Link to home
Create AccountLog in
Avatar of mtk4590
mtk4590Flag for United States of America

asked on

xp workstations go offline

We have a 10 workstation network, 5 win 7 and 5 win xp, connecting to sbs 2008 with exchange 2007.  At least 3 times a week, xp workstations will suddenly go offline and they no longer have access tp folders or their timeslips program. The only recourse has been restarting the server, sometimes twice to get the xp wrkstns back online. Everything works great after until the next morning.  This started after uninstalling Trend micro's worry free internet security. I re-installed trend and it did not improve.  Any ideas?
Avatar of Gabriel Clifton
Gabriel Clifton
Flag of United States of America image

Trend probably made some changes to how the server handles the nic to better protect the data passes through. Unfortunately, this is happening and you probably are not getting the program installed back exactly as it was to try to correct this. See if uninstalling the network adapter and reinstalling it works. We'll start from there.
Avatar of arnold
Are all systems/network on a 1GB network?
Ipv6 enabled on the XP systems?
Check the DHCP configuration to make sure that the issue is not with it I.e. the XP IP lease expires and the DHCP server is i reachable or non responsive.

If you want to test this, pick an xp workstation and assign it a static IP n the network.  Then see whether all XP workstation experience the issue again or whether all except the static one run not the issue.
Avatar of mtk4590

ASKER

I will assign static ip addresses and try that tonight.  I had already updated the driver for the network but i did not uninstall and re-install the network card yet.
It is a 1gb network, no ipv6. Thanks
Avatar of mtk4590

ASKER

I assigned a static IP address and it appeared to work at first and the workstations syncronized etc...  the next morning I started getting the calls-can't get email, we are offline again and they could not get to the company internal website.  
I changed back to DHCP assigned IP and it went back to normal.  in the event logs, I notice 10 Distributed COM critical errors every morning.
Check your switches/firewall to make sure that they don't auto-lockout these systems.
Do you use 802.1x access control on your switches?
Avatar of mtk4590

ASKER

It is on a sonicwall tz180 with an unmanaged switch.
Are there any events on the firewall?  What are the network configuration? Are they set to auto negotiate?
Avatar of mtk4590

ASKER

No major events on the firewall.  Auto negotiate is on for everyone.
the event viewer is loaded with 2700 entries of the following  event log, i hope it helps to shed light on an answer:
Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          12/5/2012 8:43:18 AM
Event ID:      10016
Task Category: None
Level:         Error
Keywords:      Classic
User:          NETWORK SERVICE
Computer:      CHAMBERS.******.local
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{61738644-F196-11D0-9953-00C04FD919C1}
 to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="49152">10016</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-12-05T13:43:18.000Z" />
    <EventRecordID>1811296</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>CHAMBERS.bandf.local</Computer>
    <Security UserID="S-1-5-20" />
  </System>
  <EventData>
    <Data Name="param1">application-specific</Data>
    <Data Name="param2">Local</Data>
    <Data Name="param3">Activation</Data>
    <Data Name="param4">{61738644-F196-11D0-9953-00C04FD919C1}</Data>
    <Data Name="param5">NT AUTHORITY</Data>
    <Data Name="param6">NETWORK SERVICE</Data>
    <Data Name="param7">S-1-5-20</Data>
    <Data Name="param8">LocalHost (Using LRPC)</Data>
  </EventData>
</Event>
Did you notice this in your log

"The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{61738644-F196-11D0-9953-00C04FD919C1}
 to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool."
ASKER CERTIFIED SOLUTION
Avatar of mtk4590
mtk4590
Flag of United States of America image

Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
Avatar of mtk4590

ASKER

abandoned the question long ago