Solved

Network running VERY Slow

Posted on 2006-06-14
42
547 Views
Last Modified: 2016-08-29
Just installed a new server running SBS 2003 last week.  Have less than 10 computers accessing it total.

The office is running a bit of specialized software (contact mgr) .  DB is installed on the sql part of the box, which is also running exchange.

Previously had a peer-to-peer network that was running the software fine. Now, on the new system, a task that used to take 1 minute is taking 10.  

Any suggestions on where to start looking?

Thanks!

0
Comment
Question by:citycoop
  • 19
  • 14
  • 7
42 Comments
 
LVL 95

Assisted Solution

by:Lee W, MVP
Lee W, MVP earned 250 total points
ID: 16909250
DNS.  How is your DNS setup?

But first, how did you setup the SBS server?  Did you use the Wizards for everything?

Where is your DHCP service running from?  The SBS server or the router?

SBS is MEANT to be setup a very specific way using the wizards, failing to do so can cause various network problems.

DNS is ABSOLUTELY VITAL to an Active Directory Domain (what SBS provides).  If you THINK you've got it right, you might not, so post your settings, on the server and from at least one client.  Basically, the SBS server MUST run DNS and your clients MUST use it as their ONLY DNS server.
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16909303
Please post a complete IPCONFIG /ALL from your server and a workstation so that we can take a look at how you have it set up.

Jeff
TechSoEasy
0
 

Author Comment

by:citycoop
ID: 16917321
Here's the server:
   Host Name . . . . . . . . . . . . : S1
   Primary Dns Suffix  . . . . . . . :cooperpsych.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . :cooperpsych.local

Ethernet adapter Server Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
   Physical Address. . . . . . . . . :00-13-72-3E-B8-DC
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . :192.168.1.2
   Subnet Mask . . . . . . . . . . . :255.255.255.0
   Default Gateway . . . . . . . . . :192.168.1.1
   DNS Servers . . . . . . . . . . . :192.168.1.2
   Primary WINS Server . . . . . . . :192.168.2.2
   NetBIOS over Tcpip. . . . . . . . : Disabled

Here's a client:
Host Name . . . . . . . . . . . . : BILLING1
        Primary Dns Suffix  . . . . . . . : cooperpsych.local
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : cooperpsych.local
                                           
cooperpsych.local

Ethernet adapter Local Area Connection:
        Connection-specific DNS Suffix  . : cooperpsych.local
        Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
        Physical Address. . . . . . . . . : 00-08-74-29-D7-DF
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.1.15
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
        DHCP Server . . . . . . . . . . . : 192.168.1.2
        DNS Servers . . . . . . . . . . . : 192.168.1.2
        Primary WINS Server . . . . . . . : 192.168.1.2
        Lease Obtained. . . . . . . . . . : Wednesday, June 14, 2006 3:58:21 PM
        Lease Expires . . . . . . . . . . : Thursday, June 22, 2006 3:58:21 PM


It looks like the consultant who set it up set WINS on the server as a 192.168.2.x address.  Is that right?
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 16917325
Well, at first glance, that looks ok - except your noted WINS server - change that to a 1.2 unless 2.2 is a valid network address with a WINS server on it... ?
0
 

Author Comment

by:citycoop
ID: 16917355
It's not.  How do I change it?
0
 

Author Comment

by:citycoop
ID: 16917357
And would that account for such a slow performance?
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 16917371
It could have a definite affect as the server would not be registered with WINS and not found as easily if it were.  Although in theory you don't need WINS at all, especially if you have no subnets, it shouldn't hurt having it as long as it's properly configured.  Go to the network control panel and get the properties of the network connection.  Click on TCP/IP and get the properties of that.  Click the Advanced button and go to the WINS tab and change the setting.
0
 

Author Comment

by:citycoop
ID: 16917382
done.  

anything else that would slow down the system so significantly?  also, curious why the gateway is 1.1, yet the ip of the server is 1.2.  Any thoughts?

-AC
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 16917416
The gateway should be a router - unless the server is your router, then it's probably right.

You might now want to reboot the server so it registers with the WINS server.
0
 

Author Comment

by:citycoop
ID: 16917442
will do.  anything else to look at?  performance logs, etc?

the box is running msexchange and sql server...

0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 16917516
No, that should be it for now - see if performance improves with the corrected WINS setting.
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16918772
You need to rerun the Configure Email and Internet Connection Wizard (CEICW -- linked as Connect to the Internet in the Server Management Console) after changing the WINS to the correct IP address.  A reboot is not necessary.  See http://sbsurl.com/ceicw for an overview.

Just to clarify what leew mentioned about WINS not being necessary.  With SBS it is still necessary because Exchange still requires it (http://support.microsoft.com/kb/837391).  Also, if you are going to use the Small Business Server Connection Manager (VPN) you will need WINS to resolve NETBIOS browsing of the network resources from remote clients.

Jeff
TechSoEasy
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 16927414
I've been seeing a lot of questions concerning network performance pop up lately.  They often seen to be unrelated as they are described, for example, just migrated to a domain, etc.  But there really have been a lot of them lately.

It may really just be unique issues and coincidences... but I can't help but wonder if it's related to a new Microsoft Patch.

If you wouldn't mind, on each domain controller you have, please run this command in a command prompt:
dir /ah /od %windir%\$ntun*
and copy and paste the entries between April 1, 2006 and today.

I'm not sure I'll be able to figure anything out with this - and maybe there is nothing to figure out... but who knows...
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16928410
leew... that sounds like a good theory as I've seen a number of these lately as well... But I don't think that it's patch related.  This question, for instance, has just been installed.  Some of the others have had specific issues that were apparent, INCLUDING not having WINS configured or misconfigured.

There have been 12 updates since April 1st, which are:
 
KB911562         
KB908981         
KB912812         
KB908531         
KB911567         
KB917734         
KB914389         
KB917344         
KB918439         
KB911280         
KB916281         
KB917953       

These have been installed on 19 networks that I manage and I have yet to see any performance issues on these systems at all.

One of the advantages of having so many SBS networks (all of which are configured pretty much the same) is that I am able to watch for trends which run across all of them, and can usually spot something that is causing problems.

Jeff
TechSoEasy
0
 

Author Comment

by:citycoop
ID: 16931054
Here's the ones installed since April 1:

06/16/2006  05:06 PM    <DIR>          $NtUninstallKB917734$
06/16/2006  05:06 PM    <DIR>          $NtUninstallKB917344$
06/16/2006  05:06 PM    <DIR>          $NtUninstallKB911280$
06/16/2006  05:06 PM    <DIR>          $NtUninstallKB914389$
06/16/2006  05:06 PM    <DIR>          $NtUninstallKB917953$
06/16/2006  05:06 PM    <DIR>          $NtUninstallKB916281$
06/16/2006  05:07 PM    <DIR>          $NtUninstallKB918439$
0
 

Author Comment

by:citycoop
ID: 16931070
Btw, when I run the Internet and E-mail Config Wizard, do I have to change anything or can I just use the "do not change" options for e-mail and internet?

0
 

Author Comment

by:citycoop
ID: 16931117
Just in case you need all of them:

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\Documents and Settings\Administrator>dir /ah /od %windir%\$ntun*
 Volume in drive C has no label.
 Volume Serial Number is 54D6-16EA

 Directory of C:\WINDOWS

04/20/2006  02:59 AM    <DIR>          $NtUninstallKB896422$
04/20/2006  02:59 AM    <DIR>          $NtUninstallKB896358$
04/20/2006  02:59 AM    <DIR>          $NtUninstallKB901214$
04/20/2006  02:59 AM    <DIR>          $NtUninstallKB904706$
04/20/2006  03:00 AM    <DIR>          $NtUninstallKB902400$
04/20/2006  03:00 AM    <DIR>          $NtUninstallKB896688$
04/20/2006  03:00 AM    <DIR>          $NtUninstallKB904782$
04/20/2006  03:00 AM    <DIR>          $NtUninstallKB896424$
04/20/2006  03:00 AM    <DIR>          $NtUninstallKB908519$
04/20/2006  03:00 AM    <DIR>          $NtUninstallKB912919$
05/05/2006  09:59 AM    <DIR>          $NtUninstallKB890046$
05/05/2006  09:59 AM    <DIR>          $NtUninstallKB899589$
05/05/2006  09:59 AM    <DIR>          $NtUninstallKB913446$
05/05/2006  09:59 AM    <DIR>          $NtUninstallKB911562$
05/05/2006  09:59 AM    <DIR>          $NtUninstallKB898715$
05/05/2006  09:59 AM    <DIR>          $NtUninstallKB910437$
05/05/2006  09:59 AM    <DIR>          $NtUninstallKB899591$
05/05/2006  10:00 AM    <DIR>          $NtUninstallKB899588$
05/05/2006  10:00 AM    <DIR>          $NtUninstallKB896428$
05/05/2006  10:00 AM    <DIR>          $NtUninstallKB908981$
05/05/2006  10:01 AM    <DIR>          $NtUninstallKB912812$
05/05/2006  10:01 AM    <DIR>          $NtUninstallKB911927$
05/05/2006  10:01 AM    <DIR>          $NtUninstallKB898792$
05/05/2006  10:01 AM    <DIR>          $NtUninstallKB911567$
05/05/2006  10:01 AM    <DIR>          $NtUninstallKB908531$
05/05/2006  10:02 AM    <DIR>          $NtUninstallKB899587$
05/05/2006  10:02 AM    <DIR>          $NtUninstallKB901017$
05/05/2006  10:02 AM    <DIR>          $NtUninstallKB893756$
05/05/2006  10:02 AM    <DIR>          $NtUninstallKB900725$
05/05/2006  10:02 AM    <DIR>          $NtUninstallKB905414$
06/16/2006  05:06 PM    <DIR>          $NtUninstallKB917734$
06/16/2006  05:06 PM    <DIR>          $NtUninstallKB917344$
06/16/2006  05:06 PM    <DIR>          $NtUninstallKB911280$
06/16/2006  05:06 PM    <DIR>          $NtUninstallKB914389$
06/16/2006  05:06 PM    <DIR>          $NtUninstallKB917953$
06/16/2006  05:06 PM    <DIR>          $NtUninstallKB916281$
06/16/2006  05:07 PM    <DIR>          $NtUninstallKB918439$


Also, is there a performance manager that can be run to see what's taking up processor and memory?
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16931257
When you posted the first lot and said they were from April 1, I got a bit worried... since you were missing all of April's patches.  But now I see that they are there...

I take it that your original software had Service Pack 1 included?  

When you run the CEICW, I wouldn't select the "do not change" because you really want to make sure that the WINS server registration goes through to both your DHCP settings and the Exchange Server's settings.  

Jeff
TechSoEasy
0
 

Author Comment

by:citycoop
ID: 16931294
I'm guessing SP1 was installed.  It's a brand new server from Dell (dual xeon 3.2, 2gb ram, 3-drive raid5)

WINS helped a little.  I'll re-rerun the wizard and see what happens.

0
 

Author Comment

by:citycoop
ID: 16931308
Also, looking at the event viewer, there are a bunch of msexchange errors/warnings over the last few days, many of which seem to be repeating themselves:

Warning - MSExchangeIS Mailbox (2000) Verify that the Microsoft Exchange MTA service has started. Consecutive ma-open calls are failing with error 3051.

Error - MSExchangeDSAccess: (2102) Process MAD.EXE (PID=3204). All Domain Controller Servers in use are not responding:

Error - MSExchangeSA (9154) DSACCESS returned an error '0x80004005' on DS notification. Microsoft Exchange System Attendant will re-set DS notification later.

Error - MSExchangeIS Public Store (7200) Background thread FDoUpdateCatalog halted on database "First Storage Group\Public Folder Store (S1)" due to error code 0x80004005.

Error - MSExchangeAL (8250) The Win32 API call 'DsGetDCNameW' returned error code [0x862] The specified component could not be found in the configuration information.  The service could not be initialized.  Make sure that the operating system was installed properly.

Error - MSExchangeAL (8026) LDAP Bind was unsuccessful on directory S1.cooperpsych.local for distinguished name ''. Directory returned error:[0x51] Server Down.    
0
Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16931316
How often are those repeating... because those are normal errors when you reboot your server.  Are they happening at times that you are not rebooting?

Jeff
TechSoEasy
0
 

Author Comment

by:citycoop
ID: 16931335
Not sure.  I'll have to ask the people in the office.  

I was just looking at stuff trying to figure out why it's still running slow.

0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16931402
You shouldn't have to ask anyone if you have access to the log files... there would be an information entry in the SYSTEM Event log with event ID 6009 which indicates that the server was just started.  If these errors are either immediately before or after an event 6009, then that's what's causing the problem.

Normally, though, your server shouldn't need to be rebooted except when major updates require it.

Jeff
TechSoEasy
0
 

Author Comment

by:citycoop
ID: 16931410
Don't see any 6009 errors in the System event log after 6/16/06.

0
 

Author Comment

by:citycoop
ID: 16931414
Is there anyway for me to post the log files for you to look at?
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16931425
They wouldn't be errors, but rather informational entries.  In any case, you can upload a file for this question here:
https://filedb.experts-exchange.com/incoming/ee-stuff/219-holdingfile.txthttps://filedb.experts-exchange.com/incoming/ee-stuff/220-Log_Files.zip


To create the file open the Event Viewer, click on System, and then Action > Export List...

Jeff
TechSoEasy
0
 

Author Comment

by:citycoop
ID: 16931433
Uploaded a zip files with all the log files except security.  Really interested in your thoughts... thanks!!!
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16931441
I don't see it there, did it complete yet?

Jeff
TechSoEasy
0
 

Author Comment

by:citycoop
ID: 16931455
Sorry, didn't realize there was a 4mb limit.  Posted it here:

http://www.tapelog.com/logs/

Please let me know if that works.
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16931496
Well, there may be a 4MB limit, but your file was only about 300KB, so I've uploaded it here in case anyone else wants to look:
https://filedb.experts-exchange.com/incoming/ee-stuff/220-Log_Files.zip

I'll take a look and let you know...

Jeff
TechSoEasy
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16931526
Well, just an initial look shows that you have a serious problem with your DNS.  Did you attempt to change your internal domain name and/or IP Address Subnet after you installed the server?

There are entries which show DNS zones for both cooperpsych.local and cooperpsych.com, and reverse zone entries for 192.168.1.x and 192.168.2.x.

Jeff
TechSoEasy
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16931530
P. S.  Kudos to leew for stating that at the very START of this thread!
0
 

Author Comment

by:citycoop
ID: 16931541
Originally there were 2 NIC cards - one was going to be for internal and one external.  The primary sortware, that contact/office manager package, kept arbitrarily switching between the 2 cards.  We contacted the software manufacturer who told us there's no way to bind the software to one card, so we had to remove one.

The remaining card is the 192.168.1.x address.  I'm also guessing that the .com was to run the webpage, which hasn't even been setup. (the box was for the main software, exchange and web access).

Any suggestions for fixing the problem?
0
 
LVL 74

Accepted Solution

by:
Jeffrey Kane - TechSoEasy earned 250 total points
ID: 16931661
Well, now it's starting to make a bit more sense.  

I'm wondering if you removed the NIC correctly.  It may still be ghosted somewhere in your Active Directory, and it's surely causing issues in your DNS.

Now as I look back over the first IPCONFIG you posted I see that there is an inconsistency we didn't notice before.  We DID notice that your WINS entry was 192.168.2.1, but what we didn't see... your workstation's WINS entry was actually correct.  Obviously there's something not right when that happens.  

My concern here is that the extent of these problems may be beyond what we are seeing here... the proverbial Tip of the Iceberg.

I am also concerned that while you are eager to resolve this, your limited experience and skill level in this area may make it such that this is not the best use of your time.  I also recognize that you had a less than successful engagement with your initial IT consultant, but to be honest, this is probably something that a skilled IT professional could resolve in a few hours at most... or at least within the first hour or so be able to tell you that you would have to reinstall the entire Operating System (yes, that is a possibility here... because sometimes that will take less time than continuing to troubleshoot and repair).

It's really too bad that the software manufacturer said there is no way to bind the software to one card... because it never should have even seen the second card if things were configured properly to begin with.  Also... whatever the .com was for, it shouldn't have been configured in your local DNS, as that is something that should be configured at your registrar or ISP public zone.  There doesn't have to be ANY local configuration for that.

So... now that disclaimers are out of the way.. the best thing to do would be to review your DNS zone files and see what's what.  It would also be important to review the DNS information in Active Directory.  To access that info you need to use Active Directory Users and Computers > View -- Advanced Features > Then expand System > MicrosoftDNS.

Jeff
TechSoEasy

0
 

Author Comment

by:citycoop
ID: 16931727
Another consultant it is...

Thanks!
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16932265
A couple of suggestions for you in the mean time.  

I did a quick port scan against your network... you seem to have the POP3 Service enabled and port 110 open on your router.  This is not a good idea, and it could definitely cause performance issues, it's also an unnecessary security risk.  There's generally no reason to run the POP3 service on an SBS because this is only for users who want to retrieve email from your server, and that is best done with Outlook Web Access or RPC over HTTPS.  To fix it, open up the Services Management Console and disable the POP3 Service.  Then, make sure that port 110 is not enabled on your router.

Also, you have port 80 open, which again has no good use unless you are hosting a business-card website for your organization.  (Hosting of a larger public website is not advised since again, it would use up too many resources on your server, and it is a major security risk).

It also looks like you have ports 53, 139 and 4444 open -- these should definitely be closed!  

You should have port 444 open for SharePoint and 1723 if you want VPN enabled, but they're not.

All of these should be able to be configured automatically with the CEICW if you have a UPnP enabled router.  If you don't have a UPnP enabled router then you will have to manually change the settings on the router... but you should still run the CEICW and uncheck the box for "Business Web Site - Port 80" at the very least.

As for another consultant, I'd suggest that you find someone in your area that is qualified to work with Small Business Server specifically... you can locate one through this directory:  http://www.microsoft.com/smallbusiness/partner/vendorsearch.mspx

Jeff
TechSoEasy
0
 

Author Comment

by:citycoop
ID: 16935542
Jeff,

DNS was the answer.  Another IT consultant spent 3 hours rebuilding it and everything is working as expected.

A huge thanks to you, leew and everyone else for all the help!!!

-Adam
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16937531
Adam,

Glad you got it working... sometimes the best thing to know is when to stop troubleshooting.

Jeff
TechSoEasy
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 17015517
I don't know... but somehow I think I should have shared in that - and the accepted answer makes NO SENSE whatsoever.
0
 

Author Comment

by:citycoop
ID: 17017510
Leew / Jeff...

Sorry, didn't realize you could share an "accept".  I'll go figure out how to do that...

Thanks again for all your help!

-AC
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

How to fix error ""Failed to validate the vCentre certificate. Either install or verify the certificate by using the vSphere Data Protection Configuration utility" when you are trying to connect to VDP instance from Vcenter.
VM backups can be lost due to a number of reasons: accidental backup deletion, backup file corruption, disk failure, lost or stolen hardware, malicious attack, or due to some other undesired and unpredicted event. Thus, having more than one copy of …
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now