objects from workstations in Network Places, but
> receive error message if try to open workstation not sharing resources
> - says "network path not found, may not have permission, access
> denied"
>
> · Can only ping (both IP & name) machines sharing resources to the
> network but no other machines. Can ping default gateway/router.
>
> · It appears DNS is not working with DHCP -- DHCP audit logs report
> "DNS Update Failed" for each workstation over and over.
>
> · Master Browsing is assumed by a workstation, rotating every so
> often to another workstation, even though server indicates it is the
> Operations Master for PDC, Domain Naming, RID, Infrastructure (Schema
> not installed).
>
> Environment:
>
> The network is DSL Modem > Wireless Router > Unmanaged Switch with 2
> gigabit ports > to workstations & server.
>
> Wireless Router Settings:
>
> LAN Settings
> Default Gateway: 192.168.0.x
> Subnet Mask: 255.255.255.0
> DHCP Server: OFF
>
> Windows Server 2003 Std Ed, SP1 on one machine, SERVER1, and
> approximately 14 workstations all running Windows XP Pro SP2.
>
> Client NIC TCP/IP configuration auto for DHCP and DNS and NetBIOS is
> set to Default - a couple of workstations have the DNS server IP
> listed as preferred and the default gateway listed.
>
> Server1 in "Manage Your Server" shows: DC (AD), DHCP, DNS, File
> Server, Application Server, Remote Access and VPN Server (in past
> someone tried to setup VPN), -- elsewhere in Admin Tools see these are
> "partially setup & not being used": IIS Manager (not hosting
> anything), Cluster Administrator, .NET manager, and Terminal Services
> Manger (not using Terminal Services), believe no ISA Server running.
>
> Server1 has 2 NIC's, one disabled. NIC TCP/IP configuration is
> static with no external DNS IP references and set to register itself in
> DNS.
>
> Server Static IP 192.168.0.y
> Subnet Mask: 255.255.255.0
> Default Gateway 192.168.0.x
> (the router's IP address)
> DNS Server 192.168.0.y
> WINS Server: (none)
> NetBIOS disabled
>
> (note: DHCP Server 192.168.0.y)
>
> DNS settings:
> AD Integrated
> Replication: All DNS Servers in AD domain
> Forwarder's configured in DNS for 2 ISP DNS servers.
> One Forward LookUp Zone for mycompany.local
> No Reverse LookUp Zone.
>
> Errors couple of months ago show a 4004 and 4015 but not since.
> Host (A) records present for current IP addresses being used - see
> duplicate IP addresses for some records but with "old/previous"
> workstation names.
>
> DHCP Settings:
>
> Edited Scope Options for one Scope that is setup. Scope shows green
> arrow as active.
> Dynamically updating DNS if requested, with credentials - dedicated
> user account setup.
>
> Scope Options are now:
> 001 Microsoft Disable Netbios Option
> 002 Microsoft Release DHCP Lease on Shutdown
> 003 Router 192.168.0.x
> 006 DNS Server 192.168.0.y
> 015 DNS Domain Name mycompany.local
>
> > Performed server shutdown after these changes but did not start/stop DNS
> or DHCP.
>
> Inoperable Folder Redirect object in Group Policy - pointing to
> non-existent path as a way to disable this function right now.
>
> Additional intermittent errors on workstations:
>
> 1054 Windows cannot obtain domain controller - doesn't exist or
> cannot be contacted - group policy aborted.
>
> 8021 Browser unable to retrieve list of servers from browse master -
> (from a workstation trying to reach a workstation that was turned off
> and then this machine elected itself as master browser)
>
> 40961 LSASRV SPNEGO - Security System could not establish a secured
> connection with the server
> ldap/server1.mycompany.local/(E-Mail Removed). No
> authentication protocol was available.
>
> IPCONFIG: same from each machine with the exception of its IP and
> NIC/MAC description reports all correct IP addresses for DHCP, etc.
> Hybrid nodes with WINS Server IP reported same as DNS server. Do not
> have WINS configured however, so where does it get this? Report 2 DNS
> suffix search list: mycompany.local and mycompany - not sure where
> obtaining one w/o " .local"?
>
> NETDIAG from workstations:
> Fails WINS test, Redir and BrowserTest (FATAL Cannot sent mailslot
> message to '\\mycompany*\mailslot\net\netlogon' via redir. ERROR
> BAD NETPATH), and Kerberos test
>
> Passes NetBT test with a Warning - "at least . . . one of names
> missing".
>
> NETDIAG from server:
> Passes everything except SKIPPED: NetBT transport, name, Redir and
> Browser, trust relationship, and IP security.
>
> Noticed in Network Places from a workstation that a AD workstation
> description was not available to view but when description was entered
> into the workstation's My Computer properties then it could be viewed
> in Network Places.
>
> Any ideas?
>
> Regards,
>
> viv

"Viv" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) ups.com...
1) WINS is not needed

WINS was only ever need in multi-subnet networks. If Netbios is needed,
and there are multiple subnets,...then WINS is needed.

2) And that NetBIOS is not used as the protocol? API?

The protocol was NetBEUI not Netbios. NetBEUI is a "Netbios Compatible
Protocol",...NetBEUI does *not* have to be installed for Netbios to be used.
The two are not the same thing.

As long as Applications continue to be written that use Netbios
naming,....netbios will continue to be required. MS isn't the only thing
out there,...other people write Apps that require Netbios as well.

For example, we are an affiliate NBC News Station with a Server2003 based
domain with XP and Win2K workstations,... and our current "newsroom system"
is netbios dependent, therefore netbios is required,...and we have multiple
subnets,...so WINS is required as well.
NeBEUI is not installed,...it is irrelevant.

3) And that "Enable LMHOSTS lookup" can be cleared?

If no one was using and editing LMHOSTS files in the first place,...this was
never relevant to start with. If someone is using and editing LMHOSTS
files,...then this is probably needed.


--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/downlo...7/ts_rules.doc

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/t...dance/2004.asp
http://www.microsoft.com/isaserver/t...dance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Deployment Guidelines for ISA Server 2004 Enterprise Edition
http://www.microsoft.com/technet/pro...isaserver.mspx
-----------------------------------------------------

1. In general WINS is not needed, but it may be useful if you have multiple
subnets, WAN connections, or NT clients.

2. Among your list of main problems are two variations of "can't browse".
The browser service requires NetBIOS -there is no way around this. You must
enable NetBIOS (NetBT) over TCP/IP if you want to browse in an Active
Directory domain. It's probably better to think of NetBIOS as defining a
software interface and a naming convention rather than a protocol - it is
required for a surprising number of services and programs.

3. Yes, you can clear enable Lmhosts lookup - not sure why you'd want to.

Doug Sherman
MCSE, MCSA, MCP+I, MVP

"Viv" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) ups.com...
Thanks for the speedy reply. I will try this recommended course of
action. Before I proceed I had an additional question about NetBIOS.

Is it true that in an exclusively Windows XP Pro client environment
with DNS and DHCP in effect, that:

1) WINS is not needed
2) And that NetBIOS is not used as the protocol? API?
3) And that "Enable LMHOSTS lookup" can be cleared?

Thanks.

Also, with regard to your response when enabling NetBIOS on the server
- should the "Default" option be the one selected over the
"Enabled" option on the NIC TCP/IP properties?

Regards,

viv

Doug Sherman [MVP] wrote:
> Well, the most obvious problems are:
>
> 1. NetBIOS is disabled on the server.
>
> 2. DHCP is using undesireable vendor class options.
>
> Try: delete the scope and recreate/activate it with only options 3, 6, and
> 15 - remove any server level options and make sure the DHCP server is
> authorized, disable RRAS, enable NetBIOS on the server, create a reverse
> lookup zone in DNS, reboot the server and after starup restart the
Netlogon
> service. Reboot the clients.
>
> Doug Sherman
> MCSE, MCSA, MCP+I, MVP
>
> "Viv" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed) oups.com...
> URGENT -- Seeking guidance for troubleshooting existing Windows Server
> 2003, Std Ed, SP1 network configuration; have "operated"
> established NT server networks -- newbie to setting one up. Read these
> forums and tried things prior to posting, still need help. THANKS!!
>
> Main Problems:
> · Cannot browse network objects from server in Network Places.
>
> · Can browse network objects from workstations in Network Places, but
> receive error message if try to open workstation not sharing resources
> - says "network path not found, may not have permission, access
> denied"
>
> · Can only ping (both IP & name) machines sharing resources to the
> network but no other machines. Can ping default gateway/router.
>
> · It appears DNS is not working with DHCP -- DHCP audit logs report
> "DNS Update Failed" for each workstation over and over.
>
> · Master Browsing is assumed by a workstation, rotating every so
> often to another workstation, even though server indicates it is the
> Operations Master for PDC, Domain Naming, RID, Infrastructure (Schema
> not installed).
>
> Environment:
>
> The network is DSL Modem > Wireless Router > Unmanaged Switch with 2
> gigabit ports > to workstations & server.
>
> Wireless Router Settings:
>
> LAN Settings
> Default Gateway: 192.168.0.x
> Subnet Mask: 255.255.255.0
> DHCP Server: OFF
>
> Windows Server 2003 Std Ed, SP1 on one machine, SERVER1, and
> approximately 14 workstations all running Windows XP Pro SP2.
>
> Client NIC TCP/IP configuration auto for DHCP and DNS and NetBIOS is
> set to Default - a couple of workstations have the DNS server IP
> listed as preferred and the default gateway listed.
>
> Server1 in "Manage Your Server" shows: DC (AD), DHCP, DNS, File
> Server, Application Server, Remote Access and VPN Server (in past
> someone tried to setup VPN), -- elsewhere in Admin Tools see these are
> "partially setup & not being used": IIS Manager (not hosting
> anything), Cluster Administrator, .NET manager, and Terminal Services
> Manger (not using Terminal Services), believe no ISA Server running.
>
> Server1 has 2 NIC's, one disabled. NIC TCP/IP configuration is
> static with no external DNS IP references and set to register itself in
> DNS.
>
> Server Static IP 192.168.0.y
> Subnet Mask: 255.255.255.0
> Default Gateway 192.168.0.x
> (the router's IP address)
> DNS Server 192.168.0.y
> WINS Server: (none)
> NetBIOS disabled
>
> (note: DHCP Server 192.168.0.y)
>
> DNS settings:
> AD Integrated
> Replication: All DNS Servers in AD domain
> Forwarder's configured in DNS for 2 ISP DNS servers.
> One Forward LookUp Zone for mycompany.local
> No Reverse LookUp Zone.
>
> Errors couple of months ago show a 4004 and 4015 but not since.
> Host (A) records present for current IP addresses being used - see
> duplicate IP addresses for some records but with "old/previous"
> workstation names.
>
> DHCP Settings:
>
> Edited Scope Options for one Scope that is setup. Scope shows green
> arrow as active.
> Dynamically updating DNS if requested, with credentials - dedicated
> user account setup.
>
> Scope Options are now:
> 001 Microsoft Disable Netbios Option
> 002 Microsoft Release DHCP Lease on Shutdown
> 003 Router 192.168.0.x
> 006 DNS Server 192.168.0.y
> 015 DNS Domain Name mycompany.local
>
> > Performed server shutdown after these changes but did not start/stop DNS
> or DHCP.
>
> Inoperable Folder Redirect object in Group Policy - pointing to
> non-existent path as a way to disable this function right now.
>
> Additional intermittent errors on workstations:
>
> 1054 Windows cannot obtain domain controller - doesn't exist or
> cannot be contacted - group policy aborted.
>
> 8021 Browser unable to retrieve list of servers from browse master -
> (from a workstation trying to reach a workstation that was turned off
> and then this machine elected itself as master browser)
>
> 40961 LSASRV SPNEGO - Security System could not establish a secured
> connection with the server
> ldap/server1.mycompany.local/(E-Mail Removed). No
> authentication protocol was available.
>
> IPCONFIG: same from each machine with the exception of its IP and
> NIC/MAC description reports all correct IP addresses for DHCP, etc.
> Hybrid nodes with WINS Server IP reported same as DNS server. Do not
> have WINS configured however, so where does it get this? Report 2 DNS
> suffix search list: mycompany.local and mycompany - not sure where
> obtaining one w/o " .local"?
>
> NETDIAG from workstations:
> Fails WINS test, Redir and BrowserTest (FATAL Cannot sent mailslot
> message to '\\mycompany*\mailslot\net\netlogon' via redir. ERROR
> BAD NETPATH), and Kerberos test
>
> Passes NetBT test with a Warning - "at least . . . one of names
> missing".
>
> NETDIAG from server:
> Passes everything except SKIPPED: NetBT transport, name, Redir and
> Browser, trust relationship, and IP security.
>
> Noticed in Network Places from a workstation that a AD workstation
> description was not available to view but when description was entered
> into the workstation's My Computer properties then it could be viewed
> in Network Places.
>
> Any ideas?
>
> Regards,
>
> viv