Windows 7 Pro - Network Identifying but has access to network folders and Internet.

You might have a 2012 Domain Controller with the Network Drive Mappings set to Replace.
I noticed that on update, the network mapping drops every 15 minutes or so depending on the update cycle set.

Changing it to Update or Create should fix that if this is the case

As for the limited connection, sometimes the server can try and finish that test before some services are loaded. I often find that I need to restart Network Location Awareness (Dependent on Network List) to get it showing proper. There is no outage from restarting that service on the server.

All computers (including the 1 server) are Windows 7 Professional. It's a peer to peer network. There is no domain controller.

When I took the screenshot, the only thing that was happening on the computer was Microsoft Security Essentials running a scan.

Are they all connected via wireless? As it could be the wireless which is unstable, perhaps running 1-2 PC's via cabled internet will help seeing whether wired shows and remains fine, while wireless drops from time to time.

All computers are wired. There is no wireless in use for this.

Thanks Qlmeo!

Just a shot in the dark:
The peer network uses IPv6, while Internet connection is IPv4. So I guess you have issues with IPv6 reconfigurating. Since IPv6 uses solicitation (network IDs, router info, ...), the interface might consider reconfiguration from time to time. While that is done no IPv6 network connection can be used. Try if disabling IPv6 (temporarily) in the NIC interface settings keeps the network working.

IPV6 was turned on the server and 2 of the computers. As said in the question:
"QOS and IPV6 disabled, IPV4 enabled on all computers. (QOS needs to be disabled for a program to run properly)."

Sorry, didn't spot that. TL;DR :)
UPnP might be another reason, as that is soliciting connection info too, and does that often.

What do you want me to do with the UPnP?

Disable the corresponding service on your client machine, so it ignores anything UPnP related.

Should I disable this on both server and client computers? or just Client computers?  or just the Server?

It would seem odd that I would have to disable a service on all the computers since all the computers have the problem if the problem reoccurs. So far I haven't been told that the issue repeated itself lately.

The clients so they do not receive and act on the UPnP message.
The servers that they do not send anything.
There might also be routers, media servers, ... sending UPnP messages,

Will I interfere with any USB or Network Printers By disabling UPnP on the clients computers? I'm just trying to be cautious and don't want to make the problem worse for the client.

I also find it odd on when the problem happens, all the computers have the problem. This problem never occurs with one computer having the problem and the rest working fine. It's always a 100% everyone or nothing.

That pretty much sounds like it is a device causing it. And no, everything already set up on a PC should not have any new issues if you stop UPnP. It is not essential, just makes it easier to use services on your network.

They went about 5 days without having any problems but the problem reoccurred today. Today they disabled the UPnP on all the computers. UPnP is disabled on the router.

The problem still exists. They re-enabled UPnP after the problem occurred.

Server uses static IP or gets IP address from DHCP? If device lose its IP address (whatever the reason is) can cause this kind of problems.
Beside assign static IP address if server uses dynamic address, check in device manager under network and then your network card is option "Roll back driver" available. If it is available maybe new driver is not good for your network card.
Try (if it is possible) to change port on switch where server is attached.

Going to check on that now as soon as I can get access to the server.
I'm pretty sure the port on the switch where the server is attached has been changed but I'll contact the client to make sure this happened.

A lot of things were changed before I was notified of the problem and when I listed my suggestions to the client, they said they already tried so many of my suggestions before contacting me.

IP address is static.
Roll Back Driver is grayed out.

That makes no sense, if static IP is present and if link that connects server to switch is OK it should never appear situation like one on the picture. The only time when that could (and even than just maybe) happen is network loop, but network loop should, most likely, affect all users.

Things I can suggest is to try to use system restore to point prior problem occurred or other network card (I would try this option first).

1) Are the client PC's using DHCP to obtain their ip's or are they static?
2) What is the make and model of the gateway/router?

Many of the newer routers insist that you use their reserve feature in the management interface and get really upset when you don't (i.e. the PC's say identifying...).

Predrag Jovic, the problem effects everyone when it occurs. Trying to figure out the trigger is the biggest issue. The server has 2 NICs in them and I've already switched the NICs.

Could the problem be caused by a computer attempting to connect to the server while it's already at it's max lan connections?

Davis McCarn, I would assume all the client PCs are static but I'll double check on this.
The router is a Cisco RV220W, wireless is turned off. I upgraded the firmware after this problem occurred to see that fixed the problem but no success.

Could the problem be caused by a computer attempting to connect to the server while it's already at it's max lan connections?

No. On picture you gave - host can't establish network connection with router, I usually see this when dhcp server is down, or with wireless connection problems. If there are problems in network beside other host connect to server (like internet is slow or non working) check switches for redundant links. If you have more than one link between switches and STP is not running on switches than network loop occurs, and network goes wild. In most cases it is easy to check for network loop - all lights (connected ports) on switches are light up (not blinking) all the time.

No. On picture you gave - host can't establish network connection with router, I usually see this when dhcp server is down, or with wireless connection problems. If there are problems in network beside other host connect to server (like internet is slow or non working) check switches for redundant links. If you have more than one link between switches and STP is not running on switches than network loop occurs, and network goes wild. In most cases it is easy to check for network loop - all lights (connected ports) on switches are light up (not blinking) all the time.

I've realized that not all computers are setup the same, which is something I'm going to have to change. Some request a static IP while others obtain automatically.

As I suspected, that Cisco RV220W really wants you to leave DHCP enabled for everybody and then use their "Static DHCP" section to assign ip addresses you want constant.
What happens is that Windoze never goes through DHCP negotiation if it is set to a static ip locally and, as a result, never identifies the network (which is a problem found all over the web)
Your manual: http://www.cisco.com/c/dam/en/us/td/docs/routers/csbr/rv220w/administration/guide/rv220w_ag_78-19743.pdf
I like to reserve .100, .101, etc. for servers and .151, .152, etc. for network printers with all of the clients set to use automatic DHCP.
If the server is on more than the other PC's, check out adding the IsDomainMaster to its registry.

I will check this out, like I just said, some computers request a static IP while others are obtain automatically. What's odd is those that are set to obtain automatically cannot ping each other. It doesn't matter what computer it tries to ping, it gets 127.0.53.53 in return. This could be a big clue on what is causing the problem. I'll do as you requested and will get back to you with the results.

If the server is on more than the other PC's, check out adding the IsDomainMaster to its registry.

The File server is only windows 7 professional, Should I still look at this?

Yes; the computer browser service looks for the PC which will maintain the list of PC's on the network and that setting makes it be the top dog.

Yes; the computer browser service looks for the PC which will maintain the list of PC's on the network and that setting makes it be the top dog.

I will look into this as soon as I get the chance.

I've realized that not all computers are setup the same, which is something I'm going to have to change. Some request a static IP while others obtain automatically.

I believe there is no need for that. You just need to configure DHCP server to assign IP addresses from IP address range not to overlap with your static IP addresses. You can assign dynamically addresses from some IP range for example 192.168.x.51 - 192.168.x.250  (DHCP address pool) and use IP addresses 192.168.x.1 - 192.168.x.50 & 192.168.x.251 - 192.168.x.254 for static.

I believe there is no need for that. You just need to configure DHCP range not to overlap with you static IP addresses. You can assign dynamically addresses from IP range 192.168.x.51 - 192.168.x.250  (DHCP address pool) and use addresses 192.168.x.1 - 192.168.x.50 & 192.168.x.251 - 192.168.x.254 for static IP addresses (or any other range you like).

The static IPs are outside the DHCP address pool. What would the downfalls be of having all the client computers set to static and what are the benefits of setting them to be automatic? Clients only share printers to other clients.  Some printers are IP printers (staticwhile others are USB and shared. If nothing changes, nothing can go wrong.

What type of switch?

Yes; but, that has changed and is a function of the specific router with far more of them requiring that you use the reserve ip function for them to acknowledge (properly) the connection and existence of the device on the network.
A few years ago, for example, a fairly large client had their router get flakey and its replacement demanded I use the reserve function for their server, ip based printers, and any PC/device which needed external access.  Until I did so, port forwards and local access was exactly as you describe your problem to be; it'd work OK for a while and then go poof!
In my case, with that router (hint, hint), I had to expand the DHCP scope to include the reservations, then assign the ip's for those items I wanted static.  I did not; though, have to change the settings of the devices, just tell the router that the server was to be at .100, etcetera.

I agree, but this is IT and always something is changing ( "that's the way I like it").
:)
Well, if you have a lot of hosts it is hard to configure all devices manually. Otherwise static is preferred - if DHCP server is down your local network will still be functional. As network starts to grow you need to have spreadsheet (or whatever method you like to use) for tracking static IP assigns so there would be no duplicated IP addresses... Benefit of combination static and dynamic IP address assignment is that you just configure essential devices with static IP addresses (servers, printers, routers etc) and rest of devices get address from pool since usually it is not important what is  IP address of those devices.

There isn't and won't be many hosts so I'll set them up with static IP addresses and I'll make sure it's outside the DHCP's range. I want to set this up in the most bullet proof way possible.

What type of switch?

The main router is a Cisco RV220W. The wireless is turned off and isn't used.

I guess you didn't catch my last sentence...  Setting the router to reserve the ip's (Cisco calls them static ip's) of the devices (PC's, Servers, NVR, printers,...) in the router made everything happy AND I did not have to change the ip settings in the devices; I left them with the ip's I had already set previously.
All of the network devices which don't need to be shared or remotely accessed, I left using DHCP which was their default, anyway.

I got your last sentence and I understand what needs to be done. I found the static DHCP Client table setting in the router and it's blank. I'll setup the network with static IP addresses. I discovered Friday that half the network was set to obtain network information automatically and the other half was set to static.

Anything that's set to Static, will be setup on the router as static.

The main computers now have static IP addresses in the router. I'll keep you posted if the problem reoccurs.

The problem reoccurred. I had remote access to the computer when this happened.
When I opened 'Computer' to take a look at the network drives, it was extremely slow.

I uninstalled KB3035583 on the host computer I'm remotely connected to and I'm going to uninstall it on the server as well. This update is used to download Windows 10 and I'm wondering if the server randomly tries to download Windows 10 and that's what causes the problem.

When I attempt to 'Troubleshoot a problem with your computer's hard drive', (which is really the network drive), I get a message 'This solution could not be downloaded'.

The Windows 10 (GWX) "upgrade" will seriously chew up a machine, using up to 50% of the PC while it "prepares".
Save the following as DisableGWX.reg and then merge it.  GWX will be gone after a reboot.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\GWX]
"DisableGWX"=dword:00000001

Windows Update Service was disabled on the server so I'd assume that couldn't be the problem.

No, your original question was about Windoze perpetually trying to identify the network which happens with setting static ip addresses and/or the router screwing up network negotiation queries.
Using DHCP solves that, most of the time.

Davis, using a DHCP config sounds more likely to cause then to solve the issue. Nothing is impossible, though. Anyway, sounds as if neither static nor DHCP setting is related.

DHCP is a four step process which negotiates getting an ip address and the other key items (DHCP server, gateway, DNS)  Because it is an interactive process, it helps Windoze decide it has joined a network.
http://www.itgeared.com/articles/1111-dhcp-process-negotiating-lease/

In setting static ip's, you bypass that negotiation which can be the cause for the network never getting identified.

Davis,

1. The link you provided describes the DHCP process. It does not proove anything about Network Identification. And something interactive and dynamic sounds more like triggering negotiation and selection and testing, no?
2. It seems that DHCP and static IPs are mixed, and all are showing that strange behaviour. The mixture might  be an issue, but I've never heard of it as it is how most pros configure their networks.

It depends heavily on the router and what makes it be happy.

Hi @JohnnyBCJ,

Apologies if I revisit anything that's happened before, but I feel some basic diagnostics have been missed and I think it's worth going back a step or two.
Not sure DHCP is the right road to go down as one of your comments above suggest you have been remotely connected to a client during the issue, which suggests that it was still able to communicate with it's default gateway & internet. DHCP could be giving out a duplicate IP (or you could have a rogue DHCP server somewhere) but it seems we don't know enough about whats happening to really pin this down to DHCP yet.

could you please confirm the below:


set up some pings and leave them running. When the issue occurs, check the pings to get a picture of what is actually happening.

example:

Server:

Static PC:

DHCP PC:


Also, what *exactly* do you do to get it working again when the issue occurs (apologies if I've missed it above)
This may be important in knowing what's wrong.

subnet being used (eg 192.168.1.0/24 or 192.168.1.0 255.255.255.0)

192.168.1.0 / 255.255.255.0

IP/mask of server

192.168.1.253 / 255.255.255.0

routers IP/mask

192.168.1.254 / 255.255.255.0

DHCP server's IP and pool of IPs being given out

192.168.1.100 to 192.168.1.200

example IP of a computer that has suffered this issue

When the problem occurs, all computers on the network suffer this problem.

example IP/mask of the PCs with static IPs

192.168.1.253 / 255.255.255.0
192.168.1.56 / 255.255.255.0

The problem goes away on it's own after 10 to 15 minutes of lag or from what I was told, if you go to the server and 'move the mouse', it instantly fixes the problem.

When the problem happens, going to 'computer' to see the network drives is insanely slow.

Suddenly, I think we are working on two problems with the primary one posted not being what needs fixing.......
Windows has several session timeout parameters that cause "inactive" network connections to be disconnected.  In most cases, the default is 15 minutes of inactivity.
Here are some settings to fix it: http://www.nextofwindows.com/how-to-fix-the-red-x-on-the-icon-of-mapped-network-drives-in-windows-7
And/or, here's a different spin.  I have named my server ECCxx for almost 20 years now where the xx is the year I put it in service.  Suddenly, about 6 years ago, none of the workstations could wake up the server to access the shares.  When I checked with Pingplotter (a great free visual traceroute), I found to my chagrin that EarthLink had decided to search the world for my server causing all sorts of grief.  The permanent fix is to add an entry to the LMHOSTS file for the server which I have now used on hundreds of peer to peer networks with great success.

Suddenly, I think we are working on two problems with the primary one posted not being what needs fixing.......
Windows has several session timeout parameters that cause "inactive" network connections to be disconnected.  In most cases, the default is 15 minutes of inactivity.
Here are some settings to fix it: http://www.nextofwindows.com/how-to-fix-the-red-x-on-the-icon-of-mapped-network-drives-in-windows-7
And/or, here's a different spin.  I have named my server ECCxx for almost 20 years now where the xx is the year I put it in service.  Suddenly, about 6 years ago, none of the workstations could wake up the server to access the shares.  When I checked with Pingplotter (a great free visual traceroute), I found to my chagrin that EarthLink had decided to search the world for my server causing all sorts of grief.  The permanent fix is to add an entry to the LMHOSTS file for the server which I have now used on hundreds of peer to peer networks with great success.

I will run this command on the server:   net config server /autodisconnect:-1
and I will make the registry changes on the other computers.

I will also use Pingplotter to see if there is any network issues.

"if you go to the server and 'move the mouse', it instantly fixes the problem" sounds like a Power Saving option. Make sure the server does not go into any such mode, switches off devices etc.

"if you go to the server and 'move the mouse', it instantly fixes the problem" sounds like a Power Saving option. Make sure the server does not go into any such mode, switches off devices etc.

I agree with you. The server is set to not go to sleep, does not turn off the hard drive and does not turn off the networking card to save power. Is there any other settings? I'm pretty sure the screen saver is turned off as well.

Try setting a screensaver (Mystify and 10 minutes, maybe?) and telling it to never dim or turn off the display.  My thought is that maybe its hanging on some portion of doing those.

Is hibernation turned off as well as sleep? (since hibernation was not mentioned above)
If not - cmd as admin
powercfg -h off

Try setting a screensaver (Mystify and 10 minutes, maybe?) and telling it to never dim or turn off the display.  My thought is that maybe its hanging on some portion of doing those.

I will do this now.

Is hibernation turned off as well as sleep?
If not - cmd as admin
powercfg -h off

Hibernation should be off but if it isn't, I'll run the command.

Try setting a screensaver (Mystify and 10 minutes, maybe?) and telling it to never dim or turn off the display.  My thought is that maybe its hanging on some portion of doing those.

When I change the screensaver from none to Mystify @ 10 minutes, the monitor displays 'The screen saver can't run because it requires a newer video card or one that's compatible with Direct3D.

The video card is 'Standard VGA Graphics Adapter'.
The hardware IDs are:
PCI\VEN_1002&DEV_515E&SUBSYS_31FB103C&REV_02
PCI\VEN_1002&DEV_515E&SUBSYS_31FB103C
PCI\VEN_1002&DEV_515E&CC_030000
PCI\VEN_1002&DEV_515E&CC_0300

I don't know if this is because I have remote access to the server or not.

OK; that's a very old ATI Radeon 7000 video card and it doesn't meet the specs for DirectX in 7.
But; your post has me concerned about what other drivers were not installed so, what is the make and model of that PC?
Try not turning off or dimming the display without a screensaver.

OK; that's a very old ATI Radeon 7000 video card and it doesn't meet the specs for DirectX in 7.
But; your post has me concerned about what other drivers were not installed so, what is the make and model of that PC?
Try not turning off or dimming the display without a screensaver.

The server is a Proliant ML350 G5 with Windows 7 professional installed

The device manager looks perfect. No question marks or exclamation marks.

Apparently, that ATI card is actually an ES1000 built-in on the systemboard.
The support page does not list 7 as a supported O/S; but drivers for Server 2008 will work.  Normally, chipset, network, and video drivers are always needed:
http://h20564.www2.hpe.com/hpsc/swd/public/readIndex?sp4ts.oid=1123563

Apparently, that ATI card is actually an ES1000 built-in on the systemboard.
The support page does not list 7 as a supported O/S; but drivers for Server 2008 will work.  Normally, chipset, network, and video drivers are always needed:
http://h20564.www2.hpe.com/hpsc/swd/public/readIndex?sp4ts.oid=1123563

I installed the driver and just restarted the server.

Thanks for the subnet details @JohnnyBCJ,
Always worth checking the basics before getting too deep into the issue.
Did you manage to setup the pings?

the symptoms do sound like the machine is sleeping in some way but if you are sure it isn't there must be something else happening when the machine is left unused for a while.
You could check the event logs on the server around the time the issue occurs to see if there are any significant gaps in the time events are logged. if it is asleep/hibernating you should see a gap where no events are logged.

Could the defrag/checkdisk facility be kicking in when usused (which stops when activity is detected like moving the mouse)
Do you have any scheduled AV scans that could be overloading the disk activity?

I'm not sure how to setup the pings in a way that the pings are recorded. I rarely get contacted when the problem is actually occurring. For example they'll call me lunch time and tell me that the server acted up 5 times this morning.

When looking at the logs, I couldn't find anything that was out of the normal. Nothing critical, warnings or errors related to the problem. There was no gaps in the event log.

That's a good question about the defrag/checkdisk facility kicking in. I haven't witness that program being open but who says it isn't running in the background? I'll check into this.

Scheduled AV scans are at 1030 PM. I'll look into how long they usually last.

Not ideal  but if you run ping <ip> -t it will keep running until stopped.  You leave a load of pings running in an RDP session on the server as long as your sessions aren't set to time-out.

could you set up a basic performance monitor log on the server, as this would at least show the usage of the server at the time an issue occurs. If something like an AV/checkdisk process was running when idle you should see the activity in the performance logs.

Sorry for the delay in response.

I'll be at the client's location on next Thursday (January 14th). I can't really do much more troubleshooting steps until I'm there. Do you have any suggestions on what performance monitor to use?

Just use the built in windows one.
Start with the basics

Examples:
Cpu time%
Memory free mb
Current disk queues
Average disk queues
Network bytes/sec

We found out today that the array battery needs to be replaced. Do you think this might be the cause of the problem?

Depends on the controller model as to what it uses the battery for, but many good ones use the battery to handle the write cache. It's certainly possible. No harm in trying a replacement as the battery is pretty critical to the stability of the raid set.

Most RAIDs with battery-buffered write-behind cache will switch off write-behind and go to write-thru. This means that write requests are required to be confirmed by the RAID for completion, which degrades performance. But it cannot lead to that symptom - the battery does not charge because you move the mouse ...

I found out that an svchost.exe is taking up over half a gig in memory. It manages the netman service. If I simply end task the svchost, it takes no time to get back to the same size. Is there any suggestions on what can be done?

I have a funny feeling I'm going to replace the server at the end of it all but I'd like to put a bandaid on the problem if possible. How can I stop this from happening?

The list of services are:
UxSms
UmRdpService
TrkWks
SysMain
PcaSvc
Netman
CscService
AudioEndPoint

I apologize in advance if this sounds like different questions. I feel like this is the true cause of the problem.

I don't think this is related to the original issue.
However, I like to switch off TrkWks, as I don't want my shortcuts to change automaticatlly whenever I move network file ...

svchost.exe is a critical component to Windows, and should not be terminated. It contains a collection of services generally which you can review using Sysinternals ProcessXP from the PSTool's suite (Microsoft Owned)
Using Process Explorer you might be able to dig deeper into what is utilizing the memory under svchost, however 512MB doesn't sound like a terrible lot for this and I would think that this would be unrelated.

I would setup a ping logger to check whether the connection to the "server" drops at any time, in order to identify whether the problem has to do with network interrupts. This has been recommended before I noticed by Steve, but I did not see a response to that.
You could use Ping Plotter or PingWiz (PingWiz not always reliable, I prefer to simply ping and record output to a text file e.g. via a Command Prompt ping serveripaddress -t >c:\Ping.log)

Other things to check is whether you setup a limitation as to how many users can concurrently connect to the share from which the application runs.
Perhaps you have it set to 20 users, but 21+ users are trying to utilize it.


Neither of those suggestion explain the network showing as "Identifying" but it would help narrow down potential causes.

To address the "Identifying" issue try the below

1] Make sure Network discovery in Windows 7 has been turned on.
To check this:

1a] Open "Advanced sharing settings" (Control Panel>>Network and Sharing Center>>click Change advanced sharing settings.)
1b] Click to expand the current network profile.
1c] Click Turn on network discovery, and Save changes.

Source: What is network discovery
 
2] Run the Network Troubleshooter on Windows 7 to check for problems causing LAN status stuck on “Identifying…”. again.

Just to add to Maclean's post, svchost.exe is critical Windows process, but there are also many viruses that are hiding behind the same name to mask themselves...

Well stated yes. A virus scan never hurts, and processXP could shed some more light on the processes hiding behind it :)
You could also use TCPView to check if any data is being transmitted to dubious IP's, but a virus scan with lets say Malware Bytes and in addition Malware Bytes Rootkit Scan should clarify if that is the case.

I'm going to replace the server because the server is 6 years old but I do not know when I'll be able to do so. It might be in May. There is no purpose on troubleshooting a problem when I'll be replacing the main component of the problem (the server). I've done several suggestions so far but the problem still exists. There's also no point on keeping the question open until I replace the server. Please accept my apology. I would of never posted the question if I had realized the server was 6 years old.