XP machine inaccessible

[Menno Hershberger]

About a week ago my main machine here decided to stop sharing with the
other computers on my network. I can access all the other machines from it
and read/write files to/from them. But when I try to access it from another
machine I get (from a Win 98 machine) "\\Main is not accessible. No
permission to access resource." From an XP machine it's about the same
message... only longer. I'm running XP Pro-SP2 and am using the FAT 32 file
system. Simple file sharing is selected. All drives are fully shared. I've
turned off my firewall(s) and antivirus. I have rerun the Network setup
Wizard, making sure File and Print Sharing is turned on. I Googled around a
bit and found no set solution. I uninstalled Client for Microsoft Networks
and reinstalled it. The workgroup names are the same, of course, or I
couldn't access all the machines from this one. Also, the *name* of this
machine shows up on all the other computers... they just can't access it.
It's getting to be a pain. If I want a file from this machine on another
machine, I have to come to this machine and send it to the other machine.
Two weeks ago it was working fine. I changed nothing.
Any ideas?

 

[Menno Hershberger]

About a week ago my main machine here decided to stop sharing with the
other computers on my network. I can access all the other machines
from it and read/write files to/from them. But when I try to access it
from another machine I get (from a Win 98 machine) "\\Main is not
accessible. No permission to access resource." From an XP machine it's
about the same message... only longer. I'm running XP Pro-SP2 and am
using the FAT 32 file system. Simple file sharing is selected. All
drives are fully shared. I've turned off my firewall(s) and antivirus.
I have rerun the Network setup Wizard, making sure File and Print
Sharing is turned on. I Googled around a bit and found no set
solution. I uninstalled Client for Microsoft Networks and reinstalled
it. The workgroup names are the same, of course, or I couldn't access
all the machines from this one. Also, the *name* of this machine
shows up on all the other computers... they just can't access it. It's
getting to be a pain. If I want a file from this machine on another
machine, I have to come to this machine and send it to the other
machine. Two weeks ago it was working fine. I changed nothing.
Any ideas?

I might add to this that about the same time this happened, I started
getting a popup "network connections" dialog when accessing certain
websites (usally forums). It's one I've never seen before but it is
apparently a valid windows popup, since one of the options is my dialup
connection, which I hardly EVER use. I'm on a T1 and have "never dial a
connection" opted. It accesses the sites alright, but I have to keep
closing that window. A screen capture at www.mewnlite.com/popup.jpg .
My computers are all linked by a Linksys router. I am spyware, adware,
and virus free. HiJack This is showing nothing I don't fully understand.

 

[Chuck]

About a week ago my main machine here decided to stop sharing with the
other computers on my network. I can access all the other machines from it
and read/write files to/from them. But when I try to access it from another
machine I get (from a Win 98 machine) "\\Main is not accessible. No
permission to access resource." From an XP machine it's about the same
message... only longer. I'm running XP Pro-SP2 and am using the FAT 32 file
system. Simple file sharing is selected. All drives are fully shared. I've
turned off my firewall(s) and antivirus. I have rerun the Network setup
Wizard, making sure File and Print Sharing is turned on. I Googled around a
bit and found no set solution. I uninstalled Client for Microsoft Networks
and reinstalled it. The workgroup names are the same, of course, or I
couldn't access all the machines from this one. Also, the *name* of this
machine shows up on all the other computers... they just can't access it.
It's getting to be a pain. If I want a file from this machine on another
machine, I have to come to this machine and send it to the other machine.
Two weeks ago it was working fine. I changed nothing.
Any ideas?

Menno,

Identify the two Windows XP computers that will be online the most, and
designate them the master and backup browsers (this is not referring to Internet
Explorer).

Make sure the browser service is running on the browser computers. Control
Panel - Administrative Tools - Services. Verify that the Computer Browser, and
the TCP/IP NetBIOS Helper, services both show with Status = Started. Disable
the browser on the others, including the Win98 computer. To disable the browser
on the Win98 computer:
http://cms.simons-rock.edu/faq_by_subtopic/node138.html

After checking / starting / stopping the browsers, power all computers off.
Power the two browser computers on, and then the others.

The Microsoft Browstat program will show us what browsers you have in your
domain / workgroup, at any time.
http://support.microsoft.com/?id=188305

You can download Browstat from either:
<http://www.dynawell.com/reskit/microsoft/win2000/browstat.zip>
<http://rescomp.stanford.edu/staff/manual/rcc/tools/browstat.zip>

Browstat is very small (40K), and needs no install. Just unzip the downloaded
file, copy browstat.exe to any folder in the Path, and run it from a command
window, by "browstat status". Make sure all computers give the same result.

For more information about the browser subsystem (very intricate), see:
http://support.microsoft.com/?id=188001
http://support.microsoft.com/?id=188305
<http://www.microsoft.com/technet/prodtechnol/winntas/deploy/prodspecs/ntbrowse.mspx>

If you disabled the Windows XP SP2 firewall appropriately, you're OK. If you
disabled WF by turning off the WF/ICS service, you'll have problems. If you
disabled a third party firewall, enable it and configure it properly. Firewall
problems are a very common cause of file sharing problems.

Look at registry key [HKLM\System\CurrentControlSet\Control\Lsa], value
restrictanonymous, on all computers.
<http://www.microsoft.com/windows200...2000/techinfo/reskit/en-us/regentry/46688.asp>
<http://www.jsifaq.com/subf/tip2600/rh2625.htm>
http://support.microsoft.com/?id=246261
http://support.microsoft.com/?id=296403

The above articles refer to Windows 2000. Remember WinXP is NT V5.1, and Win2K
is NT V5.0.

Have you used the Registry Editor before? If not, it's a scary tool, but it's
pretty simple once you get used to it. Here are a couple articles that might
help:
<http://www.microsoft.com/windowsxp/...home/using/productdoc/en/tools_regeditors.asp>
<http://www.annoyances.org/exec/show/registry>

Just remember to backup the key (create a registry patch) for
[HKLM\System\CurrentControlSet\Control\Lsa] before making any changes, if
appropriate.

From the Annoyances article:
You can create a Registry patch by opening the Registry Editor, selecting a
branch, and choosing Export from the File menu. Then, specify a filename, and
press OK. You can then view the Registry patch file by opening it in Notepad
(right-click on it and select Edit). Again, just double-click on a Registry
patch file (or use Import in the Registry Editor's File menu) to apply it to the
registry.

And Menno, please don't contribute to the spread and success of email address
mining viruses. Posting your email address openly will get you more unwanted
email, than wanted email. Learn to munge your email address properly, to keep
yourself a bit safer when posting to open forums. Protect yourself and the rest
of the internet - read this article.
http://www.mailmsg.com/SPAM_munging.htm

 

[Chuck]

I might add to this that about the same time this happened, I started
getting a popup "network connections" dialog when accessing certain
websites (usally forums). It's one I've never seen before but it is
apparently a valid windows popup, since one of the options is my dialup
connection, which I hardly EVER use. I'm on a T1 and have "never dial a
connection" opted. It accesses the sites alright, but I have to keep
closing that window. A screen capture at www.mewnlite.com/popup.jpg .
My computers are all linked by a Linksys router. I am spyware, adware,
and virus free. HiJack This is showing nothing I don't fully understand.

Menno,

When you have a problem like yours, trying to diagnose it yourself is not the
best idea. If the problem stays with you, get expert help.

The spyware expert forums are full of HijackThis logs with "...nothing I don't
fully understand". Some are accompanied by solutions found by the experts, and
the service is free. Have you posted to one or more of these forums (please do
so, and please post links to your posts here).
Aumha: <http://forum.aumha.org/index.php>
Net-Integration: <http://forums.net-integration.net/>
Spyware Info: <http://forums.spywareinfo.com/>
Spyware Warrior: <http://spywarewarrior.com/index.php>
Tom Coyote: <http://forums.tomcoyote.org/>

 

[Menno Hershberger]

Menno,

Identify the two Windows XP computers that will be online the most,
and designate them the master and backup browsers (this is not
referring to Internet Explorer).

Make sure the browser service is running on the browser computers.
Control Panel - Administrative Tools - Services. Verify that the
Computer Browser, and the TCP/IP NetBIOS Helper, services both show
with Status = Started. Disable the browser on the others, including
the Win98 computer. To disable the browser on the Win98 computer:
http://cms.simons-rock.edu/faq_by_subtopic/node138.html

OK, did that.

After checking / starting / stopping the browsers, power all computers
off. Power the two browser computers on, and then the others.

Did that too.

Browstat is very small (40K), and needs no install. Just unzip the
downloaded file, copy browstat.exe to any folder in the Path, and run
it from a command window, by "browstat status". Make sure all
computers give the same result.

I disabled browsemaster on the one 98 computer and unplugged all the
rest except this one and the other XP computer. Here's what browstat
status returned.
Status for domain TELCO on transport \Device\NetBT_Tcpip_{F75A7A93-DD9D-
4B6B-B33F-A3AE98606460}
Browsing is active on domain.
Master browser name is: HERB
Could not open key in registry, error = 5 Unable to determine
build of browser master: 5
\\\\HERB . Version:05.01 Flags: 51003 NT POTENTIAL MASTER
1 backup servers retrieved from master HERB
\\HERB
There are 3 servers in domain TELCO on transport \Device\NetBT_Tcpip_
{F75A7A93-DD9D-4B6B-B33F-A3AE98606460}
There are 1 domains in domain TELCO on transport \Device\NetBT_Tcpip_
{F75A7A93-DD9D-4B6B-B33F-A3AE98606460}

Look at registry key [HKLM\System\CurrentControlSet\Control\Lsa],
value restrictanonymous, on all computers.

That was IT! restrictanonymous was set to 1 on this computer. After
comparing it to the other XP computer (HERB), I changed it to zero and it
has fixed the problem. Thank you so much!
I remember some kind of reference to that key in one of those support
forums, but it was vague as to its location.

And Menno, please don't contribute to the spread and success of email
address mining viruses. Posting your email address openly will get
you more unwanted email, than wanted email.

mhersh22 at hotmail.com was a figment of my imagination in the first
place. However I have munged it a more now to make it a little more
obvious... I run my own domain (on that 98 machine) and get my email
through that. I use several aliases (like one for eBay only). If I start
getting junk, I just change the username and try to be more careful.
Is that error in the browstat log anything to worry about?
And again... THANK YOU!

 

[Menno Hershberger]

Menno,

When you have a problem like yours, trying to diagnose it yourself is
not the best idea. If the problem stays with you, get expert help.

I'm a regular in alt.privacy.spyware as Lil' Abner. I have indeed
posted logs (usually from a customer's machine) to at least three of
those forums. I don't deem myself an "expert" in any sense of the word,
but I've fixed enough stuff (through the help of those forums) that I'm
beginning to get the hang of it. And I will soon be seeking help about
the little network connections popup I've been getting.

 

[Chuck]

Menno,

Identify the two Windows XP computers that will be online the most,
and designate them the master and backup browsers (this is not
referring to Internet Explorer).

Make sure the browser service is running on the browser computers.
Control Panel - Administrative Tools - Services. Verify that the
Computer Browser, and the TCP/IP NetBIOS Helper, services both show
with Status = Started. Disable the browser on the others, including
the Win98 computer. To disable the browser on the Win98 computer:
http://cms.simons-rock.edu/faq_by_subtopic/node138.html

OK, did that.

After checking / starting / stopping the browsers, power all computers
off. Power the two browser computers on, and then the others.

Did that too.

Browstat is very small (40K), and needs no install. Just unzip the
downloaded file, copy browstat.exe to any folder in the Path, and run
it from a command window, by "browstat status". Make sure all
computers give the same result.

I disabled browsemaster on the one 98 computer and unplugged all the
rest except this one and the other XP computer. Here's what browstat
status returned.
Status for domain TELCO on transport \Device\NetBT_Tcpip_{F75A7A93-DD9D-
4B6B-B33F-A3AE98606460}
Browsing is active on domain.
Master browser name is: HERB
Could not open key in registry, error = 5 Unable to determine
build of browser master: 5
\\\\HERB . Version:05.01 Flags: 51003 NT POTENTIAL MASTER
1 backup servers retrieved from master HERB
\\HERB
There are 3 servers in domain TELCO on transport \Device\NetBT_Tcpip_
{F75A7A93-DD9D-4B6B-B33F-A3AE98606460}
There are 1 domains in domain TELCO on transport \Device\NetBT_Tcpip_
{F75A7A93-DD9D-4B6B-B33F-A3AE98606460}

Look at registry key [HKLM\System\CurrentControlSet\Control\Lsa],
value restrictanonymous, on all computers.

That was IT! restrictanonymous was set to 1 on this computer. After
comparing it to the other XP computer (HERB), I changed it to zero and it
has fixed the problem. Thank you so much!
I remember some kind of reference to that key in one of those support
forums, but it was vague as to its location.

And Menno, please don't contribute to the spread and success of email
address mining viruses. Posting your email address openly will get
you more unwanted email, than wanted email.

mhersh22 at hotmail.com was a figment of my imagination in the first
place. However I have munged it a more now to make it a little more
obvious... I run my own domain (on that 98 machine) and get my email
through that. I use several aliases (like one for eBay only). If I start
getting junk, I just change the username and try to be more careful.
Is that error in the browstat log anything to worry about?
And again... THANK YOU!

Abner,

My pleasure.

Son of a gun. I've been preaching that RestrictAnonymous thing for a couple
months, and it pops up in the oddest circumstances. Gotta wonder What Was
Microsoft Thinking when they designed all the settings in Windows?

Please let us know (forum links appreciated) about your popup situation.

Good munge.

 

[Chuck]

I disabled browsemaster on the one 98 computer and unplugged all the
rest except this one and the other XP computer. Here's what browstat
status returned.
Status for domain TELCO on transport \Device\NetBT_Tcpip_{F75A7A93-DD9D-
4B6B-B33F-A3AE98606460}
Browsing is active on domain.
Master browser name is: HERB
Could not open key in registry, error = 5 Unable to determine
build of browser master: 5
\\\\HERB . Version:05.01 Flags: 51003 NT POTENTIAL MASTER
1 backup servers retrieved from master HERB
\\HERB
There are 3 servers in domain TELCO on transport \Device\NetBT_Tcpip_
{F75A7A93-DD9D-4B6B-B33F-A3AE98606460}
There are 1 domains in domain TELCO on transport \Device\NetBT_Tcpip_
{F75A7A93-DD9D-4B6B-B33F-A3AE98606460}

Look at registry key [HKLM\System\CurrentControlSet\Control\Lsa],
value restrictanonymous, on all computers.

That was IT! restrictanonymous was set to 1 on this computer. After
comparing it to the other XP computer (HERB), I changed it to zero and it
has fixed the problem. Thank you so much!
I remember some kind of reference to that key in one of those support
forums, but it was vague as to its location.

And Menno, please don't contribute to the spread and success of email
address mining viruses. Posting your email address openly will get
you more unwanted email, than wanted email.

mhersh22 at hotmail.com was a figment of my imagination in the first
place. However I have munged it a more now to make it a little more
obvious... I run my own domain (on that 98 machine) and get my email
through that. I use several aliases (like one for eBay only). If I start
getting junk, I just change the username and try to be more careful.
Is that error in the browstat log anything to worry about?
And again... THANK YOU!

Abner / Menno,

The error 5 ("Unable to determine build of browser master: 5") is a
permissioning problem. Are you still seeing that after the RA reset? Might
need some more analysis if any other symptoms pop up. If no more symptoms - if
everything else works - I say ignore it. The important question is do all
computers show Herb as the master browser?

I used to enjoy Al Capp's comic strip when I was young. Most newspapers don't
carry it any anymore, probably deemed culturally insensitive by the American
Hillbillys Association or whatever. ;-(