Solved

Master Browser anomaly

Posted on 2006-06-30
20
564 Views
Last Modified: 2012-06-22
I have a Master Browser issue I’m trying to resolve. After the last set of MS Updates (June/06) one of my multi-homed DC’s suffered OS damage and the browse service was lost.

I have since reinstalled the NIC drivers (presently using single card), & WINS (was corrupted), then ran netdiag /fix and corrected anything noted, then purged all pertinent WINS/DNS records and made sure the controller records were gold. Next I ran Nbtstat -R, Nbtstat -RR, Ipconfig /flushdns, Ipconfig /registerdns. I then restarted NetLogon services, also stopped WINS and ran ““jetpack wins.mdb temp.mdb” then started WINS.

The Browser service now runs but Network Neighborhood browser shows clients that are not attached or even powered up. The browser splash is static.

I rebooted the DC and checked again but same issue.

Browstat status shows proper transport device\proto information.
Browstat dumpnet shows “Api call returned 50” instead of expected output. Which implies a binding issue.
I noticed DHCP (other DC) shows clients (that are not logged in, powered on, etc) as having active leases when they shouldn’t.

I see no relative events in the viewer of the Master Browser DC.
The other DC post the expected “The browser has forced an election on network \Device\NetBT_Tcpip_{47152109-9B1D-4D46-95BD-99B8EC06EAEC} because a Windows Server (or domain master) browser is started.” Message.

I’m guessing the graceful shutdown of the end stations was never received properly at the DC’s so DHCP and WINS are frozen for these clients.

I’ve restarted DHCP Client/Server on the DC without any progress.

I would appreciate any insight you might provide.

Thank you in advance for your time.

Mark
0
Comment
Question by:MarkMan
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 11
  • 9
20 Comments
 
LVL 26

Expert Comment

by:Pber
ID: 17020135
Sounds like a corruption on the NICs somewhere.  

What you could try is:
Delete the NICS in Device Manager.
Then do a redetect.

Sometimes this shakes things up enough to help Windows bind to everything properly again.
0
 

Author Comment

by:MarkMan
ID: 17020262
I had done this already but gave it another try without success.
0
 
LVL 26

Expert Comment

by:Pber
ID: 17020290
wasn't sure you mentioned you replaced the driver.

Check HKLM\System\CurrentControlSet\Services\Browser\Parameters:

What do you have in IsDomainMaster?  Should be "True"
What do you have in MaintainServerList?  Should be "Auto"
0
How our DevOps Teams Maximize Uptime

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us. Read the use case whitepaper.

 

Author Comment

by:MarkMan
ID: 17020458
What do you have in IsDomainMaster?  Should be "True"
Prior to last reboot was True, Upon check was False, I changed back to True
What do you have in MaintainServerList?  Should be "Auto"
Correct

Checked via Browstat Status both before and after Reg hack both stated this DC was Master Browser.

I'm afraid I have to wait to continue working on this as I'm on holiday until the 14th. I thank you for your reponses so far and look forward to working with you later.

Thank You
0
 
LVL 26

Expert Comment

by:Pber
ID: 17020463
Have fun, ttyl
0
 

Author Comment

by:MarkMan
ID: 17042102
OK I'm back in-house.
Checked this morning and the server stats for following are

IsDomainMaster "True"
MaintainServerList "Yes"

The other controller is as follows
IsDomainMaster "False"
MaintainServerList "Auto"

Browstat status shows proper post with exception to last line.
"Unable to retrieve server list from _____:64
0
 
LVL 26

Expert Comment

by:Pber
ID: 17042143
Back early?  That can't be good. (:

Anyhow check out this link:

http://www.experts-exchange.com/Networking/Q_21555144.html
0
 

Author Comment

by:MarkMan
ID: 17043105
Yes I looked at Browstate but since nothing is missing it didn't pan out.
The issue (other than the "Unable to retrieve server list from _____:64") is that the Network Neighborhood info is static.

The only other item I've noticed is that DHCP shows a few IP's active that are not. WINS & DNS seem healthy.
0
 
LVL 26

Expert Comment

by:Pber
ID: 17043166
Is the TCP Netbios helper running on the DC?
0
 

Author Comment

by:MarkMan
ID: 17043209
Yes on both of them
0
 
LVL 26

Expert Comment

by:Pber
ID: 17043257
What are the outputs for the following:

nbtstat -a YourPDCe
nbtstat -a yourBDC
0
 

Author Comment

by:MarkMan
ID: 17043369
PDC
DALETH         <00>  UNIQUE      
DALETH         <20>  UNIQUE      
CAMELOT        <00>  GROUP      
CAMELOT        <1C>  GROUP      
DALETH         <03>  UNIQUE      
MENSVR         <03>  UNIQUE      
CAMELOT        <1B>  UNIQUE      
CAMELOT        <1E>  GROUP      

Bdc
ALEPH          <00>  UNIQUE      
CAMELOT        <1C>  GROUP      
CAMELOT        <00>  GROUP      
ALEPH          <20>  UNIQUE      
ALEPH          <03>  UNIQUE      
CAMELOT        <1E>  GROUP      
CAMELOT        <1D>  UNIQUE      
..__MSBROWSE__.<01>  GROUP      
0
 
LVL 26

Expert Comment

by:Pber
ID: 17045495
We're getting in deep here, but look in the registry of the bad server and look for the the NIC key:

The NICS will be located at
HKLM\SYSTEM\CurrentControlSet\Services\{Adapter}\Parameters\Tcpip]
(where {Adapter} equals the service name of the installed network card. This might be a guid)  In your case from the the first message the guid would be {47152109-9B1D-4D46-95BD-99B8EC06EAEC}

You might want to take note to see if the old nic that you removed is still in here.  I know sometimes when I have nic issues and delete Local Area Connection and it redetects it as Local Area Connection 2, it is because the first NIC is still in the registry at the above key.  I usually axe the NICs from the registry as well as Computer Management Hidden then redetect.  You mgith want to try that.

Now if the old NIC is still in there, it still might be bound to Netbios/NetBT.  Look in the following keys:

HKLM\System\CurrentControlSet\Services\NetBT\Linkage
HKLM\System\CurrentControlSet\Services\NetBios\Linkage

Look at the Bind\Export\Route values.  These might have your old NIC present and the Browser Service is bound to the old non present nic.  you'll notice these values match your {Adapter} value from above.

Compare these settings between the two and you might find something.
0
 

Author Comment

by:MarkMan
ID: 17045539
Thanks I will look into this.

I have gotten the splash from Network Neighborhood to change since the last email. I'll know in the morning once the clients gracefully power down tonight if the Browser is now dynamic.

I'll post you once I know if it's functioning properly, the Reg content, and the latest browser related problems.
0
 

Author Comment

by:MarkMan
ID: 17045760
The Reg KLM\SYSTEM\CurrentControlSet\Services\{Adapter}\Parameters\Tcpip] & HKLM\System\CurrentControlSet\Services\NetBios\Linkage look good.

Not much to see at HKLM\System\CurrentControlSet\Services\NetBT\Linkage

So I guess Reg NIC is gold. How about the Computer Management Hidden then Redirect, you've got me on this one. I'll need more clues please.
0
 
LVL 26

Accepted Solution

by:
Pber earned 400 total points
ID: 17045937

> So I guess Reg NIC is gold. How about the Computer Management Hidden then Redirect, you've got me on this one. I'll need more clues please.

I thought I mentioned this already, but must have been a different post.

Anyhow, I go into the Device Manager and select View show hidden devices, then the NIC tree and delete all the NICS.  When you just pull a nic the entry remains.  So I delete the hidden ones.  then I load the registry and hack them out of there. Then I do a redetect.
0
 

Author Comment

by:MarkMan
ID: 17049801
You may have mentioned it previously, the updates damaged two other servers so I've been doing multiple threads, it probably was an oversight on my part.

I checked network neighborhood and it seems to be dynamic now. I just have a little Wins issue and "Ta Da!".

I can't believe I've never utilized the "show hidden" before, did reg hacks previously. Ok the NIC's are clean in device manager also.

I'll follow up shortly.
0
 

Author Comment

by:MarkMan
ID: 17050548
I think I've got it now.
Thanks for all your help.
0
 
LVL 26

Expert Comment

by:Pber
ID: 17050560
So did things clear up on their own or did you find something?
0
 

Author Comment

by:MarkMan
ID: 17050612
I had re-installed Wins on one of the servers, rebooted, tweaked Reg as per our notes.
This morning the browser seemed dynamic and the only remaining issue was a wins record (no master browser).

I changed reg to reflect PDC=Master browser, then purged all Wins records for both servers, rebooted both servers.
Now it seems happy, will know for sure in the morning.

Basically looking at what we did and what I did- I dismantled & re-installed Wins (kept partners off until list stabized), rmv'd & added NIC's, cleaned Dns, Wins, checked Dhcp, hacked Reg.

Sooooooooo
Nothing new, just kept doing and undoing until servers were happy.
0

Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Organizations create, modify, and maintain huge amounts of data to help their businesses earn money and generally function.  Typically every network user within an organization has a bit of disk space to store in process items and personal files.   …
by Batuhan Cetin In this article I will be guiding through the process of removing a failed DC metadata from Active Directory (hereafter, AD) using the ntdsutil tool in a Windows Server 2003 environment. These steps are not necessary in a Win…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

737 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question