Link to home
Start Free TrialLog in
Avatar of kgeiger81
kgeiger81Flag for United States of America

asked on

DHCP clients cannot contact/connect to Domain Controller

I have been working on this for the last couple of hours now with no luck.  I have an SBS 03 Prem R2 box and as of this afternoon network connectivity has been down.  The client computers cannot connect to the server at all.  I can ping the clients from the server but the clients cannot ping the server.  The clients can ping each other and the router though.  I have checked all of the usual suspects.  First checked the cable from the server to the switch, its good.  Tried a different port and it didn't change anything.  DHCP is running, DNS is running, IPSEC is running.  There have been no major changes done in the last 24 hrs.  I went as far as going out and buying a new NIC and I'm still having the same problem.  I also bypassed my switches and connected the server to a different switch and connected my laptop to the same switch and tried to ping it with no luck.  I am at a complete loss here and I don't know what I am overlooking.  Any suggestions??
ASKER CERTIFIED SOLUTION
Avatar of Michael Ortega
Michael Ortega
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Also, have you checked the event logs? Anything stand out? I've seen the IPSec driver go into Blocked mode after some windows updates. Typically rebooting the server will resolve the issue.

MO
Avatar of kgeiger81

ASKER

Firewall is disabled, antivirus is disabled, I'm not running a IPSec policies and I also tried disabling that as well.  I checked the event log many times and there is nothing unusual showing up.  I have rebooted 3 times already with no change.  I just tried running a packet capture on the Nic and the report is showing DNS queries from the clients to the server IP but they still cannot connect.  
Your server and clients are all on the same broadcast domain, right? Same subnet?

MO
Yes they are, same domain and subnet.
Can you post the capture? If it's a .cap file just rename it to .zip and upload it. Don't try to zip the .cap file, because the file upload features on EE will scan the contents and block it.

MO
Attached is the packet capture which only includes 100 packets.  It opens in somewhat formatted in wordpad.
Packet-Capture
sounds like a virus
something block the connection between the server and your clients...chech the antivirus..some of viruses do that..scan your files online..
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I didn't think about the possibility of it being a virus.  I had a problem about six months ago where i got a virus and it didn't allow me to open a specific console.  Anyhow, RobWIll I am only running one NIC in the machine and all of my VPN connections are handled by my Sonicwall router so the routing and remote access service is already disabled.  I will run an online scan when I go back to the office this morning.  Thank you all for your suggestions thus far.  I will post my findings after I run a scan.
You mentioned buying a new NIC. Though I appreciate the problem existed before this, you MUST use the Change server IP wizard, even if making no changes, after installing, and then run the CEICW.
Can you get a NetMon capture and post it? Not enough details in the capture you posted.

MO
I ran a virus scan and it did find a few bugs and I removed them.  I checked to make sure that RRAS was not running and for whatever reason it was running.  I ended up disabling it and restarted the machine and that ended up being the problem.  I'm not sure why that service was enabled and the only thing I can think of is that one of the bugs could have enabled it.  Thanks for all of your help.
Thanks kgeiger81. Good to hear you were able to resolve.
Cheers!
--Rob