UNC Network Shares Fail

Question

I have a Windows Server 2008 R2 installation that is acting as a DC. It has been operational without any problems since late August. All of a sudden, UNC share access experiences an issue where no-one (clients or the DC itself) can access the DC's shares. A reboot of the computer resolves the issue for a minimum time 24-hours, at which time UNC fails again. When this occurs, DNS appears to be fine, routing is fine, I can remote in the server by its FCDN, etc. There are no log entries that really indicate that there is a problem until clients and even the DC itself try to refresh Group Policy, which is accessed via a UNC share.

I realize that details are scant, so if you have any troubleshooting information I can go dig up and post, I would appreciate it.

Not that I am aware, but the DC itself has a problem accessing its own shared through the domain unc. For example, \\domain.local\sysvol is inaccessible. — Wayne Hartman, Oct 17 '09 at 01:29
Can you browse to UNC shares on other servers when this happens? The 24-hour span seems to indicate something like a DHCP/DNS entry expiring, or a service is leaking memory, reaching a point where it eventually crashes. — mpeterson, Oct 17 '09 at 18:14

score 2 · Answer 1 · answered Nov 14 '09 at 04:43

2

"Windows Server 2008 network shares may become unresponsive with Symantec Endpoint Protection 11 or Symantec AntiVirus 10.2 client installed and Auto-Protect enabled."

From here.

answered Nov 14 '09 at 04:43

GregD

8,713
1
24
36

score 1 · Accepted Answer · answered Nov 15 '09 at 20:12

Have been conducting my own additional research and found this article:

Windows 2008 Server Network Connectivity Problem:

Here was the symptom – Everything would work fine for at least 3 hours, sometimes close to 24 hours. Then everything would start to go screwy. Computers would start to drop off the network like flies. The sysvol share would become inaccessible to anyone on the network (including the server itself.) ... Rebooting the server would make the errors and problems go away for a while, but within a day, the problem would be back. ... This symptom is caused by a flaky network card driver.

I noticed my drivers were the Microsoft installed versions. I also found that my NIC manufacturer had more specific (and recent) versions of the NIC drivers, so I have loaded those. It has been a few days; so far so good. I'm not calling this one solved, so we'll see what the next few days bring...

score 0 · Answer 3 · answered Oct 17 '09 at 00:20

0

Any updates applied about the time it started having this trouble?

answered Oct 17 '09 at 00:20

mpeterson

255
1
11

Last updates were applied at the end of September. – Wayne Hartman Oct 17 '09 at 03:35

alexm · Answer 4 · 2009-11-16T14:40:15.393

0

Check that following services are up and running on the server:

netlogon
server
computer browser

They should be dealing with sharing...

EDIT:

Try to check also all dependences to Network Discovery, like:
* Function Discovery Resource Publication
* SSDP Discovery
* UPnP Device Host

edited Nov 16 '09 at 14:40

answered Nov 12 '09 at 10:06

alexm

458
3
11

I will check this out when the problem occurs again. – Wayne Hartman Nov 12 '09 at 13:04
Those service appear to be working fine. I restarted them for good measure when it exhibited the problem again. No dice. – Wayne Hartman Nov 12 '09 at 22:17

score 0 · Answer 5 · answered Nov 12 '09 at 12:27

0

Did you adjust the server clocks for Daylight Savings? You might be off by an hour.

answered Nov 12 '09 at 12:27

charlesbridge

827
5
14

This was occuring long before the time change. The time is correct. – Wayne Hartman Nov 12 '09 at 13:03

score 0 · Answer 6 · answered Nov 14 '09 at 01:13

0

Please define "no one can access". What is the exact error message/problem....permission denied, shares not visible, server not found, etc?

In your example \\domain.local\sysvol being inaccessible, is DFS in use?

Have you done the previously suggested test of \\127.0.0.1\Share from the server itself?

answered Nov 14 '09 at 01:13

Ed Fries

1,619
2
12
14

'No one can access' means that no clients, nor the server itself, can access UNC shares. There is no error in the logs, save a Group Policy error, saying that it cannot reach the group policy settings stored in the UNC share \\domain.local\sysvol. I have had to do some reboots on the server to do my own troubleshooting, so the error has not yet resurfaced to try the local host share. I would suspect that it would fail because it cannot reach the \\domain.local\sysvol. I will try, however, if/when the problem resurfaces again. – Wayne Hartman Nov 14 '09 at 01:45
In light of what you just said here Wayne - check your AD DNS (advanced view in DNS), I bet that your DC registrations are either missing or wrong. – pauska Nov 17 '09 at 22:53

score 0 · Answer 7 · answered Nov 14 '09 at 12:26

This might seem obscure since you can do pretty much everything except SMBFS on the server, but - have you tried moving the server to a different switch port? A confused switch ARP stack can create many weird problems. I've had similar problems before (especially when doing trunking), and my only solution was to hard-reset our switches.

score 0 · Answer 8 · answered Nov 16 '09 at 10:34

The Server service allows shares to be accessible. So you indicated that the server service is up and running and that client and the DC itself cannot connact to the shares.

Do you have a firewall configured? if the clients cannot connect to the shares you could try portqryv2 on the server itself to confirm that the ip ports are open, these ports are 137,138,139, and 445. Is NBT enabled?

Is the DC internet facing?

Also try turning up the logging to find out if there are any errors you're not specifically picking up. It could be that you have a virus which may be causeing a buffer overflow on the TCP stack.

score 0 · Answer 9 · answered Nov 17 '09 at 22:00

0

What does the output of "net share" say when you run it from the cmd.exe?

Are all the shares which should be there actually appearing?

answered Nov 17 '09 at 22:00

Conor

101
1

UNC Network Shares Fail

9 Answers9