Intermittent internet for Windows 7 Laptops

Posted on 2011-02-12
Medium Priority
Last Modified: 2012-06-22
Hello, I have a head scratcher

I have an issue with a client where the windows 7 clients are experiencing intermittent internet / network drop outs. XP clients seem to be fine. These clients are members of a SBS 2003 domain.

The first sign is the client does not have internet connectivity.
The machines can still access all network resources.
While IE and/or Firefox are “clocking” trying to open a page, I was able to successfully perform an NS Lookup in command line. External DNS was verified.
Disabling and enabling the NIC ‘sometimes’ resolves the issue for a short while.
This issue happens randomly throughout the day.
Three of the affected laptops are HP’s-- 2 dv4’s and one dv6
These machines worked fine with windows 7 home premium. (Not members of the domain)
All of our Win 7 are having the same issue. I have tried the following...
Disabled Power management on the NIC
Disabled IPv6
Disabled Teredo
Disabled the firewalls
Removed Antivirus
set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet\EnableActiveProbing = 0
installed the latest revision of NIC drivers
Removed and reinstalled NIC drivers/Adapters
Formatted and reinstalled windows on one machine
We did an anytime upgrade to win7 pro, joined them to the domain and a few days later the problem began.
I first thought the drivers were an issue so I replaced/reinstalled drivers. Still persisted
Then I thought it was the users profile, turns out the problem affects even the local users and domain admins logins as well.
I formatted the hard drive on one dv4 and did a clean reinstall of win 7 pro 32 bit to see if that changed anything. It didn’t. Still would happen with a clean machine.
Yesterday while onsite; I experienced the issue on my personal laptop, a HP dv6700. I had not had any issues before yesterday.
I had three machines set up on a counter:
Left to right LT1 LT2 and LT 3:
While transferring data from LT 1 to server share, I suddenly lost Web access on Lt2. I tried LT1 and it worked. Then on LT3 I tried and it failed. Tried LT 1 again and it failed. Then LT2 worked. Then LT 3 worked. LT1 also worked. Then LT 3 stopped working, so did LT1 but LT 2 worked.
I was able to log into the two wireless access points with all 3 even though I couldn’t get an external website to open. On LT3 I was able to log into the Firewall a ZyWall USG 100.
I then looked at the log file and saw that the IP addresses from all 4 laptops (mine was included) were being blocked access to the internet. (INTERMITTENTLY)
 I am beside myself trying figure out why
---only the laptops with windows 7 are affected
---This happens on wireless and hardwired connection
---It is intermittent
---And only started a couple of weeks ago.
Zwall USG 100 firmware version 2.20(AQQ.1) / 1.12 / 2010-05-06 11:21:04
Laptops affected are 2 hp dv4’s 1 HP dv6, 1 HP dv6700
Can anyone offer any new ideas or has anyone else seen this?
Thanks in advance for helping me.
Question by:TGentry2010

Expert Comment

ID: 34879275

Sounds like an incompatible NIC driver.  Windows 7can download and replace drivers with "compatible" ones through security updates, of all places.  Check your hotfixes under event viewer and ensure they haven't been changed from your manufacturer driver since you started to experience the problem.

Author Comment

ID: 34879307
That was my first thought too, however Ive done all that and more.
The fact that takes me away from that idea is that the NIC is still connected to the newtwork and all local resources are still available. I can even resolve names of external websites using NSLOOKUP in a command prompt--. they just wont open in a browser. I can open and log into the GUI of the Wireless access points and the Firewall-- as well as VNC into other machines. all local networking is good,External web pages will not load.

Expert Comment

ID: 34879519

All these machines access to local resources and Internet through wireless or wired network, I am assuming this because you said you can log into the GUI of the  "wireless access points".

Secondly, Can you verify there is no interference in your area which might be disturbing the wireless connectivity, just as a pre-caution do check it.

If you connect to your Internet Router directly can you browse without any interruption or it still gives you the same problem?

at the time when the any machines cannot browse , have you tried to do the nslookup and see the results, also which Anti-Virus are you using and does it include any Intrusion Prevention System e.g. McAfee HIPS

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.


Author Comment

ID: 34879635
==(All these machines access to local resources and Internet through wireless or wired network, I am assuming this because you said you can log into the GUI of the  "wireless access points". )

That is correct

The issue occures on both wired and wireless and other (XP) machines have no issue either wired or wireless.

Antivirus is uniform across the network (ESSET NOD32) and I even tried one of these laptops without it even installed. I ahev also tried it while AV was turned off.

the one exception was MY laptop which is runnign a different AV (Corporate Norton V11) I tried with it turned off as well.

Yes NSLOOKUP was successful while unable to open web page in browser.
and before its asked let me say I tried IE, Firefox, Chrome and Safari

My laptop is not a member of the domain.

the only 2 common threads are Windows 7 and the ACCESS BLOCKED log entry

Let me qualify with this statement:

NONE of these machines have any issue OUTSIDE this network.

Which brings me to the Firewall. I cannot understand why the IP's would be blocked with no rule to that effect and it happens intermittently. AND it only hapens to these machines.

Connecting directly to the Firewall is not an option and really wouldnt answer the question anyway.

Accepted Solution

TGentry2010 earned 0 total points
ID: 34880170
I think I may have fixed my own problem. (or at least found the root cause)
I won’t be able to verify until Monday though.
In the ZyWall there was a deny rule configured:
Priority= 10, From: WAN to ANY (excluding ZyWall), User=ANY, Source=ANY, Destination=ANY, Service=ANY, Access=DENY
I noticed that in the log file where the local IP was Blocked, that it was this priority rule every time.
I disabled it and monitored the log, no further entries with local IPs being blocked access to external ports so far.
The client’s employees will not return to the office until Monday. I will post results then.
Thanks for the suggestions. If there are any other ideas (in case I am wrong) please let me have them.

Author Comment

ID: 34880180
I still find it odd that the only "reported" machines that were affected were the laptops we upgraded to Windows 7 Pro. However, I did see log entries for other machines. One being the main Domain controller. (SBS 2003)


Expert Comment

ID: 34881389
I agree with your finding that it might be ZyWall blocking client but then why only windows 7 and not XP clients.

the only difference I can understand is that default windows 7 activates the IPv6 and this might be playing with ZyWall and it was blocking the clients.

do let me know on Monday.

Author Comment

ID: 34882783
I had thought of that, The second thing i did after replacing drivers was disable IPv6 and Teredo though.On all adapters. Even the VPN adapter.

Author Comment

ID: 34882795
I almost convinced that other machines were affected and just not reported. with it being intermittent, it is hard to say with for sure.

I will post what I find out after Monday.

thanks again
LVL 33

Expert Comment

ID: 35115477
This question has been classified as abandoned and is being closed as part of the Cleanup Program. See my comment at the end of the question for more details.

Featured Post

A Cyber Security RX to Protect Your Organization

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
While working, an annoying popup showing below will come and we cannot cancel or close it form the screen. The error message will come again and again.
In this Micro Tutorial viewers will learn how to use Boot Corrector from Paragon Rescue Kit Free to identify and fix the boot problems of Windows 7/8/2012R2 etc. As an example is used Windows 2012R2 which lost its active partition flag (often happen…
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.
Suggested Courses
Course of the Month13 days, 20 hours left to enroll

807 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question