Vista clients became unresponsive after network move

Hi,

I have been having this weird issue that I cannot isolate and I was
hoping someone can guess what's going on.

We recently moved our offices to a new location. Half of the computers
(Vista & XP clients) moved on day one, and worked without the domain
controller (2003) for a day. On the next day, the rest of the clients
and the domain controller have been moved to the new location. The
computers detected a new network, so not everything worked out of the
box after the move: some firewall and sharing settings were reset
since they have a new network connection. There were no hardware or
software changes on the computers (auto-updates were turned off) The
only difference between the old office network and the new one are the
cabling in the walls, and the Ethernet switch (old one: Siemens +
Netgear, new one: Cisco SR224)

Since the move, Vista clients seems to be acting strange in the
mornings when they were left on overnight:
- User cannot open any new programs or task manager. Currently open
programs run OK
- CTRL+ALT+DEL brings a black screen, and then shows this error:
"Logon Process has failed to create the security options dialog. "
with a dialog box "Failure - Security Options"
- Command prompt can be opened. Some commands work (ipconfig,
shutdown) some don't (ipconfig /all)
- I can ping the unresponsive Vista client on the LAN, and I can
remotely shutdown/restart it although it waits at that black screen
for few minutes before it starts to shutdown
- Event logs do not show any specific error before the clients become
unresponsive

Since I did not change any software/hardware on the machines, I have
reason to believe that this is a network issue. I searched online for
the error message I wrote above, but none of them helped so far (and
only few of them were related to network).

Has anybody had similar issues, or can anybody guess what the issue
could be?

Our current network:
----T1-router-----Linksys-with-DD-WRT------Cisco-SR224-switch-------DC-
and-clients--

Thank you,

Deniz

Have you also changed the ip addressing? Did you make sure all machines use
the correct addresses and subnet masks? Can you post an unedited ipconfig
/all from the DC/DNS and a problem machine?

Are all machines correct registered in the DNS zones?

Only our public IP (WAN IP on the router) has changed. All other IPs
are static assigned IPs in 192.168.x.x range.

One DNS issue that was pointed out in another discussion was about the
security settings on the host records. For example, host record for
COMPUTER-A did not have full control permissions for the user COMPUTER-
A$. Granting full control to the record owner did not solve this
problem, however.

Here is the technical data you requested, I hope it's helpful:

DC> ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : global
Primary Dns Suffix . . . . . . . : Global.local
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : Global.local

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Linksys LNE100TX Fast Ethernet
Adapter(LNE100TX v4)
Physical Address. . . . . . . . . : 00-12-17-51-56-44
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.1.100
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.1.100

Vista Business 1> ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : MOSCOW
Primary Dns Suffix . . . . . . . : Global.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : Global.local

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 PL Network
Connection
Physical Address. . . . . . . . . : 00-22-68-04-48-EB
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::6806:4594:ed33:a0c6%11
(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.124(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.1.100
NetBIOS over Tcpip. . . . . . . . : Enabled

Wireless LAN adapter Wireless Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Atheros AR5007EG Wireless
Network Adapter
Physical Address. . . . . . . . . : 00-23-4D-97-FA-28
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 6:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{69493646-
EEA0-47F4-8D03-6FB084D382D0}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 7:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{0ED3926F-DCC3-4875-
B522-0F8FA7753E0B}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes


I can see the Host (A) record in DNS for the computer MOSCOW, and it
points to 192.168.1.124 as also described in the IPconfig above.

The ipconfig output look fine on both machines. What you can try on the Vista
machine is to uncheck IPv6 on the NIC, to see if this helps.

Any errors in the event viewer? Strange that it comes only over night, after
a reboot then everything is ok again?

In the event viewer first I saw errors like "GroupPolicy" or "DNSApi"
which suggested network connection problems. After fiddling around a
little bit those errors are not showing anymore. But the problem
remains. Another event that is always logged is Tcpip warning 4227,
which seems to happen little more often since we moved.

Computers appear to be running fine, until I do the Task Manager test,
or ipconfig /all test, none of which respond if the computer is having
the problem I described. If so, I immediately restart from the command
line. Then it runs fine throughout the day. Some computers even run
couple of days before they hit by this issue.

I will disable the IPv6 today to see if that helps. I will post an
update tomorrow.

If DNSApi was event id 11166, this can belong to a DNS record update problem.
Check the security permisssions on the forward/reverse lookup zone entry
of the machine, if an unknown SID is used add the computername to the list
and give it the same permissions as the unknown account, then remove the
unknown one.

Group policy is to global , the complete error would be better to see what's
going on.

My Reverse Lookup Zones section is empty. Am I supposed to put any
records here?
In Forward Lookup Zones, I have (A) records for each station under
Global.local. User COMPUTER$ has enough permissions for the record
COMPUTER. There is nothing recent in the DNS events.

I checked the events for the computer in question this morning.
Starting from yesterday afternoon, it recorded GroupPolicy event 1058
every hour. I don't know what caused it, there are no errors before
it, and the only logged warning was TCPIP 4227 hours before the GP
error. I also remember entering GPUPDATE command on that computer
yesterday and getting the same error as the event log:

The processing of Group Policy failed. Windows attempted to read the
file \\Global.local\sysvol\Global.local\Policies
\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain
controller and was not successful. Group Policy settings may not be
applied until this event is resolved. This issue may be transient and
could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain
controller.
b) File Replication Service Latency (a file created on another domain
controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.

After a restart this morning, computer seems to be working fine.
GPUPDATE runs OK as well.

If the configured reverse lookup zone is empty you have to check the "create
associated pointer" record in the record properties in the forward lookup
one.

For 1058 are many options available, google for 'event id 1058 Windows attempted
to read'. Also make sure the server is installed with latest SP and patches.

Do you have only one DC or more?

Check this for event id 1058 also:
http://support.microsoft.com/default...b;EN-US;887303

There is and there has been only one DC. No substitution/upgrade of DC
ever occurred.

I went into one of the Host (A) records, and checked the box "Update
associated pointer (PTR) record". It gave me an error saying that
there are no reverse lookup zones defined. I went ahead and defined
one.

One thing I haven't tried yet is to rejoin to the domain.

If you look at your zone global.local, what do you see in regards of
the "(same as parent)" record? There should only be one record,
pointing to the DC, 192.168.1.100. Same with the 'moscow' A record in
the zone.

Also, look in the _gc_msdcs.global.local zone. Do you see a reference
to the DC? That's your Global Catalog entry.

In the reverse zone, which I believe you just created, make sure
Updates are allowed on the zone.

Also curious, do you have any services disabled on the DC, such as the
DHCP Client Service? Despite its name, that's actually a required
service on all machines, since it is the DNS registration and client
side resolver service.

There are 3 "Same as Parent" records: one of each A, NS, SOA. I found
a second NS record which had the IP of 127.0.0.1 but I got rid of that
one. There is one "Same as Parent" A record, AND another A record
named after DC (GLOBAL) both of which are pointing to 192.168.1.100
Moscow A record in the zone has only one IP and that is the IPv4
address of that particular Vista station.
Under _msdcs.Global.local there are NS, SOA, and CNAME records. There
is also gc in there which contains Host (A) Same as Parent pointing to
192.168.1.100

DHCP seems to be working, even though clients do not use it. I see one
scope 192.168.0.0 with one scope option "006 DNS Servers" with the
value 192.168.0.1. I do not use 192.168.0.x addresses anywhere. Should
I change this value?

Yes, you must change the DHCP scope to match your new subnet. You may
have to delete the scope and recreate it.

You will want Scope Options:

003 192.168.1.1 (router or gateway)
006 192.168.1.100 (DNS)
015 global.local (DNS Specific suffix)

If you use WINS, you will want the following options:
044 0x8 (for hybrid)
046 192.168.1.100

I hope that helps.

Really interesting, because of this i never thought/read that he changes
the ip range as i asked before:

"Have you also changed the ip addressing? Did you make sure all machines
use the correct addresses and subnet masks?

Only our public IP (WAN IP on the router) has changed. All other IPs are
static assigned IPs in 192.168.x.x range"

Why not? That's the likely source of your troubles. When you use DHCP you
can make changes centrally and then do nothing more than just reboot the
client machines. When you use static configurations you have to manually
visit each machine to make changes, not a good plan.

From the poster's response, I am assuming the scope was never changed. Then
was mentioned that DHCP wasn't used, which Bill responded to. So it's
somewhat confusing of exactly what the whole setup is. If DHCP is not being
used, and all clients are static and incorrectly configured, I can
understand the problems. As Bill responded, DHCP properly configured will
take care of all the problems, especially if all of this started with an
IP/network change and not everything was taken into account or planned prior
to the move.