unable to map network drives

Hi

We're running Windows 2003 with a workgroup and I'm unable to map
network drives.

A few days ago a couple of computers that accessed a share on this
server couldn't connect. I remapped the drives and they got in fine. It
kept happening and event ID 4321 is appearing in event viewer on client
PC's and the server.

I figured restarting the server was worth a try but now no-one can
access shared drives on the server. If I try to map a drive it just says
the network path isn't found. NAT drives are unaffected and the server
itself can access a share on it's local drive, if that makes sense, so
the problem is that something is stopping all client PC's accessing the
server..even my remote desktop connection has stopped working.

I'm not sure if this is a netbios problem (we are using a workgroup not
a domain), a virus or what...any advice would be appreciated!

thanks


--
randalino
------------------------------------------------------------------------
randalino's Profile:
View this thread:

 

Can you post unedited

ipconfig /all

on both server and workstation?



--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]



"randalino" wrote:<!--coloro:blue--><span style="color:blue <!--/coloro-->
>
> Hi
>
> We're running Windows 2003 with a workgroup and I'm unable to map
> network drives.
>
> A few days ago a couple of computers that accessed a share on this
> server couldn't connect. I remapped the drives and they got in fine. It
> kept happening and event ID 4321 is appearing in event viewer on client
> PC's and the server.
>
> I figured restarting the server was worth a try but now no-one can
> access shared drives on the server. If I try to map a drive it just says
> the network path isn't found. NAT drives are unaffected and the server
> itself can access a share on it's local drive, if that makes sense, so
> the problem is that something is stopping all client PC's accessing the
> server..even my remote desktop connection has stopped working.
>
> I'm not sure if this is a netbios problem (we are using a workgroup not
> a domain), a virus or what...any advice would be appreciated!
>
> thanks
>
>
> --
> randalino
> ------------------------------------------------------------------------
> randalino's Profile:
> View this thread:
>
>
>
> <!--colorc--><!--/colorc-->

 

"Dave Patrick" <DSPatrick@nospam.gmail.com> wrote in message
news:OLsEBJ2SKHA.4048@TK2MSFTNGP05.phx.gbl...

In addition to the ipconfig /all from two machines, Randalino please post
any services you may disabled, updates installed, any security software
installed (AV, 3rd party firewall, etc), and what role does it hold and
service and apps does this machine have (RRAS, NAT, DC, etc).

Ace


<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Can you post unedited
>
> ipconfig /all
>
> on both server and workstation?
>
>
>
> --
>
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
>
>
>
> "randalino" wrote:<!--coloro:green--><span style="color:green <!--/coloro-->
>>
>> Hi
>>
>> We're running Windows 2003 with a workgroup and I'm unable to map
>> network drives.
>>
>> A few days ago a couple of computers that accessed a share on this
>> server couldn't connect. I remapped the drives and they got in fine. It
>> kept happening and event ID 4321 is appearing in event viewer on client
>> PC's and the server.
>>
>> I figured restarting the server was worth a try but now no-one can
>> access shared drives on the server. If I try to map a drive it just says
>> the network path isn't found. NAT drives are unaffected and the server
>> itself can access a share on it's local drive, if that makes sense, so
>> the problem is that something is stopping all client PC's accessing the
>> server..even my remote desktop connection has stopped working.
>>
>> I'm not sure if this is a netbios problem (we are using a workgroup not
>> a domain), a virus or what...any advice would be appreciated!
>>
>> thanks
>>
>>
>> --
>> randalino
>> ------------------------------------------------------------------------
>> randalino's Profile:
>> View this thread:
>>
>>
>>
>><!--colorc--><!--/colorc-->
><!--colorc--><!--/colorc-->

 

Hi Ace, Dave

We're using Kaspersky v 6.0 and haven't changed anything on the server.
I've been running virus/trojan checks but so far nothing..
the server is just used as a file server- no active directory, no
exchange. It's sitting behind a juniper firewall.

We also had event ID 8009 on 1 machine

thanks!

IPCONFIG /ALL FROM A VISTA WORKSTATION:
C:\Users\Charlie>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : Charlie
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : SSG5-Serial

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : SSG5-Serial
Description . . . . . . . . . . . : Intel® 82562V-2 10/100 Network
Connect
on
Physical Address. . . . . . . . . : 00-21-9B-08-EB-95
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . :
fe80::ac1d:a377:8d79:507%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.135.25(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 12 October 2009 14:24:06
Lease Expires . . . . . . . . . . : 14 October 2009 02:42:51
Default Gateway . . . . . . . . . : 192.168.135.254
DHCP Server . . . . . . . . . . . : 192.168.135.254
DNS Servers . . . . . . . . . . . : 195.54.225.10
195.54.226.10
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter Local Area Connection* 6:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : SSG5-Serial
Description . . . . . . . . . . . : isatap.SSG5-Serial
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 7:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling
Pseudo-Interface
Physical Address. . . . . . . . . : 02-00-54-55-4E-01
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes


IPCONFIG /ALL FROM SERVER:
© Copyright 1985-2003 Microsoft Corp.

C:\Documents and Settings\Administrator>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : vistaserver
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : Yes

Ethernet adapter Local Area Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit
Ethernet
Physical Address. . . . . . . . . : 00-0A-E4-80-ED-FF

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit
Ethernet #2
Physical Address. . . . . . . . . : 00-0A-E4-80-ED-FE
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.135.250
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.135.254
DNS Servers . . . . . . . . . . . : 195.54.225.10
195.54.226.10

C:\Documents and Settings\Administrator>


--
randalino
------------------------------------------------------------------------
randalino's Profile:
View this thread:

 

ok,

I literally shut everything down- server, workstations, switch,
firewall, wireless router, anything connected to the network basically.
I restarted everything but the problem is still there. Am beginning to
think we have a network virus/worm because this problem seemed to appear
very quickly and there were no changes made by me/anyone else that could
have had this sort of impact.

The relevant event ID's we're getting across server/workstations are:
4321, 8003 (source Mrxsmb) and 4319

Randalino


--
randalino
------------------------------------------------------------------------
randalino's Profile:
View this thread:

 

"randalino" <randalino.4006fa@DoNotSpam.com> wrote in message
news:randalino.4006fa@DoNotSpam.com...<!--coloro:blue--><span style="color:blue <!--/coloro-->
>
> ok,
>
> I literally shut everything down- server, workstations, switch,
> firewall, wireless router, anything connected to the network basically.
> I restarted everything but the problem is still there. Am beginning to
> think we have a network virus/worm because this problem seemed to appear
> very quickly and there were no changes made by me/anyone else that could
> have had this sort of impact.
>
> The relevant event ID's we're getting across server/workstations are:
> 4321, 8003 (source Mrxsmb) and 4319
>
> Randalino
>
>
> --
> randalino<!--colorc--><!--/colorc-->

Thank you for posting that information and the ipconfig.

It appears the problem is with the 'vistaserver' because it has the
following enabled:
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : Yes

Is there any reason these features are enabled? I suggest to disable them,
and the problem should go away.

Ace
Ace

 

On Tue, 13 Oct 2009 13:51:13 +0530, randalino <randalino.3zzmzb@DoNotSpam.com>
wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
>
>Hi Ace, Dave
>
>We're using Kaspersky v 6.0 and haven't changed anything on the server.<!--colorc--><!--/colorc-->

A bit off topic but I installed the Kaspersky v 8 mgmt console today and it is
well worth doing even if you stick to v6 agent etc.
--
Dave Mills
There are 10 types of people, those that understand binary and those that don't.

 

"DaveMills" <DaveMills@newsgroup.nospam> wrote in message
news:q7j9d59v8g88vbf3vi6ss60g04h1gr2lhu@4ax.com...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> On Tue, 13 Oct 2009 13:51:13 +0530, randalino
> <randalino.3zzmzb@DoNotSpam.com>
> wrote:
><!--coloro:green--><span style="color:green <!--/coloro-->
>>
>>Hi Ace, Dave
>>
>>We're using Kaspersky v 6.0 and haven't changed anything on the server.<!--colorc--><!--/colorc-->
>
> A bit off topic but I installed the Kaspersky v 8 mgmt console today and
> it is
> well worth doing even if you stick to v6 agent etc.
> --
> Dave Mills
> There are 10 types of people, those that understand binary and those that
> don't.<!--colorc--><!--/colorc-->


I've tried Kaspersky eval version last year on a personal workstation, just
to see if I would suggest it to some clients, but with the licensing, I
decided to not go with it. It's not a bad product.

Thanks!

Ace