Can't Connect to Shared Drives

[AngelicKnight]

Any help with this will be GREATLY appreciated. This is quite the crisis until I can figure it out (oh how I love Monday mornings).

We have a large data server that all our employees connect to, usually via a seperate terminal server. We have two terminal servers. However, for some mysterious reason, various clients and one of the terminal servers can no longer connect to the shared drive when mapped to it. However, the other terminal server still connects with the no problems, so the problem is not consistent across the network.

For those that cannot connect to the mapped drive, this is the error message I get:

The mapped network drive could not be created because the following error has occured:
Logon Failure: The target account name is incorrect.

There are only two clues I have so far:

1) I've been getting a LOT of MrxSub event IDs lately, but this has been occuring for a while without any problems until today, so I doubt it's at the root of the problem.

2) Mapping to the actualy IP address instead of the server name does work for some reason. It's when you use the usual "\\servername\drive" that it fails to map.

Again, we've been doing this a long time without any problems, when all of a sudden these clients just failed to connect this morning.

[morganlefay]

WINS????

What is the Server OS...2k or 2003.

There was a WINS sploit out...

any updates recently??

[AngelicKnight]

Oh sorry, forgot to mention it's W2k.

And yes, updated it with the latest Windows patch last week.

[morganlefay]

from the server you are having trouble with...can you ping the dataserver by name??

Are all servers the same OS and patch level??

[AngelicKnight]

I just found a fix...Doesn't tell me what caused the problem, but it has resolved it. I just changed:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters

from the value 0 to 1, then rebooted. The mapped drives automatically reconnected and now all is well.

Thanks for the help Morgan.

[morganlefay]

Good to hear you resolved the issue...

MLF

I hate Mondays too

[rapier57]

Glad you found a fix. I suspect that you have a workstation or some other system that has claimed "Master Browser." I used to get this once in a while when someone put in an IPX protocol on a subnet and it claimed the master browser role. Systems in that subnet could no longer map drives or hit some network resources, or be seen from other subnets. Check your WINS database to see if the domain master browser role or master browser role is on a system other than your domain controllers. This can take a while to fix if it isn't a rogue protocol.

Another place to check is your DNS. Make sure your A records are correct for the data server and you don't have anything else writing an A record or alias with a similar name. If you can hit the share with the IP, but not the NETBIOS name, you have a resolver issue somewhere. It is probably WINS, but doesn't hurt to check DNS.

[AngelicKnight]

Thanks guys.

I'm starting to have second thoughts on this idea though. Consider this:

By default, Windows NT, 2000, and XP store two different representations of each password locally and on servers: the LanMan hash and the NTLM hash. The LanMan hash is stored for backward compatibility all the way back to Microsoft's ancient LanMan product, vintage early 1990's. It's not really needed on a network where only Windows NT, 2000, and XP systems live. The LanMan password representation is extremely weak, and can be easily cracked. No matter how complex and obscure your password is, an attacker can crack it in under a week due to the incredibly feeble encryption used to formulate the LanMan hash.

To significantly improve your security, your best bet is to eliminate the LanMan hashes altogether. On Windows 2000, you can accomplish this by creating the registry key HKEY_LOCAL_MACHINE\System\CurentControlSet\Control\LSA\NoLMHash. On Windows XP, use regedit to create the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash as a "REG_DWORD – Number" and give it the value of 1.

The key I set to "1" had to do with plain text passwords and as you can see in my prior post, it was a Lanman value. Might I have just weakened my password security by chance?

[Tiger Shark]

I have just weakened my password security by chance?

My brain is a bit too tired to look into what the ramifications of the reg change are right now... But the simple question is.... Is this Term Server available publicly without the benfit of a prior VPN connection? If it isn't then you really don't have too much of a problem if your perimeter is seured.... Thoughts?

[RoadClosed]

I have this same issue on occasion. Wondering if service pack 2 related, since I run XP. I have been having issues with the master browser and authentication on pre w2k boxes. Rebooting the master browser fixes the issue. This smells like file replication issues are probably happening along with the drive mappings.