Solved

Windows Server 2012 shares crashing

Posted on 2014-01-06
9
3,636 Views
Last Modified: 2014-04-14
Hi

I have a a network set up with Windows Server 2012 and about 35 users all on Windows 7 Professional. I recently added some shares to a set of pre-existing shares. After doing this each client began began losing their connection to the 2012 file server and the connection for the shares is lost. After the connection to the share drops it will come back within 2 or 3 minutes. This happens on a regular basis (every one hour) throughout the day. The error message ID in Event Viewer on the file server is 30623.
0
Comment
Question by:lasirius
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
9 Comments
 
LVL 54

Expert Comment

by:McKnife
ID: 39761694
Hi.

The smb shares use port 445. Please monitor if 445 is continuously open by using this tool: portping http://www.tkolb.de/download/dl.php?download=portping_win.rar
Also see if the service called "server" is constantly running.
0
 

Author Comment

by:lasirius
ID: 39762775
The Server service is running continuously but port 445 closes at the time of the crash.
0
 
LVL 54

Expert Comment

by:McKnife
ID: 39762793
Good, that's the problem. Please make sure that the service is really not crashing: open eventvwr and look into the system log for service manager events.
0
SendBlaster Pro 4 - Bulk Email Sending Software

SendBlaster 4 Pro - Best Bulk Emailing Sending Software
Automatic Subscribe / Unsubscribe Processing
Great for Newsletters & Mass Mailings
Optional HTML & Text Composition
Integration with Google Features
Built in Spam Score Checking
Free Professional Templates - Feature Packed!

 

Author Comment

by:lasirius
ID: 39766366
The service is not crashing. This is the only error in event viewer:

UNSVMFILE01      30620      Warning      Microsoft-Windows-SMBClient      Microsoft-Windows-SMBClient/Operational      1/8/2014 1:49:19 PM

I am not sure how to determine what is causing the port to close. Do you have any advice?
0
 
LVL 54

Accepted Solution

by:
McKnife earned 500 total points
ID: 39766419
No further text accompanying the warning? Does that warning at least only appear while in error state? And what about event 30623 you mentioned before?
Did you try to unshared those new shares and then restart the service?

It could be difficult to find out. I would consider using the backup if that were an option. You could also use a repair installation (inplace upgrade).
0
 

Author Comment

by:lasirius
ID: 39769806
The first error is a 30623, then a 30620. I have posted the details for both errors below (while I have taken out some details for security). These errors do only appear while the problem is happening. I have not tried to recreate the shares or restarting the service, or any other modifications. Another detail is that I cannot ping the file server while the problem is occurring. Does this suggest that it is not an application layer problem, and probably a transport layer problem? I will have the person in control of the firewall look for any negative activity on port 445. Do you have any other advice?

Log Name:      Microsoft-Windows-SMBClient/Operational
Source:        Microsoft-Windows-SMBClient
Date:          1/7/2014 9:34:03 AM
Event ID:      30623
Task Category: None
Level:         Warning
Keywords:      (16)
User:          N/A
Computer:      
Description:
Connection to share \unsvmfile01\"I HAVE DELETED HERE" was lost. Status 0xC000020C
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-SMBClient" Guid="{988C59C5-0A1C-45B6-A555-0C62276E327D}" />
    <EventID>30623</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000000000000010</Keywords>
    <EventRecordID>14</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="3008" />
    <Channel>Microsoft-Windows-SMBClient/Operational</Channel>
    <Computer></Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="Object">0xfffffa800536b020</Data>
    <Data Name="OldState">0</Data>
    <Data Name="NewState">1</Data>
    <Data Name="Status">3221225996</Data>
    <Data Name="NameLength">29</Data>
    <Data Name="ObjectName">
  </EventData>
</Event>

Log Name:      Microsoft-Windows-SMBClient/Operational
Source:        Microsoft-Windows-SMBClient
Date:          1/7/2014 9:34:03 AM
Event ID:      30620
Task Category: None
Level:         Warning
Keywords:      (16),(2)
User:          N/A
Computer:    
Description:
Connection to server "" IP Address [fe80::551c:fe94:417b:fede%12]:445 was aborted.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-SMBClient" Guid="{988C59C5-0A1C-45B6-A555-0C62276E327D}" />
    <EventID>30620</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000000000000012</Keywords>
    <EventRecordID>1</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="3008" />
    <Channel>Microsoft-Windows-SMBClient/Operational</Channel>
    <Computer>""</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="VcEndpoint">0xfffffa80052f5e20</Data>
    <Data Name="RemoteAddressLength">28</Data>
    <Data Name="RemoteAddress">170001BD00000000FE80000000000000551CFE94417BFEDE0C000000</Data>
    <Data Name="ServerNameLength">12</Data>
    <Data Name="ServerName">""</Data>
  </EventData>
</Event>
0
 
LVL 54

Expert Comment

by:McKnife
ID: 39770363
> I have not tried to recreate the shares or restarting the service, or any other modifications.
You should try it.
> Another detail is that I cannot ping the file server while the problem is occurring
Interesting. Then the whole network connectivity breaks, not only the server service.
0
 

Author Closing Comment

by:lasirius
ID: 39783462
This is the first time that I am awarding points. Please do not let my 'B' grade for the solution distract you. Your help will assist me in solving the problem. Thank you!
0
 
LVL 8

Expert Comment

by:d0ughb0y
ID: 39999507
I'm having a very similar problem with a client's 2012 server. You've accepted a solution, and awarded points for it, but you didn't say what you actually did to solve the problem. Any chance you might share that? This is very relevant for me right now.
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…
This Micro Tutorial will give you a basic overview of Windows Live Photo Gallery and show you various editing filters and touches to photos you can apply. This will be demonstrated using Windows Live Photo Gallery on Windows 7 operating system.

740 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question