WinXP SP2 Network problem

[Guest]

First a little history...

My client has about 2000 machines attached to a windows 2003 AD network. All
of our machines are XP SP2 with the firewall turned off when attached to the
domain. about 1/3 of all of the machines are laptops of varying types.
Now to the problem.

Every now and again, a machine shows up that won't get virus updates. The
machine notifies the server and then a notification is then sent to the
admins. These machines for what ever reason are laptops only. The issue that
we see is that the machine will not allow incoming request of any type. None
at all. The only way to talk to the machine is by having the user start up
netmeeting and calling your machine. Then we can connect to it using
netmeeting, but nothing else. The machine is visable in DNS/DHCP as well as
being in AD. It's able to browse the network, as well as connect to any
share, check email, run network scripts, it just won't allow incoming
requests.
To date, the only fix that has worked was to rebuild the machine. Initially
we started troubleshooting it, rebuilding Winsocks and reinstalling the
TCP/IP stack, but nothing worked. We have tested the Switch's/Routers and all
of that works. Another machine in the same port works, but that machine
won't, nor on another port/switch/router. Renewing Ip/reregistering in
DNS/WINS doens't help. I can get a new IP, but it doesn't help. Problem still
exists.

I'm asking you guys for any other thoughts on this as I'm out of ideas.

Thank you

 

[Chuck]

First a little history...

My client has about 2000 machines attached to a windows 2003 AD network. All
of our machines are XP SP2 with the firewall turned off when attached to the
domain. about 1/3 of all of the machines are laptops of varying types.
Now to the problem.

Every now and again, a machine shows up that won't get virus updates. The
machine notifies the server and then a notification is then sent to the
admins. These machines for what ever reason are laptops only. The issue that
we see is that the machine will not allow incoming request of any type. None
at all. The only way to talk to the machine is by having the user start up
netmeeting and calling your machine. Then we can connect to it using
netmeeting, but nothing else. The machine is visable in DNS/DHCP as well as
being in AD. It's able to browse the network, as well as connect to any
share, check email, run network scripts, it just won't allow incoming
requests.
To date, the only fix that has worked was to rebuild the machine. Initially
we started troubleshooting it, rebuilding Winsocks and reinstalling the
TCP/IP stack, but nothing worked. We have tested the Switch's/Routers and all
of that works. Another machine in the same port works, but that machine
won't, nor on another port/switch/router. Renewing Ip/reregistering in
DNS/WINS doens't help. I can get a new IP, but it doesn't help. Problem still
exists.

I'm asking you guys for any other thoughts on this as I'm out of ideas.

Thank you

What antivirus are you using?

Any other problem preceding the AV update failure? Anything in Event Log?

Are these laptops coming in from connection to any external LANs?

Which Winsock rebuilds did you use?
<http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html>
http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html

Did you do any Winsock enumeration before rebuilding?

How often does this happen (best guess average)? The next time, enumerate
Winsock before rebuilding. Then gather "browstat status", "ipconfig /all",
"net config server", and "net config workstation", so we can diagnose the
problem. Read this article, and linked articles, and follow instructions
precisely (download browstat!):
<http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.html#AskingForHelp>
http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.html#AskingForHelp

Also look at the IRPStackSize issue:
<http://nitecruzr.blogspot.com/2005/06/server-functionality-affected-by.html>
http://nitecruzr.blogspot.com/2005/06/server-functionality-affected-by.html

 

[Guest]

How do I enumerate Winsock?

What antivirus are you using?

Any other problem preceding the AV update failure? Anything in Event Log?

Are these laptops coming in from connection to any external LANs?

Which Winsock rebuilds did you use?
<http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html>
http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html

Did you do any Winsock enumeration before rebuilding?

How often does this happen (best guess average)? The next time, enumerate
Winsock before rebuilding. Then gather "browstat status", "ipconfig /all",
"net config server", and "net config workstation", so we can diagnose the
problem. Read this article, and linked articles, and follow instructions
precisely (download browstat!):
<http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.html#AskingForHelp>
http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.html#AskingForHelp

Also look at the IRPStackSize issue:
<http://nitecruzr.blogspot.com/2005/06/server-functionality-affected-by.html>
http://nitecruzr.blogspot.com/2005/06/server-functionality-affected-by.html

 

[Chuck]

How do I enumerate Winsock?

An enumeration procedure is explained in this article:
<http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html>
http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html

 

[Guest]

By uninstall the Cisco VPN software, the problem was corrected... None of the
fixes that were on the site given fixed it, which seems odd, since reseting
the winsock data in the registry, it should have...

anyway, thank you for the help

 

[Chuck]

By uninstall the Cisco VPN software, the problem was corrected... None of the
fixes that were on the site given fixed it, which seems odd, since reseting
the winsock data in the registry, it should have...

anyway, thank you for the help

If you can do without the VPN, that's the best solution I could recommend.
Thanks for letting us know.