3

So I have an interesting issue where I have a stretched Server2012r2 domain (all servers running Server2012R2 and fully up to date) that spans two data centers; let's call them SiteA and SiteB. The computers at SiteB can all access UNC shares in SiteA by simply typing \COMPUTERNAME\c$ (or \IP\c$), but SiteA cannot access the computers in SITEB the same way. They get a 80004005 error. Note that both SITEA and SITEB can access UNC paths for their local data center; the problem only exists with SITEA making that jump to SITEB.

I've tried to include as much information as possible and do as much pre-troubleshooting as I can. Feel free to ask any questions.

UPDATE #1: I have found that if I use the FQDN of the machine, I CAN access the UNC path from SITEA to SITEB. Only if I use the IP or the short DNS name (for instance computer1 vs computer1.corp.domain.com) does it give the bad network path. Note that I can still successfully ping the IP, the short name, AND the FQDN.

So let's go through a few items:

  1. Windows Firewall is disabled environment wide (SiteA and SiteB).
  2. SiteA and SiteB are both behind Juniper Firewalls, and both firewalls allow ANY/ANY access between the two sites (verified multiple times)
  3. IPv6 is disabled environment wide, no DNS entries exist for IPv6 on either domain controller.
  4. There is a domain controller at both SITEA and SITEB. DCDIAG returns no errors on either one.
  5. Network names (whether short or FQDN) are pingable from SITEA-->SITEB and vice versa.
  6. IP addresses are all pingable from SITEA-->SITEB and vice versa.
  7. User being used for testing is a full administrator in Active Directory.
  8. All computers point to DC1 as primary, DC2 as secondary DNS, except for the DCs themselves, which each look to themselves first (private IP, not 127.0.0.1) and the other DC second.
  9. All computers show themselves connected to the domain network (none are showing private or public networks)
  10. All computers only have a single network adapter.
  11. NetBIOS is enabled system wide, as is file sharing and network discovery.

I setup ProcMon (following Explorer.exe and filtering out all SUCCESS entries to only see the failures) and got the following on a simple \IP\c$ from a SiteA computer to a SiteB computer:

Class: File System
Operation: Create FIle
Result: BAD NETWORK PATH
Path: \\xx.xx.xx.xx\c$
Desired Access: Read Attributes, Synchronize
Disposition:    Open
Options:    Synchronous IO Non-Alert
Attributes: n/a
ShareMode:  Read, Write, Delete
AllocationSize: n/a

Class: File System
Operation: CreateFile
Result: BAD NETWORK PATH
PATH: \\xx.xx.xx.xx\PIPE\srvsvc
Desired Access: Generic Read/Write
Disposition:    Open
Options:    Non-Directory File, Open No Recall
Attributes: n/a
ShareMode:  Read, Write
AllocationSize: n/a

Class: File System
Operation: Create File
Path: \\;RdpDr\;:2\xx.xx.xx.xx\c$
Desired Access: Read Attributes
Disposition:    Open
Options:    Open Reparse Point
Attributes: n/a
ShareMode:  Read, Write, Delete
AllocationSize: n/a

Class: File System
Operation: Create File
Path: \\xx.xx.xx.xx\PIPE\wkssvc
Desired Access: Generic Read/Write
Disposition:    Open
Options:    Non-Directory File, Open No Recall
Attributes: n/a
ShareMode:  Read, Write
AllocationSize: n/a

Class: File System
Operation: Create File
Path: \\;RdpDr\;:2\104.149.68.66\
Desired Access: Read Attributes
Disposition:    Open
Options:    Open Reparse Point
Attributes: n/a
ShareMode:  Read, Write, Delete
AllocationSize: n/a
CrainBramp
  • 51
  • 4
  • Since all clients on the Site are affected, I guess it may have soemthing to do with this Juniper firewall. Sure this machine doesn't act as DNS Server itself or does some weird DNS forwarding? Do you have access to the logs of the firewall? – duenni Oct 18 '17 at 10:24
  • I've made an Update #1 to the original post. Doesn't look like it has anything to do with the firewall. Also, I double-checked all the DNS, and #8 still holds true. – CrainBramp Oct 18 '17 at 10:53
  • Does this happen on normal shares or just the admin shares like C$? Can clients in SiteA access the \\SiteB_DC\Sysvol share? Are there GPO's linked to either of the sites? You can review this in GPMC. If so, what settings are in those policies? Does your anitvirus product have any settings that may have been deployed across specific sites or subnets? – Clayton Nov 14 '17 at 20:42

0 Answers0