Windows XP clients lose connection to shares on 2008 server

[boe]

Hello,

We have a single server environment running Exchange 2008. All the clients
are running XP. They'll login and the login script batch file assigns all
the drive mappings. They'll work for a week or so and then suddenly no
one can access their shared drives. They have a few drives mapped to
different volumes and none of them are accessible. They can still ping the
server by name or by IP and they get a response. However, they can't even
manually map a drive to the shares - even the hidden shares and they can't
get to the sysvol from the clients. It isn't happening at a regular
frequency - but about 1 to 3 weeks or so it will happen. I can remote
desktop to the server - no issue when this is happening. There is nothing
in the event viewer at the time the issue occcurs. If I reboot the server
everything returns to normal.

I thought it was symantec so I completely uninstalled using cleanswipe -
nothing at all remains and it still happens.

[Meinolf Weber [MVP-DS]]

Hello boe,

If the machines are up and running that long time, do you use some power
saving settings for the NIC? This can result in loss of some network connections
when the NIC wakes up again.

[Dallas Kirby]

I'm having a similar issue. We are running Windows Server 2003 x86. It
doesn't happen all the time, but every now and then, all our shares and
printers are not accessable - but we can ping the server. I can't browse the
server (START - RUN - \\file_server\) and I can't remote desktop into it
either. When I RDP I get the login prompt but when I click OK, I get a blank
screen and nothing else. I also have remote console via Dell PowerEdge 1950
DRAC and same thing on that too. The only way to fix this is to power cycle
the server. There is nothing in the Event Viewer that would indicate any
kind of problem. We are running 2003 R2 w/ SP2. I'm going to try to update
the NIC drivers/ firmware, but any other thoughts? It is not going offline
due to power settings and I have another file and print server that I built
at the same time and it is not having any of these issues.

[boe]

Thanks - it is set for default on the server - all the workstations lose
their connections - not just one or two - all at the exact same time -
always during work hours. Can you tell me what you think I should check?

[boe]

The lack of anything in the event viewer is very frustrating for me.

Just a thought - I seem to recall something similar when there was a pending
restart for some automatically applied Microsoft updates on a server - the
server became unresponsive until it was restarted.

It is perfectly useless to know the right answer to the wrong question.

I'm not going to dismiss it but since we schedule updates for 3 AM and it
just stops working mid day - I'm guessing it is something else.

[Alan Morris [MSFT]]

It sound like the server service or redirector can not get any more
resources (due to the nonpaged pool exhausted) but normally there would be
warnings in the system eventlog.

You can check if the server service is wedged by TSing into the system and
taking the directory of a remote machine


This also may be a deadlock in lsass. I'd try this hotfix first

http://support.microsoft.com/kb/948790
Services or processes that require authentication may stop responding
because of a deadlock condition in the Lsass.exe process on a Windows Server
2008-based computer or on a Windows Vista Service Pack 1-based computer

I've hit this a clustered print server.

[Scott McFall]

Ok, don't want to scare you but heres 3 possibilities that I would check ...

1 - System drive is low on space
2 - Virus
3 - Server has updated itself and has gone into limbo requesting a restart

1 - Ive found when our server ran low (and I mean low as in 200mb) on space
then services stopped. This is very true on Exchange servers and you will
find Exchange services just stop running. The webmail service being one of
them.

2 - Ive had (and still have to some degree cos it keeps coming back) the
Conficker virus at work and the first serious symptoms of this was that the
Server service stopped and all of the shares vanished. Check that the
Server service is running because if it isnt then you have issues.

3 - Ive had some updates install themselves and for some reason deactivate
certain services which then need restarting.

I would certainly scan the server system drive for viruses as Ive had a few
that muck up certain vital services within windows 2003 / 2008.

[boe]

Thanks -
1 plenty of disk space - the smallest drive - c: - has 50 GB free
2 - Pretty sure there is no virus - I'm the only one with admin rights on
the server who uses windows on it - nothing out of the ordinary in the event
viewer or registry, startup folder etc.
3 - Not sure about the last one - why would it wait until so much later in
the day to go into limbo - updates occur at 3AM.

[boe]

Here is an update - of things I checked - it just hung again



Can not map from workstation by IP \\10.10.50.10\share

Can not map from server by netbios \\10.10.50.10\share

Check if the server can see its own shares - YES

Check if you can see the sysvol from the server - YES

Tape back up is at 10.10.50.15 - just shut down

Check if you can ping the server by name - I think I did this - YES

Check if you can map a drive from the server to its own share - YES

Check if you can browse to shares on a workstation from the server - YES

Check if you map a drive by FQDN - NO

Try stopping and restarting the server service - Hangs on stopping SERVER
SERVICE

Try disabling the firewall on the server - already disabled

Cannot see any shares from workstation using net view - error 53 or 64 (64
using FQDN)

Can see shares from server by net view

Tried having Computer browser turned on

[mppdc]

Did anyone ever figure this out? This is EXACTLY the problem I'm having now. Though we did not start having this problem until we replaced an old Windows 2003 Server with a Windows 2008 Server. This server handles TS and Data. That's it. SBS 2003 R2 handles everything else.

[Meinolf Weber [MVP-DS]]

Hello mppdc,

You are replying to an 90 day or older posting in the microsoft.public.windows.server.general
newsgroup, so the starting is not available. Please create your own posting
with complete error description event viewer errors and OS version including
SP/patch level.