Slow login and difficulties accessing network reources

Hi,
I have a remote site (with 4 workstation) connected over a VPN WAN
(site-to-site VPN) to my corporate Head Office. All the Domain controllers
are located in the Head-Office. Suddenly my workstation in the remote site
are experiencing difficulties for longing into the domain (login takes a long
time) and access network resources. I have connectivity with the domain
controller because I can ping them and also resolve their name through DNS.

I can not find any error\warning events on the Domain Controller but on my
the workstations I get the following warning\error messages:

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1006
Date: 10/9/2008
Time: 9:57:09 PM
User: NT AUTHORITY\SYSTEM
Computer: XXXX-CLARA
Description:
Windows cannot bind to xxx.xxx.com domain. (Timeout). Group Policy
processing aborted.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.




Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date: 10/9/2008
Time: 9:57:09 PM
User: NT AUTHORITY\SYSTEM
Computer: XXXX-CLARA
Description:
Windows cannot query for the list of Group Policy objects. A message that
describes the reason for this was previously logged by the policy engine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 10/9/2008
Time: 11:35:27 PM
User: N/A
Computer: XXXX-CLARA
Description:
The Security System detected an attempted downgrade attack for server
LDAP/xxxx.corp.xxx.com. The failure code from authentication protocol
Kerberos was "There are currently no logon servers available to service the
logon request.
(0xc000005e)".

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.





Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40961
Date: 10/9/2008
Time: 11:35:27 PM
User: N/A
Computer: XXXX-CLARA
Description:
The Security System could not establish a secured connection with the server
LDAP/xxxx.corp.xxxxx.com. No authentication protocol was available.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: MRxSmb
Event Category: None
Event ID: 3019
Date: 10/9/2008
Time: 11:28:56 PM
User: N/A
Computer: XXXX-CLARA
Description:
The redirector failed to determine the connection type.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 04 00 4e 00 ......N.
0008: 00 00 00 00 cb 0b 00 80 ....Ë..€
0010: 00 00 00 00 84 01 00 c0 ....„..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

I am lost because I do not know what is causing the problem (is it the
domain controller or the workstation, or is it the WAN connectivity between
the workstation and the domain controller)

My domain controllers are running Windows Server 2003 standard edition SP1
and my workstation are running Windows XP SP2 .

Regards,

--
Screech

Any errors if using nslookup to check the DNS status?

--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com
"Screech" <(E-Mail Removed)> wrote in message
news:5CCBCA56-5D74-4785-B7EC-(E-Mail Removed)...
> Hi,
> I have a remote site (with 4 workstation) connected over a VPN WAN
> (site-to-site VPN) to my corporate Head Office. All the Domain controllers
> are located in the Head-Office. Suddenly my workstation in the remote site
> are experiencing difficulties for longing into the domain (login takes a
> long
> time) and access network resources. I have connectivity with the domain
> controller because I can ping them and also resolve their name through
> DNS.
>
> I can not find any error\warning events on the Domain Controller but on my
> the workstations I get the following warning\error messages:
>
> Event Type: Error
> Event Source: Userenv
> Event Category: None
> Event ID: 1006
> Date: 10/9/2008
> Time: 9:57:09 PM
> User: NT AUTHORITY\SYSTEM
> Computer: XXXX-CLARA
> Description:
> Windows cannot bind to xxx.xxx.com domain. (Timeout). Group Policy
> processing aborted.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
>
>
> Event Type: Error
> Event Source: Userenv
> Event Category: None
> Event ID: 1030
> Date: 10/9/2008
> Time: 9:57:09 PM
> User: NT AUTHORITY\SYSTEM
> Computer: XXXX-CLARA
> Description:
> Windows cannot query for the list of Group Policy objects. A message that
> describes the reason for this was previously logged by the policy engine.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: LSASRV
> Event Category: SPNEGO (Negotiator)
> Event ID: 40960
> Date: 10/9/2008
> Time: 11:35:27 PM
> User: N/A
> Computer: XXXX-CLARA
> Description:
> The Security System detected an attempted downgrade attack for server
> LDAP/xxxx.corp.xxx.com. The failure code from authentication protocol
> Kerberos was "There are currently no logon servers available to service
> the
> logon request.
> (0xc000005e)".
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
>
>
>
> Event Type: Warning
> Event Source: LSASRV
> Event Category: SPNEGO (Negotiator)
> Event ID: 40961
> Date: 10/9/2008
> Time: 11:35:27 PM
> User: N/A
> Computer: XXXX-CLARA
> Description:
> The Security System could not establish a secured connection with the
> server
> LDAP/xxxx.corp.xxxxx.com. No authentication protocol was available.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MRxSmb
> Event Category: None
> Event ID: 3019
> Date: 10/9/2008
> Time: 11:28:56 PM
> User: N/A
> Computer: XXXX-CLARA
> Description:
> The redirector failed to determine the connection type.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 04 00 4e 00 ......N.
> 0008: 00 00 00 00 cb 0b 00 80 ....Ë..€
> 0010: 00 00 00 00 84 01 00 c0 ....„..À
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
>
> I am lost because I do not know what is causing the problem (is it the
> domain controller or the workstation, or is it the WAN connectivity
> between
> the workstation and the domain controller)
>
> My domain controllers are running Windows Server 2003 standard edition SP1
> and my workstation are running Windows XP SP2 .
>
> Regards,
>
> --
> Screech

I finally solved the problem:

netdiag.exe showed that I was having difficulties communicating with the
Domain Controllers using LDAP. Furher research showd that this was being
caused by a mismatch in MTU size between the two ends of the VPN tunnel. I
was able to solve the problem by applying the hotfix KB898060 to my windows
server 2003 R2 . Running netdiag on my XP clients after the apllication of
the hotfix on the servers confirmed that the problem has been resolved.

Regards,
--
Screech


"Screech" wrote:

> Hi,
> I have a remote site (with 4 workstation) connected over a VPN WAN
> (site-to-site VPN) to my corporate Head Office. All the Domain controllers
> are located in the Head-Office. Suddenly my workstation in the remote site
> are experiencing difficulties for longing into the domain (login takes a long
> time) and access network resources. I have connectivity with the domain
> controller because I can ping them and also resolve their name through DNS.
>
> I can not find any error\warning events on the Domain Controller but on my
> the workstations I get the following warning\error messages:
>
> Event Type: Error
> Event Source: Userenv
> Event Category: None
> Event ID: 1006
> Date: 10/9/2008
> Time: 9:57:09 PM
> User: NT AUTHORITY\SYSTEM
> Computer: XXXX-CLARA
> Description:
> Windows cannot bind to xxx.xxx.com domain. (Timeout). Group Policy
> processing aborted.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
>
>
> Event Type: Error
> Event Source: Userenv
> Event Category: None
> Event ID: 1030
> Date: 10/9/2008
> Time: 9:57:09 PM
> User: NT AUTHORITY\SYSTEM
> Computer: XXXX-CLARA
> Description:
> Windows cannot query for the list of Group Policy objects. A message that
> describes the reason for this was previously logged by the policy engine.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: LSASRV
> Event Category: SPNEGO (Negotiator)
> Event ID: 40960
> Date: 10/9/2008
> Time: 11:35:27 PM
> User: N/A
> Computer: XXXX-CLARA
> Description:
> The Security System detected an attempted downgrade attack for server
> LDAP/xxxx.corp.xxx.com. The failure code from authentication protocol
> Kerberos was "There are currently no logon servers available to service the
> logon request.
> (0xc000005e)".
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
>
>
>
> Event Type: Warning
> Event Source: LSASRV
> Event Category: SPNEGO (Negotiator)
> Event ID: 40961
> Date: 10/9/2008
> Time: 11:35:27 PM
> User: N/A
> Computer: XXXX-CLARA
> Description:
> The Security System could not establish a secured connection with the server
> LDAP/xxxx.corp.xxxxx.com. No authentication protocol was available.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MRxSmb
> Event Category: None
> Event ID: 3019
> Date: 10/9/2008
> Time: 11:28:56 PM
> User: N/A
> Computer: XXXX-CLARA
> Description:
> The redirector failed to determine the connection type.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 04 00 4e 00 ......N.
> 0008: 00 00 00 00 cb 0b 00 80 ....Ë..€
> 0010: 00 00 00 00 84 01 00 c0 ....„..À
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
>
> I am lost because I do not know what is causing the problem (is it the
> domain controller or the workstation, or is it the WAN connectivity between
> the workstation and the domain controller)
>
> My domain controllers are running Windows Server 2003 standard edition SP1
> and my workstation are running Windows XP SP2 .
>
> Regards,
>
> --
> Screech