Solved Windows 7 not connecting to W2003SR2 Shares but allowing login

[DAXQ]

We have an older network set up with a Windows 2003 SR2 AD Domain Controller. There is another AD Controller at another facility (this would have been the PDC back in the day) with this one here on another subnet being a backup and allowing users at the remote facility to participate in the domain.

We ended up having to Add window 7 64 workstations to this domain as an application required it. Adding the computer to the domain was never an issue, just went through the steps and addded them Start > Computer > Properties > Change setting and then added the workstation with the Administrators username and password for the domain.

Everything was working fine till about two days ago, and now all the Windows 7 PCs are not connecting to shares. The login script is supposed to map out drives for the user, it maps drives to the other DC in the other facility (via VPN through the Internet) but when it tries to map the drives for the DC right here in its own subnet, it just times out and says it was unable to find the host.

If I try and ping the DC in the same subnet, all pings fail.
If I try and do a DIR listing to the ip: dir \\192.168.1.10\share the network path was not found.

I can ping other computers in the subnet, just not that DC.

For the computer that started experiencing this, I had to restore to an earlier point and then thinks "kind" of work - but not 100% they still are not able to access shares (like their home folder which slows everything down) or other folders that should be mapped out for them. It is very frustrating but I am almost to the point of just dumping the domain entirely and having the users just work off a Workgroup in this remote facility.

I don't think I should have to upgrade my server to windows 2008 or 2012 just to connect a Windows 7 pro computer to it, but it is kind of feeling that way. I have a gut feeling that is has something to do with security settings, but I dont get that either - the user can Log into the Domain, connect to other share at the other facility, just not shares on this DC. Is there some way to have the Main DC at the other facility refresh the security on this remote one? Any suggestions or help with this matter is greatly appreciated. Thanks in advance

 

[DAXQ]

Well this has got me completely buggered. I am sure there is some thing wrong with the security between the W7 PC/s and this AD DC. There are also some other weird network things going on so for this PC, I am restoring it to factory defaults and seeing what effect that will have on the issue.

Still does not fix my 4 other W7 PC's that are sitting in the same boat and starting to experience the same issues, so if anyone has any info about these matter(s) or even remotely has some things I can check out I would really appreciate it.

Oh and if there is any more information I can provide that may help, please let me know what you need provided and I will provided it.

 

[chev65]

Have you tried working with the lanman server perimeters in the GPO of the Windows 7 machines? In order for Windows 7 to work with older servers you usually need to adjust the lanman server security settings.

I can't figure out why it would work for two days then just stop working.

The following settings may work.

Control Panel - Administrative Tools - Local Security Policy

Local Policies - Security Options

Network security: LAN Manager authentication level
Set to Send LM & NTLM responses only

Set the Minimum session security for NTLM SSP
Disable Require 128-bit encryption

 

[DAXQ]

I will certainly give those a shot for the other W7 PC's. This one PC has gotten even deeper now! This whole mess originally started because this user could not print to his printer. (Its a network printer - straight to IP - I can ping it no problem with my Linux Toughbook). And while I was trying to update its driver, I ran into these other issues with the Network and learned that these users have been experiencing the in-ability to connect to the network shares (most did not really even notice the issues).

Any way after dinking around with things for most of the morning, as I stated earlier, I was just going to factory restore this pc and see where that got me (setting the other Domain/Network issues aside for the time being). After wiping the drive and completely reinstalling back to factory, I ping the gateway - no problem. Ping the printer to begin setting it up Request Time out (all the while I am still pinging it from my laptop)!

So even after rebuilding this users PC back to factory, I still cannot ping the printer. Just testing, it looks like all I can ping from this @#(@#&*@)) computer is the gateway! WTFGives!

 

[DAXQ]

It dont mean a think if it aint got that ping

This is truly about to drive me knockers. It looks like - sometimes, intermittently - if I run the command prompt as administrator, I can ping. Have disabled the Windows Firewall (disabled the service) - why on earth would a com test like ping need to be run as admin?

 

[DAXQ]

Ok! So after my meltdown yesterday, apparently I have stumbled onto a pretty common thing with w7 and its weird networking. We still have quite a few Xp computers running that just don't have issues. Well ok let's be honest - they all have issues. I have just been not experiencing w7 as we have not needed to. My biggest dread is that I do have other w7 PC's spread out throughout the network and have a real gut feeling about see more of this. I just cannot seem to get why the basic networking tools like ping needed to be messed with - I was seriously getting ready to call the mfg fearing nic issues.

So I still have my share issue, and now there is the ping issues - are there any tricks to making windows 7 networking act like it normally should.

 

[chev65]

Ok! So after my meltdown yesterday, apparently I have stumbled onto a pretty common thing with w7 and its weird networking. We still have quite a few Xp computers running that just don't have issues. Well ok let's be honest - they all have issues. I have just been not experiencing w7 as we have not needed to. My biggest dread is that I do have other w7 PC's spread out throughout the network and have a real gut feeling about see more of this. I just cannot seem to get why the basic networking tools like ping needed to be messed with - I was seriously getting ready to call the mfg fearing nic issues.

So I still have my share issue, and now there is the ping issues - are there any tricks to making windows 7 networking act like it normally should.

You might try the following registry adjustment.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\size
Your choices for this registry key are 1,2 and 3.
1 = Minimize Memory Used
2 = Balance
3 = Maximize Throughput for File Sharing and Maximize Throughput for Network Applications

Be sure to set this to (3). By default it is configured to 1.

windows 7 stops sharing files
System error 64 - the specified network name is no longer available

 

[DAXQ]

Will give it a whirl! Just out of curiosity am I alone in thinking this is really kinda goofy? How in a windows 2003 domain it is easier for me to get my Ubuntu laptop talking to the domain server and other devices on the LAN than windows 7?

 

[chev65]

Will give it a whirl! Just out of curiosity am I alone in thinking this is really kinda goofy? How in a windows 2003 domain it is easier for me to get my Ubuntu laptop talking to the domain server and other devices on the LAN than windows 7?

I can't figure out why Microsoft set things up this way but between the endless security settings and the lame power saving features it seems that Microsoft has shot itself in the foot because I see similar complaints all the time.

 

[DAXQ]

When you get to the point that you need to let everyone be an administrator to get things done, have you really changed or fixed anything?

 

[DAXQ]

I was able to mess with things a bit more today and if I run a command prompt as admin and issue ping -4 ipaddress it works. If I run normal ping ipaddress I will get no reply (request time out) or some times 1 reply then time out. Actually I take that back. That worked for a few seconds but while I was typing this up it stopped working. Now neither ping works. Well maybe 1 reply then timed out. This is really inconvenient and driving me batty - I think my rectification is going to be to remove the dc server down here and run stand alone pc's and use this office to test out migration from exchange to gmail for domains!

 

[DAXQ]

Well I think this turned out to be my router assigning the wrong MAC address to the nic card.

 

[chev65]

Well I think this turned out to be my router assigning the wrong MAC address to the nic card.

The router should be picking up the MAC address from the NIC, not assigning it an incorrect one.

 

[DAXQ]

Agreed - just wasn't sure if it was a bad nic or the router doing something weird, but if I take the router off the switch things work - if I add it back - intermittently I will see Mac addresses getting assigned the router mac address rather than the printer MAC address as it should. This has definitely been an experience.

 

[Khestra]

For fun, try this:

Try changing these settings in Control Panel>Administrator Tools>Local Security Policy:

* Computer Configuration\Windows Settings\Security Settings\Local Policies\Security
Microsoft network client: Digitally sign communications (always): Disabled

* Computer Configuration\Windows Settings\Security Settings\Local Policies\Security
Network security: LAN Manager authentication level: Send LM & NTLM - use NTLMv2 session security if negotiated

Restart the system after making changes.

 

[chev65]

For fun, try this:

Try changing these settings in Control Panel>Administrator Tools>Local Security Policy:

* Computer Configuration\Windows Settings\Security Settings\Local Policies\Security
Microsoft network client: Digitally sign communications (always): Disabled

* Computer Configuration\Windows Settings\Security Settings\Local Policies\Security
Network security: LAN Manager authentication level: Send LM & NTLM - use NTLMv2 session security if negotiated

Restart the system after making changes.

I have already posted nearly the same thing on the first page of this thread, there is no need to keep repeating it for problems that can't be fixed with these adjustments.

http://www.sevenforums.com/network-sharing/260203-windows-7-problem-samba-shares.html#post2150563

http://www.sevenforums.com/network-...-shares-but-allowing-login-2.html#post2150594

http://www.sevenforums.com/network-sharing/213413-d-link-dns-320-mapping-issue.html#post2150580

 

[DAXQ]

My demon was Arp Proxy running on a new Cisco ASA router I installed. Apparently it was handing out its own address for things like my Printer and the AD controller in the LAN - don't care what kind of proxy it is, it never should have done that for something on the same LAN as itself on the inside. Very annoying and hard (for me anyway) to track down.

 

[chev65]

My demon was Arp Proxy running on a new Cisco ASA router I installed. Apparently it was handing out its own address for things like my Printer and the AD controller in the LAN - don't care what kind of proxy it is, it never should have done that for something on the same LAN as itself on the inside. Very annoying and hard (for me anyway) to track down.

It sounds like it was shoving it's own MAC address in other hardware as it forwards requests. It looks like it's made to forward requests between two different subnets. It should have only been using router proxy when sending requests between the two subnets.

Course I never realized that this ARP was enabled on this router. Is it part of the firmware or is it an add on?

Maybe because it was MAC spoofing "Router Proxying" all requests, Windows security might have blocked it from forwarding those packets. The part in bold below might explain it.

After reading about Arp Proxy at Wiki it says that it's designed to hand out it's own MAC address. Apparently it offers its own MAC address in reply, effectively saying, "send it to me, and I'll get it to where it needs to go."

Just in case anyone else reading this wonders what ARP does.

Advantages
The advantage of Proxy ARP over other networking schemes is simplicity. A network can be extended using this technique without the knowledge of the upstream router.
For example, suppose a host, say A, wants to contact another host B, where B is on a different subnet/broadcast domain than A. For this, host A will send an ARP request with a Destination IP address of B in its ARP packet. The multi-homed router which is connected to both the subnets, responds to host A's request with its MAC address instead of host B's actual MAC address, thus proxying for host B. In the due course of time, when host A sends a packet to the router which is actually destined to host B, the router just forwards the packet to host B. The communication between host A and B is totally unaware of the router proxying for each other.

Disadvantages
Disadvantage of Proxy ARP include scalability (ARP resolution is required for every device routed in this manner) and reliability (no fallback mechanism is present, and masquerading can be confusing in some environments). ARP manipulation techniques, however, are the basis for protocols providing redundancy on broadcast networks (e.g., Ethernet), most notably CARP and Virtual Router Redundancy Protocol.
Proxy ARP can create DoS attacks on networks if misconfigured. For example a misconfigured router with proxy ARP has the ability to receive packets destined for other hosts (as it gives its own MAC address in response to ARP requests for other hosts/routers), but may not have the ability to correctly forward these packets on to their final destination, thus black holing the traffic.

Source: http://en.wikipedia.org/wiki/Proxy_ARP

 

[DAXQ]

It supposedly will help an improperly configured network, (like if the mask was off or something) still work. In my case it did not - it just broke things, and drove me up the wall trying find what was doing it.

 

[chev65]

It supposedly will help an improperly configured network, (like if the mask was off or something) still work. In my case it did not - it just broke things, and drove me up the wall trying find what was doing it.

Was it part of the routers firmware or some type of add on?