Cannot map network drive from NAS in 2008 R2

[Jason S. Global Moderator]

http://support.microsoft.com/kb/954387

Apologies, meant to post this one first time.

Thanks Guolong, but i've already tried that one a couple times and didnt help

[Jason S. Global Moderator]

If you think it's a group policy issue; then disable them.

http://technet.micro...y/cc730760.aspx

Starting from #7...

i can certainly try this. will this effectively erase all my GP changes or can i enable/disable w/o consequence?

[+BudMan MVC]

So how do you manage this nas - is there some web ui that you access?

is it possible to let me or sc302 teamviewer into this 2k8r2 box and access the nas web ui from this box?

I would be interested in seeing the sniff the traffic when creating the ntml session for the map / access. If you can map access of the other boxes shares to this 2k8r2 box then it clearly is not a issue with the account your using on 2k8 not having permissions to map.

And if you say you can map shares on the nas from a different win 7 box using the same account it really seems odd!!

I don't recall ever seeing a error 58 before, and google for it has been of no help.

I sniff of the traffic while you try and map a share on the nas, and then mapping on share on one of your other boxes might be very helpful in figuring out what is not allowing the access.

edit: I just noticed your using some assistance software from synology -- what happens when you just do normal map? And what about a different share -- are these other machines mapping to this adminfiles share?

about does a simple net view show you?

net view \\kmsnas01

do you get error 53 or access denied error 5? If access denied

then net use \\kmsnas01\ipc$ /u:kmsnas01\admin adminpassword

then

net view \\kmsnas01

again

[c.grz]

i can certainly try this. will this effectively erase all my GP changes or can i enable/disable w/o consequence?

Just disables them until you want to re-enable them.

[Jason S. Global Moderator]

Just disables them until you want to re-enable them.

Just tried this, but it didnt work. I even rebooted just to make sure the 'disable' took effect. Thanks though.

[Jason S. Global Moderator]

So how do you manage this nas - is there some web ui that you access?

is it possible to let me or sc302 teamviewer into this 2k8r2 box and access the nas web ui from this box?

I would be interested in seeing the sniff the traffic when creating the ntml session for the map / access. If you can map access of the other boxes shares to this 2k8r2 box then it clearly is not a issue with the account your using on 2k8 not having permissions to map.

And if you say you can map shares on the nas from a different win 7 box using the same account it really seems odd!!

I don't recall ever seeing a error 58 before, and google for it has been of no help.

I sniff of the traffic while you try and map a share on the nas, and then mapping on share on one of your other boxes might be very helpful in figuring out what is not allowing the access.

edit: I just noticed your using some assistance software from synology -- what happens when you just do normal map? And what about a different share -- are these other machines mapping to this adminfiles share?

The NAS is managed through a web UI. I log in to the UI using the same admin account that i am using to map the network drive. Sure enough, the NAS's log says "CIFS client 'admin' from [computername] accessed the shared folder 'adminfiles'."

sorry - i'd love to have someone remote into the box, but that's against the company's policy.

Just to check again, i logged onto the Server 2003 machine and was able to map the NAS's folder using the same 'admin' account. really strange! i also mapped a drive from the 2008 R2 box to a shared folder on the 2003 box. really strange!

about your edit: when i do a normal map, i get repeatedly prompted for the password, over and over. i get the Error 58 from either the Synology Assistant program, or when i try to map a drive in CMD. Other machines, as said above, are able to map to this same shared folder on the NAS using the exact same 'admin' account.

[Jason S. Global Moderator]

about does a simple net view show you?

net view \\kmsnas01

do you get error 53 or access denied error 5? If access denied

then net use \\kmsnas01\ipc$ /u:kmsnas01\admin adminpassword

then

net view \\kmsnas01

again

when i type "net view \\kmsnas01" i do get the "system error 5 has occured. Access is denied."

When i do the next command you typed, i get the System Error 58.

Next, not knowing what ipc$ is, i changed that w/ the 'adminfiles' shared folder. i then get the same error 58.

[sc302 Veteran]

ipc$ is just a share, any share.

\\kmsnas01\admin would be just fine

net use x: \\kmsnas01\admin /user:kmsnas01\admin adminpass

replace x with whatever drive letter you wish to use that is not currently in use and adminpass with whatever pass.

without really seeing the network traffic, I am not sure exactly how much blind troubleshooting we can do to help here. Obvioulsly there is something wrong, have you looked at your event logs to see if anything registered there?

[Jason S. Global Moderator]

without really seeing the network traffic, I am not sure exactly how much blind troubleshooting we can do to help here. Obvioulsly there is something wrong, have you looked at your event logs to see if anything registered there?

can either of you guide me through the process of sniffing the traffic then? would wireshark suffice? i dont have much experience sniffing network traffic.

[sc302 Veteran]

wireshark would suffice. you could also use capsa free, it is a bit easier to read.

if using a switch you would have to either have a managed switch an enable a spanning, debug or mirror port (depending on the switch will depend on the terminology used) or install a basic hub (this cannot be a switch of any kind) between the server and the nas box and attach a pc to that hub to capture traffic with wireshark or capsa.

You would be interested in the converstation streams between your nas and your server, obviously, but you may see other traffic as well. Do not concentrate on that. This will basically verify that traffic is getting back to the server and we can try to see what/where it is being rejected. For all we know the software firewall in 2008 or uac is blocking you. Hard to see without the whole picture.

[Jason S. Global Moderator]

wireshark would suffice. you could also use capsa free, it is a bit easier to read.

if using a switch you would have to either have a managed switch an enable a spanning, debug or mirror port (depending on the switch will depend on the terminology used) or install a basic hub (this cannot be a switch of any kind) between the server and the nas box and attach a pc to that hub to capture traffic with wireshark or capsa.

You would be interested in the converstation streams between your nas and your server, obviously, but you may see other traffic as well. Do not concentrate on that. This will basically verify that traffic is getting back to the server and we can try to see what/where it is being rejected. For all we know the software firewall in 2008 or uac is blocking you. Hard to see without the whole picture.

i'll see what i can do w/ the sniffing, thanks

also, i disabled the firewalls in 2008 R2. just this morning i disabled UAC and rebooted the machine. didnt help either. :iiam:

[+BudMan MVC]

Since your doing the sniffing on a box directly involved in the traffic you don't have to worry about any switch port spanning or mirroring, etc. That is only required if you were trying to sniff traffic on a box not involved directly in the traffic.

But your 2k8 box is creating the traffic to your nas, so if you run wireshark - or whatever other sniff you want to use directly on the 2k8 box we will see all the traffic we need to see.

Just download wireshark, start a capture -- then do the commands we gave you for net view, net use, etc. Try to auth to the machine with your account from the nas and we should be able to see some useful info on why its failing.. Or maybe nas is saying GREAT you auth just fine and 2k8 is just not working???

I can tell you in the 23+ years I have been working with windows professionally and just as hobby for fun. I remember when we were running windows 3.11 for workgroups, and when install our first 3.51 NT server, etc. And every flavor in between. I can honestly say I do not recall ever seeing error 58.

And I have tried my best googlefu on this and just can not find anything of use about that error. And I can not duplicate it - my 2k8 boxes, both r2 and non, 32 bit, 64 bit, etc. I have never had any issues authing to any other smb/cifs box. Be it my popcorn hour, or samba running on linux, etc. Any issues I have seen have never presented error 58.

So worse case scenario after the sniff we will have more info to work with on what is failing.

The access denied makes sense - understand that, can fix that -- just have not seen 58 before.

edit: BTW, since seems this is not common sense ;) Don't be running any p2p clients or remote desktop sessions, or downloading any large files off the internet, surfing anything - watching a video off your other machine, etc. etc.. While you doing the sniff. Don't have email open, don't be chatting on AIM, etc.. etc.. Close all the other applications you might normally use while your doing the sniff -- if you don't the sniff is going to be LARGE and have lots of stuff we don't need to troubleshoot the problem (noise).

I can send you an example of what it would normally look like doing a connection to a share and authing, etc. Give me a few minutes and will post what the conversation between my 2k8r2 box and one of my other boxes.

[Jason S. Global Moderator]

ok, i ran wireshark on both the 2008 R2 box as well as the 2003 box. the former doesnt work, the latter does work. i'll send the pcap files via PM.

i cant make much sense of these, but what i do know is that the R2 box is having trouble negotiating - it's trying numerous source ports (all over 56,000) as well as other destination ports like 445, 80, 5000.

on the 2003 machine, however, you'll see the same 445 or 80 destination port, but the source port is much lower, 1855.

let me know if this means anything to you guys.

[+BudMan MVC]

Saw your PM, where you could not attache pcap -- replied with my personal email you can send them too.

Source port is going to be random above 1024, this is the case with any tcp connection. It wouldn't be doing any sort of ntlm auth over 80, so that is strange.

looking forward to seeing the traces.

BTW - I started my example yesterday, but got sidetracked with a real work issue I had to address. Lets see if I can get that going again.

[+BudMan MVC]

Ok -- did you not try and make any smb connections when you were doing that capture.

See my PM. There are no SMB packets at all in that 2k8 sniff you sent me.

[Jason S. Global Moderator]

Ok -- did you not try and make any smb connections when you were doing that capture.

See my PM. There are no SMB packets at all in that 2k8 sniff you sent me.

i did try smb connections - i did an attempt through Windows Explorer, CMD and Synology Assistant. just sent you the latest pcap file.

[xendrome]

I am coming into this late, but are you running a domain and is the 2008 R2 box part of that? If so, why not just join the NAS to the domain, it should have that function. Then map the drives with a domain account which has proper permissions.

[Jason S. Global Moderator]

I am coming into this late, but are you running a domain and is the 2008 R2 box part of that? If so, why not just join the NAS to the domain, it should have that function. Then map the drives with a domain account which has proper permissions.

nope - no domain involved here

[c.grz]

Anyway you can create a fresh install of 2008R2 and see if that fails?

[+BudMan MVC]

Ok we are on the track of the fix now!

Seems this box has 2 networks -- a public one, and a private.. Not seeing any of the smb traffic on the private interface.

Walking him through the removal of the bindings of windows network on the public interface so that traffic has to go on the correct interface.

Once we get it working will put together a write up on the root cause of the problem!

[jasondefaoite]

Cheers budman ... should be an interesting read :)