Recommended Posts

I own a small business and run Windows Server 2008 R2 and about 7-8 workstations. The problem I've run into recently is odd network behavior on my workstation. For instance, every morning I come in and there's an X through all my shared network drives (not mapped but set in my user profile on the server) when they worked perfectly the previous day. I have to reboot the computer in order to get them back. I also started having an issue where websites would not load until I hit reload in the browser a bunch of times. I solved this one by changing the DNS server addresses on my workstation. I also have developed a problem printing to network printers until a reboot.

Just for information, my server address is 192.168.10.2 and the default gateway is 192.168.10.1. All my workstations have static IP's, for instance my personal workstation is 192.168.10.40

What could possibly have changed to make my network so messed up? I've noticed this behavior on 2 other workstations. Do I need to change some setting on the server in Administrative Tools? I barely ever touch the server so I don't know what could have gone wrong.

Link to comment
https://www.neowin.net/forum/topic/1119406-server-domain-problems/
Share on other sites

Hmm sounds odd, so it has been working in the past without the issues and all of a sudden they've started to happen?

The first thing i'd check tbh is the time on the DC, then look at each machine and ensure the same time is there, as it sounds abit like a credential failure, which can occur if times are out, usually anymore than 5 mins is considered a big chance difference in Active Directory.

Report back your findings, I wouldn't want to say do this and do that if it has worked in the past without any modifications occuring, would make sense for this to happen if you/someone has been playing around.

Yeah all of a sudden. The only change I did do was upgrade AVG Business Edition to the latest version. I just checked the time on the DC and it's exactly the same as my workstation. Your line of think does seem to make sense since this literally happens over night. Is there something I should do to make sure my time is properly synchronized with the DC at all times?

"I solved this one by changing the DNS server addresses on my workstation."

What did you change it too? the ONLY dns that a member of a domain should point to is the AD dns, normally in small setup this is the one DC they have. If you are pointing to your isp, googledns, opendns, etc. on the workstation even if added as secondary then yeah your going to have nothing but grief with your AD.

googledns does not know anything about your AD. Clients need to talk to AD dns, AD dns then forwards to googledns, isp dns, etc. or looks up from roots directly. If you were having issues with looking up websites, this tells me you have something wrong setup in your AD dns.

"I solved this one by changing the DNS server addresses on my workstation."

What did you change it too? the ONLY dns that a member of a domain should point to is the AD dns, normally in small setup this is the one DC they have. If you are pointing to your isp, googledns, opendns, etc. on the workstation even if added as secondary then yeah your going to have nothing but grief with your AD.

googledns does not know anything about your AD. Clients need to talk to AD dns, AD dns then forwards to googledns, isp dns, etc. or looks up from roots directly. If you were having issues with looking up websites, this tells me you have something wrong setup in your AD dns.

The website loading errors got to be so annoying that I changed them to 4.2.2.1 and 4.2.2.2

I know what you're saying and for years I pointed it to the AD DC by using 192.168.10.1. I could change it back but would that have anything to do with these other issues?

Sorry you NEED to point to your AD for dns - maybe there is something wrong with it resolves outside domains slow. FIX IT!!

How do you resolve your AD records if your not usnig its DNS? 4.2.2.2 does not know about it for damn sure.

If your AD is having issues with resolve outside domains - then you Need to FIX that. And yes not pointing to your AD dns could cause all kinds of issues like not being able to auth to stuff, stuff being disconnected, not being able to log in or taking a LONG time to, etc. etc.

Having issue finding the MS article that lists it as one of the top mistakes, but here

http://mcpmag.com/ar...ur-network.aspx

10 DNS Errors That Will Kill Your Network

1. TCP/IP Configuration Points to Public DNS Servers

This is by far the most common DNS error. Each network interface has a set of TCP/IP settings that lists the DNS servers used by that interface.

If the TCP/IP settings for a member computer specify the IP address of a public DNS server?perhaps at an ISP or DNS vendor or the company?s public-facing name server?the TCP/IP resolver won?t find Service Locator (SRV) records that advertise domain controller services, LDAP, Kerberos and Global Catalog. Without these records, a member computer can?t authenticate and get the information it needs to operate in the domain. It then acts like a teenager who can?t get the car keys, growing sullen and exhibiting a variety of bad behaviors.

I pointed my workstation DNS servers to the DC and website loading problems started immediately. When I went back to the ones listed above, everything went back to normal.

I just don't know how there can be any "DNS errors" when my Domain has worked fine for 10 years.

you need to learn active directory and dns....

cliffs:

dns....setup forwarders in your ad dns to your dns servers that are not having issues. uncheck use root hints if no forwarders are available.

clients use the ad dns server for all lookups. also the ad server points to its ip in tcpip properties, not the loop back.

post-118098-0-15402700-1352921254.jpg

"I just don't know how there can be any "DNS errors" when my Domain has worked fine for 10 years."

Well where are you forwarding your non authoritative zone lookups too on your AD dns? As sc302 points out on your AD dns you can have it either use root hints or your isp dns or some other dns server.

FACT!!! - All members of AD NEED!!! and Require to ONLY use your AD for dns, if they point or have multiple entries to other outside dns, then your going to have issues with your AD, plain simple FACT!! The only dns that knows anything about your AD is your AD dns, googledns sure and the hell does not have your srv records, nor does 4.2.2.2, etc. So if you ask them for stuff about your AD, your going to get back nxdomain. This is going to cause you NOTHING but pain!!!

Point your clients to your AD dns, and then work out why your AD dns can not resolve google.com, neowin.net, etc.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Google Chrome is killing all uBlock Origin bypasses, Microsoft Edge, Opera to follow by Sayan Sen For a while now the transition away from Manifest V2 (MV2) to MV3 has been on-going and it looks like it is entering its final phase of deprecation, at least, in the case of Google Chrome. A recent discussion thread in the w3c WebExtensions Community Group GitHub repo has highlighted how the latest and upcoming versions of the most popular browser are expected to be its final releases with support for MV2 extensions. Chromium contributor Andrey Bershanskiy shared details about recent Chromium changes and according to comments from Google engineer Devlin Cronin, Chrome has now started removing the flags that previously controlled MV2 availability. kExtensionManifestV2Disabled, the Chromium feature flag that allowed controlled disabling of MV2 add-ons, is now completely removed, which means you will likely no longer find uBlock Origin in your browser extensions list. He wrote: "The kExtensionManifestV2Disabled feature has been default-enabled for over a year. Remove the feature and the effectively-dead code. ... Any tests that relied on being in the "warning" phase (i.e., with the kExtensionManifestV2Disabled) for their sole behavior testing are removed, since this stage is no longer reachable." Cronin further explained why MV2 extensions are no longer allowed in supported Chrome versions as maintaining the associated functionality indefinitely is no longer possible. He cited growing technical difficulties and implementation complexities as well as security concerns. He wrote: "MV2 extensions are no longer allowed in any supported version of Chrome, and we are removing support for them and the associated functionality. We won't be able to provide / maintain this functionality indefinitely due to the complexity and tech debt, as well as the security risks it entails (we've actually found a number of bugs that are specific to MV2 lately). Of course, other browsers can continue supporting these if they so desire. Unfortunately, we won't be putting code behind a compilation flag ... We won't be removing all the MV2 code wholesale right away, so many of these things will continue working for awhile (but they will go away eventually, and some may go away sooner than others)." What this essentially means is that the tricks and bypasses that were used to keep MV2 extensions like uBlock Origin and others alive will not work any more on Chrome, or at least not for very long. For example the Windows Registry mod that could extend MV2 availability will cease to function after Chromium version 151. Here is a rundown of the changes coming in the final such releases of Chromium releases: Chromium 150 lost ExtensionManifestV2Disabled option Chromium 151 will loose ExtensionManifestV2Unsupported option Chromium 151 will loose ExtensionManifestV2Availability option Chromium 151 will likely loose AllowLegacyMV2Extensions option Other Chromium-based browsers like Opera and Microsoft Edge could soon follow suit too. Although it is not specified, Edge began disabling uBlock Origin back in February, and Opera could also stop the functioning of MV2 add-ons, even though it had committed to support MV2 for longer in October 2024. uBlock Origin developer Raymond Hill (gorhill) apparently stated the following: "For Opera I did submit 1.70.0 rather late, but this was weeks ago. A while ago I received an email from Opera that they plan to abandon MV2-based extension so maybe they are no longer allocating resources for reviewing such extensions." The email which developers like Gorhill mentions was received from Opera last year. Here is what it seemingly said: Hence for now the only Chromium browser that seems to be on-board fully with MV2 support is Brave, and perhaps Vivaldi as well. Meanwhile if you want to ditch Chromium browsers entirely then Mozilla Firefox is an excellent alternative as MV3 and MV2 are both supported. Of course the easiest solution is to switch to uBlock Origin Lite if you want to remain on Chrome, as it is MV3-based, but from our experience, uBO Lite does not seem to be as good as the original non-Lite version. Source: w3C (GitHub repo) As an online publication, Neowin too relies on ads for operating costs and, if you use an ad blocker, we'd appreciate being whitelisted. In addition, we have an ad-free subscription for $28 a year, which is another way to show support!
    • Write to your MP 😄 Like believing in Santa. Total surveillance IS the goal. Wake up.
    • This whole dumb age verification thing needs to die and be replaced by giving parents tools to control devices. Why am I required to plaster my ID all over the internet to prove I'm old enough when parents should be the ones dictating what their kids are doing on their phones. Apple released great set of tools for iPhones coming to iOS 27 that do just that. Why are governments not mandating that kind of control to phone makers to built them into phones. This whole thing is so absolutely idiotic it's wild.
    • Remeber this decade, when the free internet died... tell your grand kids about this, record there reaction and post it on InstaTwitBook.com
  • Recent Achievements

    • Very Popular
      Captain_Eric earned a badge
      Very Popular
    • One Month Later
      amusc earned a badge
      One Month Later
    • One Month Later
      DJC50PLUS earned a badge
      One Month Later
    • Week One Done
      DJC50PLUS earned a badge
      Week One Done
    • Proficient
      Eric Biran went up a rank
      Proficient
  • Popular Contributors

    1. 1
      +primortal
      511
    2. 2
      PsYcHoKiLLa
      220
    3. 3
      ATLien_0
      92
    4. 4
      +Edouard
      90
    5. 5
      Steven P.
      83
  • Tell a friend

    Love Neowin? Tell a friend!