Explorer is non-responsive with tray activity when domain (AD) traffic is dropped

J

Jason R. Coombs

Introduction
I've been experiencing this problem for some time now (~months), and I'm surprised other mobile users aren't experiencing the same problem.

It does seem remotely related to a previous post in windows.server.active_directory with the title, "Windows XP Clients Explorer hangs when accessing DFS shares".

Problem description
I have a Windows Server 2003 AD (in native mode) with a single domain controller (jaraco.com). The domain controller is co-located with an ISP. The domain name resolves to three IP addresses currently.

I have several domain client systems, all running Windows XP. Some of these clients have been added to the domain via a PPTP or other VPN connection to the server because of blocked traffic (ports 445, 135, etc).

When these client machines are running and are on a network connection and there is activity in the explorer tray (such as an IM client updating an icon or a network adapter indicating traffic), explorer will stop responding. Explorer will eventually begin responding again after some timeouts take place (30-120 seconds or more). If I disconnect the network connectivity (either by disabling a wireless adapter or disconnecting the cable for the network), explorer will begin responding in a few seconds.

After the timeouts occur, explorer will begin responding normally again, and tray events function normally as well. After a new login or change of network or suspend/resume cycle, the problem will arise once again.

If the client machine is on a network which does not drop RPC/CIFS traffic (directly or via VPN), this problem does not occur. If the client machine is not on a network at all, the problem does not occur.

When explorer is not responding, other applications continue to operate normally. If no applications are running, I can use Ctrl-Alt-Delete to launch Task Manager and other programs. Only other programs that communicate with Explorer are affected.

Discussion
It seems clear to me that explorer is attempting to communicate with the domain controller and blocking until communication succeeds or fails via lengthy timeouts. I also believe, but am not certain, that the delay is relative to the number of IP addresses assigned to the domain controller (as if the timeout must occur for each DC address).

This problem occurs on at least four member workstations.

I am an expert computer user, intimately familiar with networking and software. I am a novice AD administrator, however. I was unable to find this problem in the KB, but would humbly and gratefully receive links to articles that address this issue.

I appreciate any feedback.

Regards,
Jason
 
J

Jason R. Coombs

More Information
It occurred again a minute ago. While it was occurring, I pulled up a command prompt and ran netstat. I indeed did confirm that it was attempting to contact the DC on the Endpoint Mapper port (135?). It seemed to be checking each of the three IP addresses at least twice, and had to wait for the TCP timeout each time.


TCP metaorganism:4644 unused-colo-10.swcp.com:epmap SYN_SENT
TCP metaorganism:4645 69.49.174.1.swcp.com:epmap SYN_SENT
TCP metaorganism:4646 69.49.174.5.swcp.com:epmap SYN_SENT

The three lines above were not seen together, but seen upon successive calls to netstat. I guessed on the outgoing ports, but the other information is cut/paste.

Jason
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top