• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 541
  • Last Modified:

cannot connect to network shares, have 5774 errors, dcdiag errors, admin shares missing?

1 win2K server.  Domain.  starting this (monday) morning users can login to domain but cannot access any network drives or printers.  users can get on internet fine.  I can login remotely to server fine.  Only "new" thing about network (I am aware of) is Friday our ISP added capacity to our T1.  (Our static IP address stayed the same).
users can login and of course can ping the server.
I rebooted server - no change
i stopped and restarted DNS and netlogon service - no change
Dcdiag got connectivity error. so I changed the TCP/IP properties of the server to point to itself as the DNS server and setup DNS forwarding in DNS.  This got rid of DCdiag connectivity error but now get "a net use or LsaPolicy operation failed with error 67. THe network name cannot be found" under the netlogons test in dcdiag. Still users cannot connect.

get repeated 5774 errors such as "Registration of the DNS record '_gc._tcp.Default-First-Site-Name._sites.firstcapital.local. 600 IN SRV 0 100 3268 firstcapdc1.firstcapital.local.' failed with the following error:
DNS name does not exist.  "

Also got an 8003 error: "The master browser has received a server announcement from the computer LT-JOHN that believes that it is the master browser for the domain on transport NetBT_Tcpip_{91F5B8AE-F80B-4A26-A. The master browser is stopping or an election is being forced. "

Only other thing I noticed was MS had a tech note that said administgrative shares could be missing due to viruses and my C$, admin$, and IFC$ shares are missing.  No other sign of virus activity.  Not sure how to get these shares back or if this has anything to do with the problem.

Help!
Daryl
0
drinaldi
Asked:
drinaldi
  • 3
  • 2
1 Solution
 
drinaldiAuthor Commented:
Friartuk - thanks but your reply wasn't really helpful this time.  I have discovered that the server was infected with a virus.  Called backdoor:win32/rbot.gen by MS malicious SW removal tool and called w32.spybot.worm by Norton.  I have removed the virus but people still cannot connect to network shares.  
IMPORTANT NOTE: Domain users cannot connect to network shares, however workgroup users CAN connect to network shares.  If I try to map a network drive on a domain user it says "network drive \\servername\sharename cannot be found" ANy advice on how to go about fixing this?
0
Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

 
drinaldiAuthor Commented:
PS. Removing the virus brought back the administrative shares.  So they are there and working fine.
0
 
drinaldiAuthor Commented:
Actually I just got this resolved by opening a microsoft tech support case.  Long involved process that entailed turning off and on offline files on each client machine, and then on some had to manually delete the offline synchronization directory and reboot.  Had to recreate some shares on the server.  May have done a few more things on the server - I can't recall - the MS technician did it all.  So this is now closed
0
 
ee_ai_constructCommented:
Closed, 500 points refunded.
ee_ai_construct
Community Support Moderator
replacement part #xm34
0

Featured Post

NFR key for Veeam Agent for Linux

Veeam is happy to provide a free NFR license for one year.  It allows for the non‑production use and valid for five workstations and two servers. Veeam Agent for Linux is a simple backup tool for your Linux installations, both on‑premises and in the public cloud.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now