Clients hanging, file share browsing slows, logins take minutes

I have been dealing with some strange issues ever since I moved from a
Win2003 DC w/ File and Print to a new 2008 DC w/ File and Print.
What happens is periodically client machines just start "slowing down".
Opening My Computer will take an extremely long time to show anything,
browsing of any kind on the network is delayed as well. The computers (all
XP Pro SP2 and SP3) just start waiting for something on the domain and until
it times out things are at a a standstill. If a user is logging in at this
time which is common because they reboot to cure their PC slowness they enter
their credentials and get their background with no icons. It can take up to
5 minutes for them to appear in some cases.
Rebooting the server clears everything up immediately, as soon as the server
goes down (you can't browse to your file shares, of course until it comes
back up, but this is why I feel like it must be this server that is the
problem)
This has happened on average every 2-3 weeks, and does not seem to be
happening at the same time of day.
There is absolutely nothing in the event logs. No errors at all unless I
try to restart services - I've tried to restart DNS and Active Directory
Domain Services so far when this happens - no change from the client side.
So, what this looked like to me initially was a network issue. I couldn't
find anything wrong though, I was able to login to the file server (also a DC
and DNS) and look at the Performance monitor and everything is normal. I can
run a network tool like NetTools Pro and get the same bandwidth to the server
as I would any other time (all connections are Gigabit). So I don't think
the issue is networking.
I contacted Microsoft and the rep logged in to my servers and checked the
NTFRS which all checked out fine. Since there wasn't anything useful in the
event logs they couldn't find anything else that could be tested.
Then I thought it might be something with the file shares themselves. The
data was stored on a SAN and I thought that maybe there was some issue with
the SAN iSCSI connection so I replaced the entire server with a new one that
has local SAS RAID 5 data drives. I figured that if the file shares were
troublesome then browsing would be an issue and that it would hang the login
script which made reference to some things on the network shares.
This new server got a fresh install of Windows 2008 Std and shared only the
original server name and IP address. Everything was fresh hardware and
software.
DCDiag reports all Successes on all my DCs, so maybe this isn't an Active
Directory issue. At the moment though I'm leaning towards AD or DNS.

So I've got new hardware, new software install and still have the problem.
If you're still reading, thank you.

The environment is 2 sites, single domain. Site 1 has 3 DCs and 2 DNS
servers. The file server does not contain the FSMO roles. The second site
is connected via high speed 100 Mb line and has 1 DC which is also DNS for
that site.

Maybe the issue isn't actually with the file server, but that wouldn't
explain how restarting that box instantly resolves the problem. I'm at a
loss! I've been trying to pin down the cause of my problems for a couple
months with no success. Any pointers or suggestions anyone can give is
greatly appreciated.

"cjhaugen" <cjhaugen@discussions.microsoft.com> wrote in message
news:EA0979E0-7721-4270-9DC0-0AA8549F1D3D@microsoft.com...
>I have been dealing with some strange issues ever since I moved from a
> Win2003 DC w/ File and Print to a new 2008 DC w/ File and Print.
> What happens is periodically client machines just start "slowing down".
> Opening My Computer will take an extremely long time to show anything,
> browsing of any kind on the network is delayed as well. The computers
> (all
> XP Pro SP2 and SP3) just start waiting for something on the domain and
> until
> it times out things are at a a standstill. If a user is logging in at
> this
> time which is common because they reboot to cure their PC slowness they
> enter
> their credentials and get their background with no icons. It can take up
> to
> 5 minutes for them to appear in some cases.
> Rebooting the server clears everything up immediately, as soon as the
> server
> goes down (you can't browse to your file shares, of course until it comes
> back up, but this is why I feel like it must be this server that is the
> problem)
> This has happened on average every 2-3 weeks, and does not seem to be
> happening at the same time of day.
> There is absolutely nothing in the event logs. No errors at all unless I
> try to restart services - I've tried to restart DNS and Active Directory
> Domain Services so far when this happens - no change from the client side.
> So, what this looked like to me initially was a network issue. I couldn't
> find anything wrong though, I was able to login to the file server (also a
> DC
> and DNS) and look at the Performance monitor and everything is normal. I
> can
> run a network tool like NetTools Pro and get the same bandwidth to the
> server
> as I would any other time (all connections are Gigabit). So I don't think
> the issue is networking.
> I contacted Microsoft and the rep logged in to my servers and checked the
> NTFRS which all checked out fine. Since there wasn't anything useful in
> the
> event logs they couldn't find anything else that could be tested.
> Then I thought it might be something with the file shares themselves. The
> data was stored on a SAN and I thought that maybe there was some issue
> with
> the SAN iSCSI connection so I replaced the entire server with a new one
> that
> has local SAS RAID 5 data drives. I figured that if the file shares were
> troublesome then browsing would be an issue and that it would hang the
> login
> script which made reference to some things on the network shares.
> This new server got a fresh install of Windows 2008 Std and shared only
> the
> original server name and IP address. Everything was fresh hardware and
> software.
> DCDiag reports all Successes on all my DCs, so maybe this isn't an Active
> Directory issue. At the moment though I'm leaning towards AD or DNS.
>
> So I've got new hardware, new software install and still have the problem.
> If you're still reading, thank you.
>
> The environment is 2 sites, single domain. Site 1 has 3 DCs and 2 DNS
> servers. The file server does not contain the FSMO roles. The second
> site
> is connected via high speed 100 Mb line and has 1 DC which is also DNS for
> that site.
>
> Maybe the issue isn't actually with the file server, but that wouldn't
> explain how restarting that box instantly resolves the problem. I'm at a
> loss! I've been trying to pin down the cause of my problems for a couple
> months with no success. Any pointers or suggestions anyone can give is
> greatly appreciated.


A few things can cause this. The main thing that can cause it is
misconfigured DNS. To better diagnose if this is the issue, please provide:
Unedited ipconfig /all from the new 2008 DC
Unedited ipconfig /all from the old 2003 DC
Unedited ipconfig /all from a sample client machine.

What can also cause it is the RSS TCP Chimney setting. This is a known cause
in some cases.
Another issue is IPv6 on the 2008 DC, another known issue. Disabling it may
take care of it, as well.

Some reading and guidelines to check out...
==================================================================================================== ==
Slow file transfer and connectivity with Windows 2003 SP2, Windows 2008, SBS
2003 SP2 and SBS 2008, and Vista
System Error 64
System Error 53
Shares disconnect after a server has been running for a period of time such
as a couple of weeks and a restart fixes it temporarily.


This may be due to the new RSS TCP Chimney Offload feature enabled on 2003
SP2 and newer servers.

TCP Chimney Offload overview:

TCP Chimney Offload is a networking technology that helps transfer the
workload from the CPU to a network adapter during network data transfer. In
Windows Server 2008, TCP Chimney Offload enables the Windows networking
subsystem to offload the processing of a TCP/IP connection to a network
adapter that includes special support for TCP/IP offload processing.

TCP Chimney Offload is available in all versions of Windows Server 2008 and
Windows Vista. Both TCP/IPv4 connections and TCP/IPv6 connections can be
offloaded if the network adapter supports this feature.


Two ways to handle it.
1. Disable RSS using the netsh command (preferred)
2. Disable RSS in the registry


1. Disable RSS using the netsh command:
(From http://support.microsoft.com/kb/951037)

netsh interface tcp set global rss=disabled
netsh interface tcp set global autotuninglevel=disabled
Reboot the server

2. Disable RSS in the Registry
(From http://support.microsoft.com/kb/927695):

Add a DWORD registry key value for
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableRSS
and setting it to 0. A reboot is required to make the value go in to
effect.
Set DisableTaskOffload in the Registry
Use the steps in KB 904946 to create a DWORD value for
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableTaskOffload
and set it to 1.
A reboot is required to make this value go in to effect.


More info on the subject...

Information about the TCP Chimney Offload, Receive Side Scaling, and Network
Direct Memory Access features in Windows Server 2008
http://support.microsoft.com/kb/951037

You cannot host TCP connections when Receive Side Scaling is enabled in
Windows Server 2003 with Service Pack 2
http://support.microsoft.com/?id=927695

Vista slow after SP2 installed on Windows 2003 Server (SBS or non-SBS) or
using Windows 2008?
http://msmvps.com/blogs/bradley/arch...installed.aspx

Windows 2003 service pack 2 known issues on Small Business Server 2003
http://support.microsoft.com/kb/555912/en-us

Susan Bradley: Vista slow after SP2 installed?
http://msmvps.com/blogs/bradley/arch...installed.aspx

You experience intermittent communication failure between computers that are
running Windows XP or Windows Server 2003
http://support.microsoft.com/?id=904946

Common Networking Issues After Applying Windows Server 2003 SP2 on SBS:
http://blogs.technet.com/sbs/archive...p2-on-sbs.aspx
==================================================================================================== ==



==================================================================================================== ==
Disabling IPv6

====
There are known issues regarding IPv6 affecting communications in certain
scenarios, such as with errors when using Outlook Anywhere such as to fix an
Exchange/DC NSPI port 6004 communication issue, among many others. Therefore
to eliminiate communications issues regarding whether this is a factor or
not, it is recommended to disable IPv6 in registry on the Exchange server,
as well as on the domain controllers, or any server for that matter,
especially if there are no plans in using IPv6.

To disable IPv6 on any server or Vista machine:

Uncheck IPv6 in NIC properties
Uncheck the two LinkLayer Topology Discovery components
Then follow the registry changes procedure below to completely disable IPv6.

1. Navigate to:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters]
2. In the details pane, click New, and then click DWORD (32-bit) Value.
3. Type in DisabledComponents , and then press ENTER.
4. Double-click DisabledComponents,
5. Type ff in Hexadecimal.
6. So it should like this when completed:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters]
"DisabledComponents"=dword:000000ff

====

More info:

The installation of the Exchange Server 2007 Hub Transport role is
unsuccessful on a Windows Server 2008-based computer
http://support.microsoft.com/?id=952842

Disabling IPv6 on Windows 2008 or Vista
http://blogs.dirteam.com/blogs/paulb...dows-2008.aspx
==================================================================================================== ==

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer
aceman@mvps.RemoveThisPart.org

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

"Efficiency is doing things right; effectiveness is doing the right
things." - Peter F. Drucker
http://twitter.com/acefekay

Thanks Ace. I will try your suggestions. In the meantime here are the
requested ipconfig/all results (edited for posting, but I will email you the
unedited versions)

New 2008 DC
Microsoft Windows [Version 6.0.6002]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.

C:\Users\administrator.domain>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : ServerName
Primary Dns Suffix . . . . . . . : domain.ws
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : domain.ws

Ethernet adapter LAN(2):

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom BCM5708C NetXtreme II GigE
(NDIS
VBD Client)
Physical Address. . . . . . . . . : 00-24-E8-51-97-A6
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : xxx.xxx.231.38(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : xxx.xxx.231.22
DNS Servers . . . . . . . . . . . : xxx.xxx.231.38
xxx.xxx.231.138
Primary WINS Server . . . . . . . : xxx.xxx.231.138
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Nic2-Team:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 PT Dual Port Server
Ada
pter #2
Physical Address. . . . . . . . . : 00-15-17-B0-60-D5
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 8:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . :
isatap.{473611D3-4192-42B6-AEB8-ADD708ED1
0AB}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 9:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : 6TO4 Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2002:905c:e726::905c:e726(Preferred)
Default Gateway . . . . . . . . . : 2002:c058:6301::c058:6301
DNS Servers . . . . . . . . . . . : xxx.xxx.231.38
xxx.xxx.231.138
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter Local Area Connection* 11:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . :
isatap.{17208FB8-85FD-497E-8BA8-19C70B2EF
E35}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

C:\Users\administrator.domain>

Old 2003 DC - no longer have it available, but the settings would have been
IPv4 Address. . . . . . . . . . . : xxx.xxx.231.38
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : xxx.xxx.231.22
DNS Servers . . . . . . . . . . . : xxx.xxx.231.38
xxx.xxx.231.138
Primary WINS Server . . . . . . . : xxx.xxx.231.138
NetBIOS over Tcpip. . . . . . . . : Enabled

Client machine
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

G:\>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : clientname
Primary Dns Suffix . . . . . . . : domain.ws
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : domain.ws
domain.ws

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : domain.ws
Description . . . . . . . . . . . : Intel(R) 82567LM-3 Gigabit
Network C
onnection
Physical Address. . . . . . . . . : 00-22-19-2F-A3-B0
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : xxx.xxx.231.218
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : xxx.xxx.231.22
DHCP Server . . . . . . . . . . . : xxx.xxx.231.22
DNS Servers . . . . . . . . . . . : xxx.xxx.231.38
xxx.xxx.231.138
Primary WINS Server . . . . . . . : xxx.xxx.231.138
Lease Obtained. . . . . . . . . . : Thursday, June 11, 2009 11:00:11
AM
Lease Expires . . . . . . . . . . : Friday, June 12, 2009 11:00:11 AM

G:\>




"Ace Fekay [Microsoft Certified Trainer]" wrote:

> "cjhaugen" <cjhaugen@discussions.microsoft.com> wrote in message
> news:EA0979E0-7721-4270-9DC0-0AA8549F1D3D@microsoft.com...
> >I have been dealing with some strange issues ever since I moved from a
> > Win2003 DC w/ File and Print to a new 2008 DC w/ File and Print.
> > What happens is periodically client machines just start "slowing down".
> > Opening My Computer will take an extremely long time to show anything,
> > browsing of any kind on the network is delayed as well. The computers
> > (all
> > XP Pro SP2 and SP3) just start waiting for something on the domain and
> > until
> > it times out things are at a a standstill. If a user is logging in at
> > this
> > time which is common because they reboot to cure their PC slowness they
> > enter
> > their credentials and get their background with no icons. It can take up
> > to
> > 5 minutes for them to appear in some cases.
> > Rebooting the server clears everything up immediately, as soon as the
> > server
> > goes down (you can't browse to your file shares, of course until it comes
> > back up, but this is why I feel like it must be this server that is the
> > problem)
> > This has happened on average every 2-3 weeks, and does not seem to be
> > happening at the same time of day.
> > There is absolutely nothing in the event logs. No errors at all unless I
> > try to restart services - I've tried to restart DNS and Active Directory
> > Domain Services so far when this happens - no change from the client side.
> > So, what this looked like to me initially was a network issue. I couldn't
> > find anything wrong though, I was able to login to the file server (also a
> > DC
> > and DNS) and look at the Performance monitor and everything is normal. I
> > can
> > run a network tool like NetTools Pro and get the same bandwidth to the
> > server
> > as I would any other time (all connections are Gigabit). So I don't think
> > the issue is networking.
> > I contacted Microsoft and the rep logged in to my servers and checked the
> > NTFRS which all checked out fine. Since there wasn't anything useful in
> > the
> > event logs they couldn't find anything else that could be tested.
> > Then I thought it might be something with the file shares themselves. The
> > data was stored on a SAN and I thought that maybe there was some issue
> > with
> > the SAN iSCSI connection so I replaced the entire server with a new one
> > that
> > has local SAS RAID 5 data drives. I figured that if the file shares were
> > troublesome then browsing would be an issue and that it would hang the
> > login
> > script which made reference to some things on the network shares.
> > This new server got a fresh install of Windows 2008 Std and shared only
> > the
> > original server name and IP address. Everything was fresh hardware and
> > software.
> > DCDiag reports all Successes on all my DCs, so maybe this isn't an Active
> > Directory issue. At the moment though I'm leaning towards AD or DNS.
> >
> > So I've got new hardware, new software install and still have the problem.
> > If you're still reading, thank you.
> >
> > The environment is 2 sites, single domain. Site 1 has 3 DCs and 2 DNS
> > servers. The file server does not contain the FSMO roles. The second
> > site
> > is connected via high speed 100 Mb line and has 1 DC which is also DNS for
> > that site.
> >
> > Maybe the issue isn't actually with the file server, but that wouldn't
> > explain how restarting that box instantly resolves the problem. I'm at a
> > loss! I've been trying to pin down the cause of my problems for a couple
> > months with no success. Any pointers or suggestions anyone can give is
> > greatly appreciated.
>
>
> A few things can cause this. The main thing that can cause it is
> misconfigured DNS. To better diagnose if this is the issue, please provide:
> Unedited ipconfig /all from the new 2008 DC
> Unedited ipconfig /all from the old 2003 DC
> Unedited ipconfig /all from a sample client machine.
>
> What can also cause it is the RSS TCP Chimney setting. This is a known cause
> in some cases.
> Another issue is IPv6 on the 2008 DC, another known issue. Disabling it may
> take care of it, as well.
>
> Some reading and guidelines to check out...
> ==================================================================================================== ==
> Slow file transfer and connectivity with Windows 2003 SP2, Windows 2008, SBS
> 2003 SP2 and SBS 2008, and Vista
> System Error 64
> System Error 53
> Shares disconnect after a server has been running for a period of time such
> as a couple of weeks and a restart fixes it temporarily.
>
>
> This may be due to the new RSS TCP Chimney Offload feature enabled on 2003
> SP2 and newer servers.
>
> TCP Chimney Offload overview:
>
> TCP Chimney Offload is a networking technology that helps transfer the
> workload from the CPU to a network adapter during network data transfer. In
> Windows Server 2008, TCP Chimney Offload enables the Windows networking
> subsystem to offload the processing of a TCP/IP connection to a network
> adapter that includes special support for TCP/IP offload processing.
>
> TCP Chimney Offload is available in all versions of Windows Server 2008 and
> Windows Vista. Both TCP/IPv4 connections and TCP/IPv6 connections can be
> offloaded if the network adapter supports this feature.
>
>
> Two ways to handle it.
> 1. Disable RSS using the netsh command (preferred)
> 2. Disable RSS in the registry
>
>
> 1. Disable RSS using the netsh command:
> (From http://support.microsoft.com/kb/951037)
>
> netsh interface tcp set global rss=disabled
> netsh interface tcp set global autotuninglevel=disabled
> Reboot the server
>
> 2. Disable RSS in the Registry
> (From http://support.microsoft.com/kb/927695):
>
> Add a DWORD registry key value for
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableRSS
> and setting it to 0. A reboot is required to make the value go in to
> effect.
> Set DisableTaskOffload in the Registry
> Use the steps in KB 904946 to create a DWORD value for
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableTaskOffload
> and set it to 1.
> A reboot is required to make this value go in to effect.
>
>
> More info on the subject...
>
> Information about the TCP Chimney Offload, Receive Side Scaling, and Network
> Direct Memory Access features in Windows Server 2008
> http://support.microsoft.com/kb/951037
>
> You cannot host TCP connections when Receive Side Scaling is enabled in
> Windows Server 2003 with Service Pack 2
> http://support.microsoft.com/?id=927695
>
> Vista slow after SP2 installed on Windows 2003 Server (SBS or non-SBS) or
> using Windows 2008?
> http://msmvps.com/blogs/bradley/arch...installed.aspx
>
> Windows 2003 service pack 2 known issues on Small Business Server 2003
> http://support.microsoft.com/kb/555912/en-us
>
> Susan Bradley: Vista slow after SP2 installed?
> http://msmvps.com/blogs/bradley/arch...installed.aspx
>
> You experience intermittent communication failure between computers that are
> running Windows XP or Windows Server 2003
> http://support.microsoft.com/?id=904946
>
> Common Networking Issues After Applying Windows Server 2003 SP2 on SBS:
> http://blogs.technet.com/sbs/archive...p2-on-sbs.aspx
> ==================================================================================================== ==
>
>
>
> ==================================================================================================== ==
> Disabling IPv6
>
> ====
> There are known issues regarding IPv6 affecting communications in certain
> scenarios, such as with errors when using Outlook Anywhere such as to fix an
> Exchange/DC NSPI port 6004 communication issue, among many others. Therefore
> to eliminiate communications issues regarding whether this is a factor or
> not, it is recommended to disable IPv6 in registry on the Exchange server,
> as well as on the domain controllers, or any server for that matter,
> especially if there are no plans in using IPv6.
>
> To disable IPv6 on any server or Vista machine:
>
> Uncheck IPv6 in NIC properties
> Uncheck the two LinkLayer Topology Discovery components
> Then follow the registry changes procedure below to completely disable IPv6.
>
> 1. Navigate to:
> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters]
> 2. In the details pane, click New, and then click DWORD (32-bit) Value.
> 3. Type in DisabledComponents , and then press ENTER.
> 4. Double-click DisabledComponents,
> 5. Type ff in Hexadecimal.
> 6. So it should like this when completed:
> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters]
> "DisabledComponents"=dword:000000ff
>
> ====
>
> More info:
>
> The installation of the Exchange Server 2007 Hub Transport role is
> unsuccessful on a Windows Server 2008-based computer
> http://support.microsoft.com/?id=952842
>
> Disabling IPv6 on Windows 2008 or Vista
> http://blogs.dirteam.com/blogs/paulb...dows-2008.aspx
> ==================================================================================================== ==
>
> --
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
> Microsoft Certified Trainer
> aceman@mvps.RemoveThisPart.org
>
> For urgent issues, you may want to contact Microsoft PSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> "Efficiency is doing things right; effectiveness is doing the right
> things." - Peter F. Drucker
> http://twitter.com/acefekay
>
>
>

Hello cjhaugen,

If IPv6 is not used disable it complete according to Pauls article:
http://blogs.dirteam.com/blogs/paulb...dows-2008.aspx

I suggest you change from the router DHCP to your 2008 server to use DHCP,
lots of advantages for configuration also DNS registration is possible according
to:
http://technet.microsoft.com/en-us/l.../cc787034.aspx

Additional disable unused NICs.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Thanks Ace. I will try your suggestions. In the meantime here are
> the requested ipconfig/all results (edited for posting, but I will
> email you the unedited versions)
>
> New 2008 DC
> Microsoft Windows [Version 6.0.6002]
> Copyright (c) 2006 Microsoft Corporation. All rights reserved.
> C:\Users\administrator.domain>ipconfig /all
>
> Windows IP Configuration
>
> Host Name . . . . . . . . . . . . : ServerName
> Primary Dns Suffix . . . . . . . : domain.ws
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : domain.ws
> Ethernet adapter LAN(2):
>
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . : Broadcom BCM5708C NetXtreme II
> GigE
> (NDIS
> VBD Client)
> Physical Address. . . . . . . . . : 00-24-E8-51-97-A6
> DHCP Enabled. . . . . . . . . . . : No
> Autoconfiguration Enabled . . . . : Yes
> IPv4 Address. . . . . . . . . . . : xxx.xxx.231.38(Preferred)
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : xxx.xxx.231.22
> DNS Servers . . . . . . . . . . . : xxx.xxx.231.38
> xxx.xxx.231.138
> Primary WINS Server . . . . . . . : xxx.xxx.231.138
> NetBIOS over Tcpip. . . . . . . . : Enabled
> Ethernet adapter Nic2-Team:
>
> Media State . . . . . . . . . . . : Media disconnected
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . : Intel(R) PRO/1000 PT Dual Port
> Server
> Ada
> pter #2
> Physical Address. . . . . . . . . : 00-15-17-B0-60-D5
> DHCP Enabled. . . . . . . . . . . : Yes
> Autoconfiguration Enabled . . . . : Yes
> Tunnel adapter Local Area Connection* 8:
>
> Media State . . . . . . . . . . . : Media disconnected
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . :
> isatap.{473611D3-4192-42B6-AEB8-ADD708ED1
> 0AB}
> Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
> DHCP Enabled. . . . . . . . . . . : No
> Autoconfiguration Enabled . . . . : Yes
> Tunnel adapter Local Area Connection* 9:
>
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . : 6TO4 Adapter
> Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
> DHCP Enabled. . . . . . . . . . . : No
> Autoconfiguration Enabled . . . . : Yes
> IPv6 Address. . . . . . . . . . . :
> 2002:905c:e726::905c:e726(Preferred)
> Default Gateway . . . . . . . . . : 2002:c058:6301::c058:6301
> DNS Servers . . . . . . . . . . . : xxx.xxx.231.38
> xxx.xxx.231.138
> NetBIOS over Tcpip. . . . . . . . : Disabled
> Tunnel adapter Local Area Connection* 11:
>
> Media State . . . . . . . . . . . : Media disconnected
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . :
> isatap.{17208FB8-85FD-497E-8BA8-19C70B2EF
> E35}
> Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
> DHCP Enabled. . . . . . . . . . . : No
> Autoconfiguration Enabled . . . . : Yes
> C:\Users\administrator.domain>
>
> Old 2003 DC - no longer have it available, but the settings would have
> been
> IPv4 Address. . . . . . . . . . . : xxx.xxx.231.38
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : xxx.xxx.231.22
> DNS Servers . . . . . . . . . . . : xxx.xxx.231.38
> xxx.xxx.231.138
> Primary WINS Server . . . . . . . : xxx.xxx.231.138
> NetBIOS over Tcpip. . . . . . . . : Enabled
> Client machine
> Microsoft Windows XP [Version 5.1.2600]
> (C) Copyright 1985-2001 Microsoft Corp.
> G:\>ipconfig /all
>
> Windows IP Configuration
>
> Host Name . . . . . . . . . . . . : clientname
> Primary Dns Suffix . . . . . . . : domain.ws
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : domain.ws
> domain.ws
> Ethernet adapter Local Area Connection:
>
> Connection-specific DNS Suffix . : domain.ws
> Description . . . . . . . . . . . : Intel(R) 82567LM-3 Gigabit
> Network C
> onnection
> Physical Address. . . . . . . . . : 00-22-19-2F-A3-B0
> Dhcp Enabled. . . . . . . . . . . : Yes
> Autoconfiguration Enabled . . . . : Yes
> IP Address. . . . . . . . . . . . : xxx.xxx.231.218
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : xxx.xxx.231.22
> DHCP Server . . . . . . . . . . . : xxx.xxx.231.22
> DNS Servers . . . . . . . . . . . : xxx.xxx.231.38
> xxx.xxx.231.138
> Primary WINS Server . . . . . . . : xxx.xxx.231.138
> Lease Obtained. . . . . . . . . . : Thursday, June 11, 2009
> 11:00:11
> AM
> Lease Expires . . . . . . . . . . : Friday, June 12, 2009
> 11:00:11 AM
> G:\>
>
> "Ace Fekay [Microsoft Certified Trainer]" wrote:
>
>> "cjhaugen" <cjhaugen@discussions.microsoft.com> wrote in message
>> news:EA0979E0-7721-4270-9DC0-0AA8549F1D3D@microsoft.com...
>>
>>> I have been dealing with some strange issues ever since I moved from
>>> a
>>> Win2003 DC w/ File and Print to a new 2008 DC w/ File and Print.
>>> What happens is periodically client machines just start "slowing
>>> down".
>>> Opening My Computer will take an extremely long time to show
>>> anything,
>>> browsing of any kind on the network is delayed as well. The
>>> computers
>>> (all
>>> XP Pro SP2 and SP3) just start waiting for something on the domain
>>> and
>>> until
>>> it times out things are at a a standstill. If a user is logging in
>>> at
>>> this
>>> time which is common because they reboot to cure their PC slowness
>>> they
>>> enter
>>> their credentials and get their background with no icons. It can
>>> take up
>>> to
>>> 5 minutes for them to appear in some cases.
>>> Rebooting the server clears everything up immediately, as soon as
>>> the
>>> server
>>> goes down (you can't browse to your file shares, of course until it
>>> comes
>>> back up, but this is why I feel like it must be this server that is
>>> the
>>> problem)
>>> This has happened on average every 2-3 weeks, and does not seem to
>>> be
>>> happening at the same time of day.
>>> There is absolutely nothing in the event logs. No errors at all
>>> unless I
>>> try to restart services - I've tried to restart DNS and Active
>>> Directory
>>> Domain Services so far when this happens - no change from the client
>>> side.
>>> So, what this looked like to me initially was a network issue. I
>>> couldn't
>>> find anything wrong though, I was able to login to the file server
>>> (also a
>>> DC
>>> and DNS) and look at the Performance monitor and everything is
>>> normal. I
>>> can
>>> run a network tool like NetTools Pro and get the same bandwidth to
>>> the
>>> server
>>> as I would any other time (all connections are Gigabit). So I don't
>>> think
>>> the issue is networking.
>>> I contacted Microsoft and the rep logged in to my servers and
>>> checked the
>>> NTFRS which all checked out fine. Since there wasn't anything
>>> useful in
>>> the
>>> event logs they couldn't find anything else that could be tested.
>>> Then I thought it might be something with the file shares
>>> themselves. The
>>> data was stored on a SAN and I thought that maybe there was some
>>> issue
>>> with
>>> the SAN iSCSI connection so I replaced the entire server with a new
>>> one
>>> that
>>> has local SAS RAID 5 data drives. I figured that if the file shares
>>> were
>>> troublesome then browsing would be an issue and that it would hang
>>> the
>>> login
>>> script which made reference to some things on the network shares.
>>> This new server got a fresh install of Windows 2008 Std and shared
>>> only
>>> the
>>> original server name and IP address. Everything was fresh hardware
>>> and
>>> software.
>>> DCDiag reports all Successes on all my DCs, so maybe this isn't an
>>> Active
>>> Directory issue. At the moment though I'm leaning towards AD or
>>> DNS.
>>> So I've got new hardware, new software install and still have the
>>> problem. If you're still reading, thank you.
>>>
>>> The environment is 2 sites, single domain. Site 1 has 3 DCs and 2
>>> DNS
>>> servers. The file server does not contain the FSMO roles. The
>>> second
>>> site
>>> is connected via high speed 100 Mb line and has 1 DC which is also
>>> DNS for
>>> that site.
>>> Maybe the issue isn't actually with the file server, but that
>>> wouldn't explain how restarting that box instantly resolves the
>>> problem. I'm at a loss! I've been trying to pin down the cause of
>>> my problems for a couple months with no success. Any pointers or
>>> suggestions anyone can give is greatly appreciated.
>>>
>> A few things can cause this. The main thing that can cause it is
>> misconfigured DNS. To better diagnose if this is the issue, please
>> provide:
>> Unedited ipconfig /all from the new 2008 DC
>> Unedited ipconfig /all from the old 2003 DC
>> Unedited ipconfig /all from a sample client machine.
>> What can also cause it is the RSS TCP Chimney setting. This is a
>> known cause
>> in some cases.
>> Another issue is IPv6 on the 2008 DC, another known issue. Disabling
>> it may
>> take care of it, as well.
>> Some reading and guidelines to check out...
>>
>> =====================================================================
>> =================================
>>
>> Slow file transfer and connectivity with Windows 2003 SP2, Windows
>> 2008, SBS
>>
>> 2003 SP2 and SBS 2008, and Vista
>>
>> System Error 64
>>
>> System Error 53
>>
>> Shares disconnect after a server has been running for a period of
>> time such
>>
>> as a couple of weeks and a restart fixes it temporarily.
>>
>> This may be due to the new RSS TCP Chimney Offload feature enabled on
>> 2003 SP2 and newer servers.
>>
>> TCP Chimney Offload overview:
>>
>> TCP Chimney Offload is a networking technology that helps transfer
>> the workload from the CPU to a network adapter during network data
>> transfer. In Windows Server 2008, TCP Chimney Offload enables the
>> Windows networking subsystem to offload the processing of a TCP/IP
>> connection to a network adapter that includes special support for
>> TCP/IP offload processing.
>>
>> TCP Chimney Offload is available in all versions of Windows Server
>> 2008 and Windows Vista. Both TCP/IPv4 connections and TCP/IPv6
>> connections can be offloaded if the network adapter supports this
>> feature.
>>
>> Two ways to handle it.
>> 1. Disable RSS using the netsh command (preferred)
>> 2. Disable RSS in the registry
>> 1. Disable RSS using the netsh command:
>> (From http://support.microsoft.com/kb/951037)
>> netsh interface tcp set global rss=disabled
>> netsh interface tcp set global autotuninglevel=disabled
>> Reboot the server
>> 2. Disable RSS in the Registry
>> (From http://support.microsoft.com/kb/927695):
>> Add a DWORD registry key value for
>> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
>> \EnableRSS
>> and setting it to 0. A reboot is required to make the value go in to
>> effect.
>> Set DisableTaskOffload in the Registry
>> Use the steps in KB 904946 to create a DWORD value for
>> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
>> \DisableTaskOffload
>> and set it to 1.
>> A reboot is required to make this value go in to effect.
>> More info on the subject...
>>
>> Information about the TCP Chimney Offload, Receive Side Scaling, and
>> Network Direct Memory Access features in Windows Server 2008
>> http://support.microsoft.com/kb/951037
>>
>> You cannot host TCP connections when Receive Side Scaling is enabled
>> in Windows Server 2003 with Service Pack 2
>> http://support.microsoft.com/?id=927695
>>
>> Vista slow after SP2 installed on Windows 2003 Server (SBS or
>> non-SBS) or using Windows 2008?
>> http://msmvps.com/blogs/bradley/arch...a-slow-after-s
>> p2-installed.aspx
>>
>> Windows 2003 service pack 2 known issues on Small Business Server
>> 2003 http://support.microsoft.com/kb/555912/en-us
>>
>> Susan Bradley: Vista slow after SP2 installed?
>> http://msmvps.com/blogs/bradley/arch...a-slow-after-s
>> p2-installed.aspx
>> You experience intermittent communication failure between computers
>> that are running Windows XP or Windows Server 2003
>> http://support.microsoft.com/?id=904946
>>
>> Common Networking Issues After Applying Windows Server 2003 SP2 on
>> SBS:
>>
>> http://blogs.technet.com/sbs/archive...networking-iss
>> ues-after-applying-windows-server-2003-sp2-on-sbs.aspx
>>
>> =====================================================================
>> =================================
>>
>> =====================================================================
>> =================================
>>
>> Disabling IPv6
>>
>> ====
>> There are known issues regarding IPv6 affecting communications in
>> certain
>> scenarios, such as with errors when using Outlook Anywhere such as to
>> fix an
>> Exchange/DC NSPI port 6004 communication issue, among many others.
>> Therefore
>> to eliminiate communications issues regarding whether this is a
>> factor or
>> not, it is recommended to disable IPv6 in registry on the Exchange
>> server,
>> as well as on the domain controllers, or any server for that matter,
>> especially if there are no plans in using IPv6.
>> To disable IPv6 on any server or Vista machine:
>>
>> Uncheck IPv6 in NIC properties
>> Uncheck the two LinkLayer Topology Discovery components
>> Then follow the registry changes procedure below to completely
>> disable IPv6.
>> 1. Navigate to:
>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Paramete
>> rs]
>> 2. In the details pane, click New, and then click DWORD (32-bit)
>> Value.
>> 3. Type in DisabledComponents , and then press ENTER.
>> 4. Double-click DisabledComponents,
>> 5. Type ff in Hexadecimal.
>> 6. So it should like this when completed:
>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Paramete
>> rs]
>> "DisabledComponents"=dword:000000ff
>> ====
>>
>> More info:
>>
>> The installation of the Exchange Server 2007 Hub Transport role is
>> unsuccessful on a Windows Server 2008-based computer
>> http://support.microsoft.com/?id=952842
>>
>> Disabling IPv6 on Windows 2008 or Vista
>>
>> http://blogs.dirteam.com/blogs/paulb.../03/19/disabli
>> ng-ipv6-on-windows-2008.aspx
>>
>> =====================================================================
>> =================================
>>
>> -- Ace
>>
>> This posting is provided "AS-IS" with no warranties or guarantees and
>> confers no rights.
>>
>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
>> Microsoft Certified Trainer
>> aceman@mvps.RemoveThisPart.org
>> For urgent issues, you may want to contact Microsoft PSS directly.
>> Please check http://support.microsoft.com for regional support phone
>> numbers.
>>
>> "Efficiency is doing things right; effectiveness is doing the right
>> things." - Peter F. Drucker
>> http://twitter.com/acefekay

"cjhaugen" <cjhaugen@discussions.microsoft.com> wrote in message
news:166C542C-A4F2-4C5D-BC28-470D30B93713@microsoft.com...
> Thanks Ace. I will try your suggestions. In the meantime here are the
> requested ipconfig/all results (edited for posting, but I will email you
> the
> unedited versions)

Hi Chris,

Thanks for the actual ipconfigs. They are usually much more helpful than
trying to read through an altered one.

They actually look pretty good. I would suggest to use the DC itself as the
first entry for DNS, then a local partner, or if not available, a remote
one.

I would also suggest to disable IPv6. Once you've done that, reply to me
privately with an updated ipconfig /all, and let me know if the errors
continue. If they do, I would look at disabling the TCP Chimney feature.

Ace

Thanks Ace and Meinolf,
I've fully disabled IPv6 on this server (and all other 2008 servers as
well). If nothing happens within a few weeks I think we'll be in good shape.
I've also started getting DHCP ready on one of the servers to replace the
firewall DHCP, which is something I've been planning on for a while anyway.
I'll let you know if there are any more issues. Thanks so much for your help!

"Ace Fekay [Microsoft Certified Trainer]" wrote:

> "cjhaugen" <cjhaugen@discussions.microsoft.com> wrote in message
> news:166C542C-A4F2-4C5D-BC28-470D30B93713@microsoft.com...
> > Thanks Ace. I will try your suggestions. In the meantime here are the
> > requested ipconfig/all results (edited for posting, but I will email you
> > the
> > unedited versions)
>
> Hi Chris,
>
> Thanks for the actual ipconfigs. They are usually much more helpful than
> trying to read through an altered one.
>
> They actually look pretty good. I would suggest to use the DC itself as the
> first entry for DNS, then a local partner, or if not available, a remote
> one.
>
> I would also suggest to disable IPv6. Once you've done that, reply to me
> privately with an updated ipconfig /all, and let me know if the errors
> continue. If they do, I would look at disabling the TCP Chimney feature.
>
> Ace
>
>
>
>

"cjhaugen" <cjhaugen@discussions.microsoft.com> wrote in message
news:281FC600-EB9D-4ACA-BE18-A59C0640754D@microsoft.com...
> Thanks Ace and Meinolf,
> I've fully disabled IPv6 on this server (and all other 2008 servers as
> well). If nothing happens within a few weeks I think we'll be in good
> shape.
> I've also started getting DHCP ready on one of the servers to replace the
> firewall DHCP, which is something I've been planning on for a while
> anyway.
> I'll let you know if there are any more issues. Thanks so much for your
> help!


You are welcome, and I hope it works out!

Ace

I'm sorry to say we had another incident this morning.
It manifests itself a little differently every time, always with the same
result as client computers become unresponsive, file shares stop working (at
different times for different people.) It seems to take 40 minutes to an
hour between when I first hear of an issue from someone to it hitting
everyone equally. This time when people tried to open Word files on the
network they got a "Downloading file..." message and the file would never
open. I've never seen it just impact a particular file type before.
Eventually it impacted everything.

Any other things you would suggest checking?


"Ace Fekay [Microsoft Certified Trainer]" wrote:

> "cjhaugen" <cjhaugen@discussions.microsoft.com> wrote in message
> news:281FC600-EB9D-4ACA-BE18-A59C0640754D@microsoft.com...
> > Thanks Ace and Meinolf,
> > I've fully disabled IPv6 on this server (and all other 2008 servers as
> > well). If nothing happens within a few weeks I think we'll be in good
> > shape.
> > I've also started getting DHCP ready on one of the servers to replace the
> > firewall DHCP, which is something I've been planning on for a while
> > anyway.
> > I'll let you know if there are any more issues. Thanks so much for your
> > help!
>
>
> You are welcome, and I hope it works out!
>
> Ace
>
>
>

"cjhaugen" <cjhaugen@discussions.microsoft.com> wrote in message
news:F975BE34-6100-442C-8878-C758CA8D7768@microsoft.com...
> I'm sorry to say we had another incident this morning.
> It manifests itself a little differently every time, always with the same
> result as client computers become unresponsive, file shares stop working
> (at
> different times for different people.) It seems to take 40 minutes to an
> hour between when I first hear of an issue from someone to it hitting
> everyone equally. This time when people tried to open Word files on the
> network they got a "Downloading file..." message and the file would never
> open. I've never seen it just impact a particular file type before.
> Eventually it impacted everything.
>
> Any other things you would suggest checking?
>

Hmm, unfortunate to hear.

See if the following about the TCP Chimney may be the cause.
==================================================================================================== ==
Slow file transfer and connectivity with Windows 2003 SP2, Windows 2008, SBS
2003 SP2 and SBS 2008, and Vista
System Error 64
System Error 53
Shares disconnect after a server has been running for a period of time such
as a couple of weeks and a restart fixes it temporarily.


This may be due to the new RSS TCP Chimney Offload feature enabled on 2003
SP2 and newer servers.

TCP Chimney Offload overview:

TCP Chimney Offload is a networking technology that helps transfer the
workload from the CPU to a network adapter during network data transfer. In
Windows Server 2008, TCP Chimney Offload enables the Windows networking
subsystem to offload the processing of a TCP/IP connection to a network
adapter that includes special support for TCP/IP offload processing.

TCP Chimney Offload is available in all versions of Windows Server 2008 and
Windows Vista. Both TCP/IPv4 connections and TCP/IPv6 connections can be
offloaded if the network adapter supports this feature.

Two ways to handle it.
1. Disable RSS using the netsh command (preferred)
2. Disable RSS in the registry

1. Disable RSS using the netsh command:
(From http://support.microsoft.com/kb/951037)

netsh interface tcp set global rss=disabled
netsh interface tcp set global autotuninglevel=disabled
Reboot the server

2. Disable RSS in the Registry
(From http://support.microsoft.com/kb/927695):

Add a DWORD registry key value for
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableRSS
and setting it to 0. A reboot is required to make the value go in to
effect.
Set DisableTaskOffload in the Registry
Use the steps in KB 904946 to create a DWORD value for
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableTaskOffload
and set it to 1.
A reboot is required to make this value go in to effect.


More info on the subject...

Information about the TCP Chimney Offload, Receive Side Scaling, and Network
Direct Memory Access features in Windows Server 2008
http://support.microsoft.com/kb/951037

You cannot host TCP connections when Receive Side Scaling is enabled in
Windows Server 2003 with Service Pack 2
http://support.microsoft.com/?id=927695

Vista slow after SP2 installed on Windows 2003 Server (SBS or non-SBS) or
using Windows 2008?
http://msmvps.com/blogs/bradley/arch...installed.aspx

Windows 2003 service pack 2 known issues on Small Business Server 2003
http://support.microsoft.com/kb/555912/en-us

Susan Bradley: Vista slow after SP2 installed?
http://msmvps.com/blogs/bradley/arch...installed.aspx

You experience intermittent communication failure between computers that are
running Windows XP or Windows Server 2003
http://support.microsoft.com/?id=904946

Common Networking Issues After Applying Windows Server 2003 SP2 on SBS:
http://blogs.technet.com/sbs/archive...p2-on-sbs.aspx
==================================================================================================== ==

Ace

Unfortunately, I performed those steps (using netsh method) when I made the
changes to remove IP V6.
Is there any monitoring I can do when this happens to pinpoint the problem?
I have so far run the built in Active Directory Diagnostics, and LAN
diagnostics. Both seem to report normal operation, however, the AD report
includes more information than I can interpret.
The only things of interest in the event logs are informational items under
the system logs. I do have a fair number of Event 7036 messages where the
Windows Modules Installer service enters the stopped state and then starts
and stops again. I also get some for the DPMRA service.


"Ace Fekay [Microsoft Certified Trainer]" wrote:

> "cjhaugen" <cjhaugen@discussions.microsoft.com> wrote in message
> news:F975BE34-6100-442C-8878-C758CA8D7768@microsoft.com...
> > I'm sorry to say we had another incident this morning.
> > It manifests itself a little differently every time, always with the same
> > result as client computers become unresponsive, file shares stop working
> > (at
> > different times for different people.) It seems to take 40 minutes to an
> > hour between when I first hear of an issue from someone to it hitting
> > everyone equally. This time when people tried to open Word files on the
> > network they got a "Downloading file..." message and the file would never
> > open. I've never seen it just impact a particular file type before.
> > Eventually it impacted everything.
> >
> > Any other things you would suggest checking?
> >
>
> Hmm, unfortunate to hear.
>
> See if the following about the TCP Chimney may be the cause.
> ==================================================================================================== ==
> Slow file transfer and connectivity with Windows 2003 SP2, Windows 2008, SBS
> 2003 SP2 and SBS 2008, and Vista
> System Error 64
> System Error 53
> Shares disconnect after a server has been running for a period of time such
> as a couple of weeks and a restart fixes it temporarily.
>
>
> This may be due to the new RSS TCP Chimney Offload feature enabled on 2003
> SP2 and newer servers.
>
> TCP Chimney Offload overview:
>
> TCP Chimney Offload is a networking technology that helps transfer the
> workload from the CPU to a network adapter during network data transfer. In
> Windows Server 2008, TCP Chimney Offload enables the Windows networking
> subsystem to offload the processing of a TCP/IP connection to a network
> adapter that includes special support for TCP/IP offload processing.
>
> TCP Chimney Offload is available in all versions of Windows Server 2008 and
> Windows Vista. Both TCP/IPv4 connections and TCP/IPv6 connections can be
> offloaded if the network adapter supports this feature.
>
> Two ways to handle it.
> 1. Disable RSS using the netsh command (preferred)
> 2. Disable RSS in the registry
>
> 1. Disable RSS using the netsh command:
> (From http://support.microsoft.com/kb/951037)
>
> netsh interface tcp set global rss=disabled
> netsh interface tcp set global autotuninglevel=disabled
> Reboot the server
>
> 2. Disable RSS in the Registry
> (From http://support.microsoft.com/kb/927695):
>
> Add a DWORD registry key value for
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableRSS
> and setting it to 0. A reboot is required to make the value go in to
> effect.
> Set DisableTaskOffload in the Registry
> Use the steps in KB 904946 to create a DWORD value for
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableTaskOffload
> and set it to 1.
> A reboot is required to make this value go in to effect.
>
>
> More info on the subject...
>
> Information about the TCP Chimney Offload, Receive Side Scaling, and Network
> Direct Memory Access features in Windows Server 2008
> http://support.microsoft.com/kb/951037
>
> You cannot host TCP connections when Receive Side Scaling is enabled in
> Windows Server 2003 with Service Pack 2
> http://support.microsoft.com/?id=927695
>
> Vista slow after SP2 installed on Windows 2003 Server (SBS or non-SBS) or
> using Windows 2008?
> http://msmvps.com/blogs/bradley/arch...installed.aspx
>
> Windows 2003 service pack 2 known issues on Small Business Server 2003
> http://support.microsoft.com/kb/555912/en-us
>
> Susan Bradley: Vista slow after SP2 installed?
> http://msmvps.com/blogs/bradley/arch...installed.aspx
>
> You experience intermittent communication failure between computers that are
> running Windows XP or Windows Server 2003
> http://support.microsoft.com/?id=904946
>
> Common Networking Issues After Applying Windows Server 2003 SP2 on SBS:
> http://blogs.technet.com/sbs/archive...p2-on-sbs.aspx
> ==================================================================================================== ==
>
> Ace
>
>
>

Inline below...

"cjhaugen" <cjhaugen@discussions.microsoft.com> wrote in message
news:846980D4-C34B-4E93-8579-7F0A8857A9DC@microsoft.com...
> Unfortunately, I performed those steps (using netsh method) when I made
> the
> changes to remove IP V6.


The steps I posted about were to disable the TCP Chimney feature. It is
different than IPv6. So I am not sure what you're saying here. Did you
disable the RSS TCP Chimney feature, too?


> Is there any monitoring I can do when this happens to pinpoint the
> problem?

You can use Process Explorer, but it is a pretty heavy log. You have to
literally watch the machine, and when it happens, to take note of the time,
then go through the logs and look at that time. You may fine 10's or 100's
of things going on at that point in time, depending on what you or the
machine was doing at that time. IITC, you will see red sections for errors.
It could be helpful.

> I have so far run the built in Active Directory Diagnostics, and LAN
> diagnostics. Both seem to report normal operation, however, the AD report
> includes more information than I can interpret.

If you see any errors or failures in the log, please post them.

> The only things of interest in the event logs are informational items
> under
> the system logs. I do have a fair number of Event 7036 messages where the
> Windows Modules Installer service enters the stopped state and then starts
> and stops again. I also get some for the DPMRA service.
>

Check the following links on the DPMRA service. The bottom suggests to call
Microsoft concerning this, but read through them to see which one will help
you.

DPMRA service terminated with service-specific error 4
http://www.nntpnews.net/f3577/dpmra-...4-0x4-2963761/

Ctrl P - The Data Protection Manager Blog! : Known Issues and ...Jul 11,
2008 ... Make sure that DPMRA service hasn't crashed on Primary DPM server
or production server while adding secondary protection through Secondary ...
http://blogs.technet.com/.../known-i...-recovery.aspx

The DPM protection agent service cannot start in System Center ...... 7024
is logged in the System log on protected servers. You also receive a "The
DPMRA service terminated with service-specific error 10048 (0x2740)" error.
http://support.microsoft.com/kb/947682


Ace

Just an update on this issue. I found this thread which matches my issues
very closely.
http://www.symantec.com/connect/foru...08-file-shares

I think the problem is with the Symantec Endpoint Protection 11 I have
installed. I've since uninstalled it and will monitor for another couple of
weeks. I'm pretty certain that the issue was caused by Symantec based on
what others have seen. Thanks so much for you help, I'll report back if I
continue to see any additional problems.

"Ace Fekay [Microsoft Certified Trainer]" wrote:

> Inline below...
>
> "cjhaugen" <cjhaugen@discussions.microsoft.com> wrote in message
> news:846980D4-C34B-4E93-8579-7F0A8857A9DC@microsoft.com...
> > Unfortunately, I performed those steps (using netsh method) when I made
> > the
> > changes to remove IP V6.
>
>
> The steps I posted about were to disable the TCP Chimney feature. It is
> different than IPv6. So I am not sure what you're saying here. Did you
> disable the RSS TCP Chimney feature, too?
>
>
> > Is there any monitoring I can do when this happens to pinpoint the
> > problem?
>
> You can use Process Explorer, but it is a pretty heavy log. You have to
> literally watch the machine, and when it happens, to take note of the time,
> then go through the logs and look at that time. You may fine 10's or 100's
> of things going on at that point in time, depending on what you or the
> machine was doing at that time. IITC, you will see red sections for errors.
> It could be helpful.
>
> > I have so far run the built in Active Directory Diagnostics, and LAN
> > diagnostics. Both seem to report normal operation, however, the AD report
> > includes more information than I can interpret.
>
> If you see any errors or failures in the log, please post them.
>
> > The only things of interest in the event logs are informational items
> > under
> > the system logs. I do have a fair number of Event 7036 messages where the
> > Windows Modules Installer service enters the stopped state and then starts
> > and stops again. I also get some for the DPMRA service.
> >
>
> Check the following links on the DPMRA service. The bottom suggests to call
> Microsoft concerning this, but read through them to see which one will help
> you.
>
> DPMRA service terminated with service-specific error 4
> http://www.nntpnews.net/f3577/dpmra-...4-0x4-2963761/
>
> Ctrl P - The Data Protection Manager Blog! : Known Issues and ...Jul 11,
> 2008 ... Make sure that DPMRA service hasn't crashed on Primary DPM server
> or production server while adding secondary protection through Secondary ...
> http://blogs.technet.com/.../known-i...-recovery.aspx
>
> The DPM protection agent service cannot start in System Center ...... 7024
> is logged in the System log on protected servers. You also receive a "The
> DPMRA service terminated with service-specific error 10048 (0x2740)" error.
> http://support.microsoft.com/kb/947682
>
>
> Ace
>
>
>

"cjhaugen" <cjhaugen@discussions.microsoft.com> wrote in message news:D371EBD8-7DF9-445E-9ECE-68ED85E50340@microsoft.com...
> Just an update on this issue. I found this thread which matches my issues
> very closely.
> http://www.symantec.com/connect/foru...08-file-shares
>
> I think the problem is with the Symantec Endpoint Protection 11 I have
> installed. I've since uninstalled it and will monitor for another couple of
> weeks. I'm pretty certain that the issue was caused by Symantec based on
> what others have seen. Thanks so much for you help, I'll report back if I
> continue to see any additional problems.

Thank you for updating us on the issue. Coicidentally, I found a similar issue awhile back with CA's antivirus, causing a similar thing. I'm glad you found that link and got a handle on what's going on.

Ace