Help with long term network problem

[Gallon_Jug]

Ok I ran the batch file form NEOBAT
Checking \\CMM...
Checking \\DATA...Unable to open Service Control Manager database on
\\\DATA:

Checking \\DELL8400...
Checking \\NEOBAT...
Found browser on:

\\NEOBAT


Checking \\CMM...
Found lmhosts on:

\\CMM

Checking \\DATA...Unable to open Service Control Manager database on
\\\DATA:

Checking \\DELL8400...
\\DELL8400

Checking \\NEOBAT...
\\NEOBAT


Checking \\CMM...
Checking \\DATA...Unable to open Service Control Manager database on
\\\DATA:

Checking \\DELL8400...
Found remoteregistry on:

\\DELL8400

Checking \\NEOBAT...
\\NEOBAT


Checking \\CMM...
Found server on:

\\CMM

Checking \\DATA...Unable to open Service Control Manager database on
\\\DATA:

Checking \\DELL8400...
\\DELL8400

Checking \\NEOBAT...
\\NEOBAT


Checking \\CMM...
Found sharedaccess on:

\\CMM

Checking \\DATA...Unable to open Service Control Manager database on
\\\DATA:

Checking \\DELL8400...
\\DELL8400

Checking \\NEOBAT...
\\NEOBAT


Checking \\CMM...
Found workstation on:

\\CMM

Checking \\DATA...Unable to open Service Control Manager database on
\\\DATA:

Checking \\DELL8400...
\\DELL8400

Checking \\NEOBAT...
\\NEOBAT

 

[Gallon_Jug]

Ok I ran the batch file form NEOBAT
Checking \\CMM...
Checking \\DATA...Unable to open Service Control Manager database on
\\\DATA:

Checking \\DELL8400...
Checking \\NEOBAT...
Found browser on:

\\NEOBAT


Checking \\CMM...
Found lmhosts on:

\\CMM

Checking \\DATA...Unable to open Service Control Manager database on
\\\DATA:

Checking \\DELL8400...
\\DELL8400

Checking \\NEOBAT...
\\NEOBAT


Checking \\CMM...
Checking \\DATA...Unable to open Service Control Manager database on
\\\DATA:

Checking \\DELL8400...
Found remoteregistry on:

\\DELL8400

Checking \\NEOBAT...
\\NEOBAT


Checking \\CMM...
Found server on:

\\CMM

Checking \\DATA...Unable to open Service Control Manager database on
\\\DATA:

Checking \\DELL8400...
\\DELL8400

Checking \\NEOBAT...
\\NEOBAT


Checking \\CMM...
Found sharedaccess on:

\\CMM

Checking \\DATA...Unable to open Service Control Manager database on
\\\DATA:

Checking \\DELL8400...
\\DELL8400

Checking \\NEOBAT...
\\NEOBAT


Checking \\CMM...
Found workstation on:

\\CMM

Checking \\DATA...Unable to open Service Control Manager database on
\\\DATA:

Checking \\DELL8400...
\\DELL8400

Checking \\NEOBAT...
\\NEOBAT

 

[Gallon_Jug]

Here is the batch file with PIS removed from all machines but DATA.
For some @%&*&( reason it will not unistall so going to Panda Tech
Support to see what registry values I need to celan out and simply
delete those and the program files.


Checking \\CMM...
Checking \\DATA...
Found browser on:

\\DATA

Checking \\NEOBAT...
\\NEOBAT


Checking \\CMM...
Found lmhosts on:

\\CMM

Checking \\DATA...
\\DATA

Checking \\NEOBAT...
\\NEOBAT


Checking \\CMM...
Checking \\DATA...
Found remoteregistry on:

\\DATA

Checking \\NEOBAT...
\\NEOBAT


Checking \\CMM...
Found server on:

\\CMM

Checking \\DATA...
\\DATA

Checking \\NEOBAT...
\\NEOBAT


Checking \\CMM...
Found sharedaccess on:

\\CMM

Checking \\DATA...
\\DATA

Checking \\NEOBAT...
\\NEOBAT


Checking \\CMM...
Found workstation on:

\\CMM

Checking \\DATA...
\\DATA

Checking \\NEOBAT...
\\NEOBAT

 

[Gallon_Jug]

Here is the batch file again with PIS removed from all machines including DATA.

Checking \\CMM...
Checking \\DATA...
Found browser on:
\\DATA
Checking \\DELL8400...
Checking \\NEOBAT...
\\NEOBAT
Checking \\CMM...
Found lmhosts on:
\\CMM
Checking \\DATA...
\\DATA
Checking \\DELL8400...
\\DELL8400
Checking \\NEOBAT...
\\NEOBAT
Checking \\CMM...
Checking \\DATA...
Found remoteregistry on:
\\DATA
Checking \\DELL8400...
\\DELL8400
Checking \\NEOBAT...
\\NEOBAT
Checking \\CMM...
Found server on:
\\CMM
Checking \\DATA...
\\DATA
Checking \\DELL8400...
\\DELL8400
Checking \\NEOBAT...
\\NEOBAT
Checking \\CMM...
Found sharedaccess on:
\\CMM
Checking \\DATA...
\\DATA
Checking \\DELL8400...
\\DELL8400
Checking \\NEOBAT...
\\NEOBAT
Checking \\CMM...
Found workstation on:
\\CMM
Checking \\DATA...
\\DATA
Checking \\DELL8400...
\\DELL8400
Checking \\NEOBAT...
\\NEOBAT


However when I ran Browstat status from NEOBAT before I was able to
remove PIS form DATA I still saw the 2 domains on WCSBZ!!!

Now it looks clean.

Status for domain WCSBZ on transport
\Device\NetBT_Tcpip_{CF0813A7-220D-429B-A2DA-8FC2566D4BB8}
Browsing is active on domain.
Master browser name is: NEOBAT
Master browser is running build 2600
1 backup servers retrieved from master NEOBAT
\\NEOBAT
There are 4 servers in domain WCSBZ on transport
\Device\NetBT_Tcpip_{CF0813A7-220D-429B-A2DA-8FC2566D4BB8}
There are 1 domains in domain WCSBZ on transport
\Device\NetBT_Tcpip_{CF0813A7-220D-429B-A2DA-8FC2566D4BB8}

 

[Chuck]

Checking \\CMM...
Checking \\DATA...
Found browser on:
\\DATA
Checking \\DELL8400...
Checking \\NEOBAT...
\\NEOBAT
Checking \\CMM...
Found lmhosts on:
\\CMM
Checking \\DATA...
\\DATA
Checking \\DELL8400...
\\DELL8400
Checking \\NEOBAT...
\\NEOBAT
Checking \\CMM...
Checking \\DATA...
Found remoteregistry on:
\\DATA
Checking \\DELL8400...
\\DELL8400
Checking \\NEOBAT...
\\NEOBAT
Checking \\CMM...
Found server on:
\\CMM
Checking \\DATA...
\\DATA
Checking \\DELL8400...
\\DELL8400
Checking \\NEOBAT...
\\NEOBAT
Checking \\CMM...
Found sharedaccess on:
\\CMM
Checking \\DATA...
\\DATA
Checking \\DELL8400...
\\DELL8400
Checking \\NEOBAT...
\\NEOBAT
Checking \\CMM...
Found workstation on:
\\CMM
Checking \\DATA...
\\DATA
Checking \\DELL8400...
\\DELL8400
Checking \\NEOBAT...
\\NEOBAT


However when I ran Browstat status from NEOBAT before I was able to
remove PIS form DATA I still saw the 2 domains on WCSBZ!!!

Now it looks clean.

Status for domain WCSBZ on transport
\Device\NetBT_Tcpip_{CF0813A7-220D-429B-A2DA-8FC2566D4BB8}
Browsing is active on domain.
Master browser name is: NEOBAT
Master browser is running build 2600
1 backup servers retrieved from master NEOBAT
\\NEOBAT
There are 4 servers in domain WCSBZ on transport
\Device\NetBT_Tcpip_{CF0813A7-220D-429B-A2DA-8FC2566D4BB8}
There are 1 domains in domain WCSBZ on transport
\Device\NetBT_Tcpip_{CF0813A7-220D-429B-A2DA-8FC2566D4BB8}

Alright, Bruce! That's what you want to see, hopefully on all computers.

Your batch file log looks clean too (not easy to read, you have to run one
"PSService find" to know what to look for).
# Browser on Data and Neobat.
# Remote Registry on Data, Dell8400, and Neobat (Why not CMM? That's for
another day I think).
# Other 4 services (LMHosts, Server, SharedAccess, and Workstation) on all 4
computers (CMM, Data, Dell8400, and Neobat).

So now its time for the big question. What about the computers themselves?
What SYMPTOMS do you see?

 

[Gallon_Jug]

Chuck,

All are connected and can still access router and internet.

Symptoms were not finding mapped network drives or shared printer on
DATA by other machines on the LAN.

Depending on the boot sequence of the computers this changed. If I
shut all down and started DATA then NEOBAT then NEOBAT could use mapped
network drive and shared printer, but not CMM or Dell8400. If I Booted
Data followed by CMM it could access all shared services, but them the
rest could not.

As noted in the beginning all with the LAN has been smooth for nearly a
decade with migrating varied dedicated servers in and out and not
dispensing with the dedicated server and just using on (DATA) as file
server and print server and running the Veritas Server BU SW so I can
back up the entire system to tape drive.

I did learn that Panda has changed some of the Firewall management for
previous versions we were running. Seems that one now needs to
explicitly list IP addresses of all computers on LAN to allow open and
free communication. In the past simply checking a box the then entire
LAN was secure and communication should be allowed was all that was
needed.

There are issues with CMM machine like the browser will not start and
now you pointed out the registry is not available. This may not be a
problem if browser services are only handled by DATA and NEOBAT.

I will let the system sit for the rest of the week end (actually need
to get back to finalizing a risk assessment for the water birds of
Belize then head to Cuba later next week to do bat work.

If everything seems to be functional at the moment I assume we are
done?

If Panda Firewall continues to cause problems using your layered
approach with multiple programs may be in order again. It was a big
pain with Symantec/Norton, Adawae and a host of other separate programs
since I would be the only one to run them and Panda will run fine on
its own on all machines.

FYI you might post to others that the Panda Internet Security 2006
needs a bit more care to config the firewall in a LAN.

http://www.pandasoftware.com/com/support/card?id=10028&idIdioma=2&pagina=5


Thanks for the hand holding and help.

Bruce

 

[Chuck]

Chuck,

All are connected and can still access router and internet.

Symptoms were not finding mapped network drives or shared printer on
DATA by other machines on the LAN.

Depending on the boot sequence of the computers this changed. If I
shut all down and started DATA then NEOBAT then NEOBAT could use mapped
network drive and shared printer, but not CMM or Dell8400. If I Booted
Data followed by CMM it could access all shared services, but them the
rest could not.

As noted in the beginning all with the LAN has been smooth for nearly a
decade with migrating varied dedicated servers in and out and not
dispensing with the dedicated server and just using on (DATA) as file
server and print server and running the Veritas Server BU SW so I can
back up the entire system to tape drive.

I did learn that Panda has changed some of the Firewall management for
previous versions we were running. Seems that one now needs to
explicitly list IP addresses of all computers on LAN to allow open and
free communication. In the past simply checking a box the then entire
LAN was secure and communication should be allowed was all that was
needed.

There are issues with CMM machine like the browser will not start and
now you pointed out the registry is not available. This may not be a
problem if browser services are only handled by DATA and NEOBAT.

I will let the system sit for the rest of the week end (actually need
to get back to finalizing a risk assessment for the water birds of
Belize then head to Cuba later next week to do bat work.

If everything seems to be functional at the moment I assume we are
done?

If Panda Firewall continues to cause problems using your layered
approach with multiple programs may be in order again. It was a big
pain with Symantec/Norton, Adawae and a host of other separate programs
since I would be the only one to run them and Panda will run fine on
its own on all machines.

FYI you might post to others that the Panda Internet Security 2006
needs a bit more care to config the firewall in a LAN.

http://www.pandasoftware.com/com/support/card?id=10028&idIdioma=2&pagina=5


Thanks for the hand holding and help.

Bruce

OK, Bruce,

By "All are connected and can still access router and internet.", I take it you
mean all computers can access other computers? But this is without PIS
installed? If so, I concur with your idea of letting the systems sit for a
week, while you do your actual work, but I urge extreme caution while you do so.

If your computers sit without any individual malware protection of any type, I
highly recommend that you not allow any visitors to access AOL, or any other
similarly unsafe content, until you are able to install anti malware protection.
I note your need to use a package for protection, but I suspect that you are now
aware that package based protection carries a trade off in terms of what we call
lack of granularity.

And you're absolutely right, it's a big pain to deal with AdAware, Spybot, and
other components in granular layered security. But you also, I hope, realise
that the pain of dealing with multiple components is far less than the pain of
trying to clean up a damaged computer, or to deal with data loss from one
irreparably damaged.

And I will note for the record that we've been aware here of the ongoing
problems with NIS and MIS, and now I add PIS to that list. Congrats on your
determination to stick it thru to the end. Please let us know how it works out
for you in the future.

 

[Gallon_Jug]

Ok Chuck,

I reinstalled PIS and re-configured the firewall explicity for each IP
address on each machne.

Everything was fine for about 8 hours not CMM can not access DATA
again, the initial problem.

Maybe I will try simply using an antivirus program and the MS firewall
or what is reccomended at teh router end?

I really do not need firewall internally on LAN if the perimeter is
secure as your info stated.

I can not afford (who can?) to lose any data an the networkignproblem
has foreced me not to have full backups of all machines for severl
months and that is making me more nervous than have some adware on a
machine.

 

[Chuck]

Ok Chuck,

I reinstalled PIS and re-configured the firewall explicity for each IP
address on each machne.

Everything was fine for about 8 hours not CMM can not access DATA
again, the initial problem.

Maybe I will try simply using an antivirus program and the MS firewall
or what is reccomended at teh router end?

I really do not need firewall internally on LAN if the perimeter is
secure as your info stated.

I can not afford (who can?) to lose any data an the networkignproblem
has foreced me not to have full backups of all machines for severl
months and that is making me more nervous than have some adware on a
machine.

Wait til CMM and Data can't communicate, then run the batch file on both.

What if you just un install PIS from Data. What do you get then?

Take it one computer at a time. And diagnose the problem, when its active. Now
that we have a baseline.

 

[Guest]

Tnx again Chuck,

I see I did not answer one of your previous queries..

Advanced file sharing is in place on all machines.

Yes NetBeui was removed from CMM and machine rebooted.

I booted up the 4th computer and stopped and disabled browsing and also
edited registry as it was set a hybrid when I ran ipconfig /all and
changed to braodcast like all other.

But this machine does not connect to the network either- but full acces
to the router and internet.

the Panda Internet Security has not cased any file sahring problems. I
replaced the Symantec/Norton Antivirus on all machine about 2 years ago
after running into problems.

I will once again go through the step by step approach you have on your
site.
I see nothing under the Firewall section that applies other thanthere
could be some hidden factor connected with this that remains unknown.

Over the week end I could disconnect several computers from the router
and uninstall the Panda complely and run browstat status or try
pinging. THen reinstall and register it again.

The MS Network GURU who loggied into our sytem remotely tried pinging
but was unable to ping several computer on the network suggesting some
blocking somewhere.

MS Firewall is OFF with Panda running. I can turn Off Panda FW adn
turn on the MS Firewall if there is any benefit to that?

 

[Guest]

Tnx again Chuck,

I see I did not answer one of your previous queries..

Advanced file sharing is in place on all machines.

Yes NetBeui was removed from CMM and machine rebooted.

I booted up the 4th computer and stopped and disabled browsing and also
edited registry as it was set a hybrid when I ran ipconfig /all and
changed to braodcast like all other.

But this machine does not connect to the network either- but full acces
to the router and internet.

the Panda Internet Security has not cased any file sahring problems. I
replaced the Symantec/Norton Antivirus on all machine about 2 years ago
after running into problems.

I will once again go through the step by step approach you have on your
site.
I see nothing under the Firewall section that applies other thanthere
could be some hidden factor connected with this that remains unknown.

Over the week end I could disconnect several computers from the router
and uninstall the Panda complely and run browstat status or try
pinging. THen reinstall and register it again.

The MS Network GURU who loggied into our sytem remotely tried pinging
but was unable to ping several computer on the network suggesting some
blocking somewhere.

MS Firewall is OFF with Panda running. I can turn Off Panda FW adn
turn on the MS Firewall if there is any benefit to that?

Try to uninstall all of your firewall software on one of your laptop's to see if it will give you the ability to ping the internal interface of your router. Then ping the external interface then try to ping one of your DNS servers. Basically I think that it would be helpful to have one machicne that you know for sure has nothing blocking it so that you can you can try to run some basic tests. try to flush your dns cache and then reregister your dns and see what results you get.