Strange network problem BUT with ipconfig and browstat info

[Guest]

I have 2 XP Pro's networked. The user name and passwords are the same on
both. PC A is acting like the server and has 4 shares. PC B maps 2 drives
to two of the shares. PC B also has a UNC shortcut to the 3rd share. The
problem is that every 2 or 3 days PC B loses access to the share for the UNC
shortcut BUT can still get to the mapped drives. When we browse \\PC A, we
see all the shares and can open 2 of the 4. The other two give us an "access
denied" error.

The below didn't help becaause it is already 0.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\
In the LSA folder, look in the right-hand pane.
look for the value 'RestrictAnonymous'.
It needs to be zero.
If it is not, double-click it and set it to zero.

Basically, why do we have access to two shares and not the other two (it's
the same two every time)? If we do the system restore we're okay for about 2
or 3 days and it happens all over again.

The additional info (Quarry1 is the "server"; the info is Quarry1 first
Quarry2 next):

Windows IP Configuration

Host Name . . . . . . . . . . . . : QUARRY1

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Hybrid

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Broadcom NetXtreme 57xx Gigabit
Controller

Physical Address. . . . . . . . . : 00-14-22-28-36-CC

Dhcp Enabled. . . . . . . . . . . : No

IP Address. . . . . . . . . . . . : 192.168.1.10

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.1.1

DNS Servers . . . . . . . . . . . : 192.168.1.1

Unable to query browser statistics: 87

Status for domain WORKGROUP on transport
\Device\NetBT_Tcpip_{9A79F1FD-3336-4223-879F-D285906DEA81}
Browsing is active on domain.
Master browser name is: QUARRY1
Master browser is running build 2600
1 backup servers retrieved from master QUARRY1
\\QUARRY1
There are 2 servers in domain WORKGROUP on transport
\Device\NetBT_Tcpip_{9A79F1FD-3336-4223-879F-D285906DEA81}
There are 1 domains in domain WORKGROUP on transport
\Device\NetBT_Tcpip_{9A79F1FD-3336-4223-879F-D285906DEA81}

Windows IP Configuration

Host Name . . . . . . . . . . . . : QUARRY2

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Hybrid

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Broadcom NetXtreme 57xx Gigabit
Controller

Physical Address. . . . . . . . . : 00-14-22-25-50-B7

Dhcp Enabled. . . . . . . . . . . : No

IP Address. . . . . . . . . . . . : 192.168.1.11

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.1.1

DNS Servers . . . . . . . . . . . : 192.168.1.1

Unable to query browser statistics: 87

Status for domain WORKGROUP on transport
\Device\NetBT_Tcpip_{0A183FCA-785F-4CDE-823F-3EBA3A72783C}
Browsing is active on domain.
Master browser name is: QUARRY1
Could not open key in registry, error = 5 Unable to determine build
of browser master: 5
\\\\QUARRY1 . Version:05.01 Flags: 51203 NT POTENTIAL MASTER
1 backup servers retrieved from master QUARRY1
\\QUARRY1
There are 2 servers in domain WORKGROUP on transport
\Device\NetBT_Tcpip_{0A183FCA-785F-4CDE-823F-3EBA3A72783C}
There are 1 domains in domain WORKGROUP on transport
\Device\NetBT_Tcpip_{0A183FCA-785F-4CDE-823F-3EBA3A72783C}


Any ideas?

TIA

jwkh

 

[Chuck]

I have 2 XP Pro's networked. The user name and passwords are the same on
both. PC A is acting like the server and has 4 shares. PC B maps 2 drives
to two of the shares. PC B also has a UNC shortcut to the 3rd share. The
problem is that every 2 or 3 days PC B loses access to the share for the UNC
shortcut BUT can still get to the mapped drives. When we browse \\PC A, we
see all the shares and can open 2 of the 4. The other two give us an "access
denied" error.

The below didn't help becaause it is already 0.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\
In the LSA folder, look in the right-hand pane.
look for the value 'RestrictAnonymous'.
It needs to be zero.
If it is not, double-click it and set it to zero.

Basically, why do we have access to two shares and not the other two (it's
the same two every time)? If we do the system restore we're okay for about 2
or 3 days and it happens all over again.

The additional info (Quarry1 is the "server"; the info is Quarry1 first
Quarry2 next):

Any ideas?

TIA

jwkh

I've tried to help you, I think, a couple times in the past. You keep opening
new threads, so it's hard to tell. Why is that?

Anyway, you have 2 diagnostic symptoms above, from Quarry2:
# Error 87:
The parameter is incorrect.
# Error 5:
Access is denied.

Which computer are you doing the system restore on? From the combination of the
2 errors, I have to suspect that you're getting an LSP / Winsock problem, and
the system restore clears that. But why is it reoccurring? The next time the
symptoms come up, try an LSP / Winsock repair.
<http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html>
http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html

And if it happens sometime in the next few days, this thread should still be
here, so try and reply in this thread, don't just create a new one. Approaching
this problem statefully might help next time.

 

[Guest]

Sorry about that. I'm using Internet Explorer and have difficulty finding my
original post(s). I'll make sure I keep track of it from now on; maybe get a
news reader.

Quarry1 is the one we have to do the restore on; it's the "server." We're
not sure why it happens every few days. The same software is run every day.
There's no outside access to the network - just 2 XP Pros on a switch.
What's strange is that when it does happen, Quarry2 can access the same 2
shares of the 4, and cannot access the same other 2 - if that makes any sense.

We've left the PCs on for the last week to avoid the problem. I guess we'll
turn them off tonight and see what happens.

Thanks a lot for your patience and help.

jwkh

 

[Chuck]

Sorry about that. I'm using Internet Explorer and have difficulty finding my
original post(s). I'll make sure I keep track of it from now on; maybe get a
news reader.

Quarry1 is the one we have to do the restore on; it's the "server." We're
not sure why it happens every few days. The same software is run every day.
There's no outside access to the network - just 2 XP Pros on a switch.
What's strange is that when it does happen, Quarry2 can access the same 2
shares of the 4, and cannot access the same other 2 - if that makes any sense.

We've left the PCs on for the last week to avoid the problem. I guess we'll
turn them off tonight and see what happens.

Thanks a lot for your patience and help.

jwkh

If there's a problem, and it reoccurs, you're going to have to solve the
problem. If turning the computers off is a permanent solution, fine; but it
won't solve anything.

How are the computers connected to the Internet? Are they directly connected?
Please read about Layered Security.
<http://nitecruzr.blogspot.com/2005/05/please-protect-yourself-layer-your.html>
http://nitecruzr.blogspot.com/2005/05/please-protect-yourself-layer-your.html

 

[Guest]

What I meant by turning them off was that we have been avoiding the problem
by NOT turning them off. We used to turn them off every night, but kept them
on for the past 10 days. We will begin turning them off every night this
Monday.

They are NOT connected to the Internet in any way.

jwkh

 

[Chuck]

What I meant by turning them off was that we have been avoiding the problem
by NOT turning them off. We used to turn them off every night, but kept them
on for the past 10 days. We will begin turning them off every night this
Monday.

They are NOT connected to the Internet in any way.

OK. Well, the error "Unable to query browser statistics: 87", where the "87" is
"The parameter is incorrect." suggests an LSP / Winsock problem.
<http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html>
http://nitecruzr.blogspot.com/2005/05/problems-with-lsp-winsock-layer-in.html

The fact that the problem happens to 2 out of the 4 shares on the server
suggests something like "885250".
<http://nitecruzr.blogspot.com/2005/11/irregularities-in-individual-share.html>
http://nitecruzr.blogspot.com/2005/11/irregularities-in-individual-share.html

So I guess we'll see what happens when you turn the computers off at night. How
many times have you noted the problem, before starting to turn them off at
night? How often does the problem reoccur?

 

[Guest]

What was happening was that we DID turn them off every night and the problem
would happen every 2 or 3 days when we turned them back on. That's why we
quit turning them off at night -- to avoid having the problem come up. We
have not had the problem since we have been leaving the computers on 24x7.

jh

 

[Chuck]

What was happening was that we DID turn them off every night and the problem
would happen every 2 or 3 days when we turned them back on. That's why we
quit turning them off at night -- to avoid having the problem come up. We
have not had the problem since we have been leaving the computers on 24x7.

Well offhand, I can't think of a known relationship between turning computers
off and either an LSP / Winsock corruption, or an "885250" scenario. When you
turn the computers off, do you do so politely (Start - Shutdown, and wait)?
When you power the computers back up, do you use a consistent sequence?
# Power Computer A up, wait til it's ready for login.
# Power Computer B up, wait til it's ready for login.
# Login to Computer A.
# Login to Computer B.

The browser (the set of programs that populate Network Neighborhood, and provide
named share access) is a fascinating subject. It's complex, and confusing.
<http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html>
http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html

 

[Guest]

The computers are shut down properly, and they are started in a specific way:
the workgroup "server" (quarry1) first then the "client" (quarry2). Not sure
about the logins -- who logs in first. I *THINK* they do it the same way --
"server" first, etc.

jwkh