Windows Server 2008 R2 Distributed File System issues

Do you also get DCOM errors when using command line management (DFSCMD)?  When this failure occurs, does anything show up in the Event Logs?

DrUltima

The "DFSCMD /view <share> /full" command returns what is expected without errors.

Here is the event error when running the report:

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          4/27/2011 10:56:56 AM
Event ID:      10009
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      OW-FS03.domain.local
Description:
DCOM was unable to communicate with the computer ow-fs01.domain.local using any of the configured protocols.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="49152">10009</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-27T15:56:56.000000000Z" />
    <EventRecordID>1913</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>OW-FS03.domain.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">ow-fs01.domain.local</Data>
    <Binary>3C5265636F726423313A20436F6D70757465723D286E756C6C293B5069643D3635363B342F32372F323031312031353A35363A35363A3233343B5374617475733D313732373B47656E636F6D703D323B4465746C6F633D313731303B466C6167733D303B506172616D733D313B7B506172616D23303A307D3E3C5265636F726423323A20436F6D70757465723D286E756C6C293B5069643D3635363B342F32372F323031312031353A35363A35363A3233343B5374617475733D2D313037333630363634373B47656E636F6D703D323B4465746C6F633D313436343B466C6167733D303B506172616D733D303B3E3C5265636F726423333A20436F6D70757465723D286E756C6C293B5069643D3635363B342F32372F323031312031353A35363A35363A3233343B5374617475733D2D313037333630363634373B47656E636F6D703D31383B4465746C6F633D3239323B466C6167733D303B506172616D733D303B3E3C5265636F726423343A20436F6D70757465723D286E756C6C293B5069643D3635363B342F32372F323031312031353A35363A35363A3233343B5374617475733D36343B47656E636F6D703D31383B4465746C6F633D3239303B466C6167733D303B506172616D733D313B7B506172616D23303A307D3E</Binary>
  </EventData>
</Event>

10009 is a pretty generic error and can be caused by a host of different things, from drivers to peripheral hardware to viruses to misconfiguration in the system.  Can you give us a little more info on what is on that server, what it does other than DFS, etc.?

DrUltima

I think I have discovered the issue.  It is a firewall issue, but not blocking - NATting.  I will have to wait until tonight to push out the updated policy.

David

That would definitely be problematic. I will continue to monitor and wait for your update.

DrUltima

OK, so the NATting issue was a non-issue.  Traffic is going through - there is no blocking of ports 135 or 445 or any other ports.  I have TCPDUMPs from my firewall that shows the traffic.  I am at a loss now.  Let me know if you would like to see that TCPDUMP file.

David

Well, I think I found the solution and it is the firewall if this is correct.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk33371

I will push policy tonight and test and update the question tomorrow.

David

Thanks for the update!  I will continue to monitor....

DrUltima

I was able to find an answer to my own issues.  In hindsight, this was as much a Checkpoint firewall issue as it was a MS Server issue, so I should have put it in that category as well.