Win XP se odpojují od serveru
Moderátor: Don
- Houska
- Začátečník
-
- Registrován: 04. čer 2003
- Kontaktovat uživatele:
Win XP se odpojují od serveru
zdravim, mam problém se sítí - na win XP se stává že po určitém čase spadne připojení k serveru, pomůže jen opětovné odlogovaní a nalogování. Win 2K jsou OK. Please HELP! THX.
---- DIE YOU SON-OF-A-BITCH ----
- pavel.minarik
- Středně pokročilý
-
- Registrován: 03. čer 2003
- Bydliště: Brno
- Kontaktovat uživatele:
- Houska
- Začátečník
-
- Registrován: 04. čer 2003
- Kontaktovat uživatele:
Takže server je pod Win 2000 server 
(tzv absolutní rým), pravděpodobně se to děje pouze pod win XP a to od 10 do cca 30 minut po přihlášení a jen když je člověk připojenej jen jako USER tzn ne jako admin. Po odpojení server znovu žádá o autentifikaci tzn. uživateli naval jméno a heslo.
díky moc
(tzv absolutní rým), pravděpodobně se to děje pouze pod win XP a to od 10 do cca 30 minut po přihlášení a jen když je člověk připojenej jen jako USER tzn ne jako admin. Po odpojení server znovu žádá o autentifikaci tzn. uživateli naval jméno a heslo. díky moc
---- DIE YOU SON-OF-A-BITCH ----
- Dony
- Středně pokročilý
-
- Registrován: 29. říj 2003
- Bydliště: okr. Mělník
- Houska
- Začátečník
-
- Registrován: 04. čer 2003
- Kontaktovat uživatele:
- pavel.minarik
- Středně pokročilý
-
- Registrován: 03. čer 2003
- Bydliště: Brno
- Kontaktovat uživatele:
- Houska
- Začátečník
-
- Registrován: 04. čer 2003
- Kontaktovat uživatele:
- Dony
- Středně pokročilý
-
- Registrován: 29. říj 2003
- Bydliště: okr. Mělník
uf, ta cestina je porod... hod sem jeste event ID a zdroj (je to u te hlasky)... Mas domenu NT, nebo Active Directory? (kdyz je tam kerberos, predpokladam, ze AD...) Jeste se koukni na server, jestli tam nejsou nejake chyby...
Avatar tancuje, nechce se mu na záchod... Windows Vista je tady, řekněte "WTF" 
- Houska
- Začátečník
-
- Registrován: 04. čer 2003
- Kontaktovat uživatele:
- Dony
- Středně pokročilý
-
- Registrován: 29. říj 2003
- Bydliště: okr. Mělník
zkontroluj nastaveni DNS na PC, jestli miri na spravny server (jako pocitace s W2K)
zkus do registru PC pridat HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\MaxPacketSize=1
viz. http://www.mail-archive.com/activedir@m ... 09865.html
je divny, ze v KB M$ o tomhle neni ani tuk
zkus do registru PC pridat HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\MaxPacketSize=1
viz. http://www.mail-archive.com/activedir@m ... 09865.html
je divny, ze v KB M$ o tomhle neni ani tuk
Naposledy upravil(a) Dony dne pon 4. říj 2004, 12:44, celkem upraveno 1 x.
Avatar tancuje, nechce se mu na záchod... Windows Vista je tady, řekněte "WTF" - -=aNgEl=-
- Nováček
-
- Registrován: 08. črc 2004
Toto som našiel jednej stránke:
Event ID: 40960
Source LsaSrv
Type Error
Description The Security System detected an attempted downgrade attack for server <server name>. The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request. (0xc000005e)".
Things to understand What is the LSA?
What is an authentication protocol?
Comments Martin Eisermann (Last update 8/25/2004):
One of our customers got this error on two of his Windows XP workstation. The workstations could initially be connected to the Windows Small Business Server 2003 domain, but after a reboot, the domain was not accessible (logon, network drive mapping, etc.). The resolve this problem we replaced the client’s network card. The old card was an Acer network adapter that had no drivers for Windows XP but worked fine with the Intel standard driver and the existing NT 4.0 domain. However, Kerberos authentication with SBS 2003 domain was impossible.
Ionut Marin (Last update 7/7/2004):
This can also occur if the File Replication Service (Ntfrs.exe) tries to authenticate before the directory service has started. See Q824217 to troubleshoot this problem. Also seeing the Kerberos FAQ might be of some help.
See the link to "Microsoft event 40960 from source lsasrv" for more details on this event.
K-Man (Last update 7/7/2004):
I experienced this problem on Windows XP workstations, when users logged into a terminal server and terminal sessions were disconnected (but not terminated). To fix this problem I configured the terminal server to end disconnected sessions, and end sessions where users were idle for more than a specified amount of time.
PK (Last update 2/25/2004):
We were also getting this error on a Windows 2003 Member Server (in a Windows 2003 AD) which had its own DNS Server Service Running. The problem was that the server was booting up and several services were trying to run (including NETLOGON) before the Member Servers DNS Server Service had started. This resulted in no name lookup for the Active Directory Domain and hence could not contact any Domain Controllers.
Adrian Grigorof (Last update 8/5/2003):
From a newsgroup post: "An authenticated connection was requested but the negotiation to find a mutually agreeable security provider (SPNEGO) failed."
As per Q823712, on a Windows 2003 server, this behavior occurs when you restart the server that was promoted to a domain controller. In this scenario, the Windows Time service (W32Time) tries to authenticate before Directory Services has started. There are no adverse effects on computers that experience the warning events that are described in the "Symptoms" section.
Vazy Gee (Last update 8/5/2003):
I had this event for users were connecting to our RRAS service. The end user could connect to RRAS and could ping hosts, nslookup hosts, tracert, etc... However, when the user tried to access any network resources in our Windows 2003 Active Directory that actually required authentication, it would fail. After a support call with Microsoft, it was determined that somewhere between his home machine and our RRAS server, the Kerberos UDP packets were being fragmented, hence any authentication was failing (recall he could ping, nslookup, etc). We set the following reg key to a value of 1 to force Kerberos authentication to use TCP instead of UDP and everything worked perfectly.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LsaKerberos\Parameters\MaxPacketSize=1
Note: On his XP Professional w/SP1 client, I had to create the Parameters subkey and MaxPacketSize DWORD value manually.
See Q244474.
Anonymous
In our case, one of our customer reports that they are periodically seeing slow logon times, (defined as the time between entering the password and hitting enter on the “Logon on to Windows Screen” and the disappearing of that screen) sometimes1 -3 minutes on Windows XP SP1. Windows 2000 Pro computers are unaffected. The domain these computers are logging onto is a Windows 2000 AD Native Mode Domain with AD Integrated DNS zones. Checking the event log of a machine reveals these 40960 errors in the system log.
Soluton: User Logon Failures must be enabled.
By looking at the logon failure audit event logged at the same time as the SPNEGO event, more information about the logon failure can be obtained. Windows XP performs a reverse lookup on the DNS Server it is configured for as part of its own blackhole router detection. In the case where the DNS Server used does not have the Reverse Lookup Zone and/or no PTR Record for their DNS Server, the request gets forwarded out to the Internet.
The response comes back with one of the following server names:
prisoner.iana.org
blackhole-1.iana.org
blackhole-2.iana.org
These servers own the public PTR records for the 192.168.x.x zones. Since they have no record of your DNS Server, they reply with a "Server does not exist" reply, which causes LSASRV to log the error.
Solution: On the local DNS Server, create a Reverse Lookup Zone, and enter a record for your DNS Server.
Anothe case: The client was pointed to the ISP's DNS servers which contained a zone for the customer's domain. We removed the External DNS server addresses and ensured that DHCP was only assigning the Internal DNS server address. For testing we manually configured the DNS server address on a workstation which overrides the DHCP values. We can reference the following Knowledge Base Articles - Q291382 Frequently Asked Questions About Windows 2000 DNS.
Another case: Check the time on the workstation. Ensure that the day, time, time zone, AM/PM, year are correct. In my case the year was incorrect everything else was correct.
Last case: In this situation they actually were not authenticating to the DC. They were being logged in with cached credentials.
Greg Martin
Had this on a WinXP workstation which could no longer access domain resources. The fix was changing the DNS settings to point to a Win2k DNS which was tied into Active Directory. Apparently the workstation could no longer locate SVR records for the kerberos authentication server. These records were not in our UNIX DNS but were in the Win2k DNS. Related directly to Event 40961 - LsaSrv
Links Q291382 , Q244474 , Q823712 , Q824217 , Kerberos FAQ, EventID 40961 from source LsaSrv, Microsoft event 40960 from source lsasrv
Event ID: 40960
Source LsaSrv
Type Error
Description The Security System detected an attempted downgrade attack for server <server name>. The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request. (0xc000005e)".
Things to understand What is the LSA?
What is an authentication protocol?
Comments Martin Eisermann (Last update 8/25/2004):
One of our customers got this error on two of his Windows XP workstation. The workstations could initially be connected to the Windows Small Business Server 2003 domain, but after a reboot, the domain was not accessible (logon, network drive mapping, etc.). The resolve this problem we replaced the client’s network card. The old card was an Acer network adapter that had no drivers for Windows XP but worked fine with the Intel standard driver and the existing NT 4.0 domain. However, Kerberos authentication with SBS 2003 domain was impossible.
Ionut Marin (Last update 7/7/2004):
This can also occur if the File Replication Service (Ntfrs.exe) tries to authenticate before the directory service has started. See Q824217 to troubleshoot this problem. Also seeing the Kerberos FAQ might be of some help.
See the link to "Microsoft event 40960 from source lsasrv" for more details on this event.
K-Man (Last update 7/7/2004):
I experienced this problem on Windows XP workstations, when users logged into a terminal server and terminal sessions were disconnected (but not terminated). To fix this problem I configured the terminal server to end disconnected sessions, and end sessions where users were idle for more than a specified amount of time.
PK (Last update 2/25/2004):
We were also getting this error on a Windows 2003 Member Server (in a Windows 2003 AD) which had its own DNS Server Service Running. The problem was that the server was booting up and several services were trying to run (including NETLOGON) before the Member Servers DNS Server Service had started. This resulted in no name lookup for the Active Directory Domain and hence could not contact any Domain Controllers.
Adrian Grigorof (Last update 8/5/2003):
From a newsgroup post: "An authenticated connection was requested but the negotiation to find a mutually agreeable security provider (SPNEGO) failed."
As per Q823712, on a Windows 2003 server, this behavior occurs when you restart the server that was promoted to a domain controller. In this scenario, the Windows Time service (W32Time) tries to authenticate before Directory Services has started. There are no adverse effects on computers that experience the warning events that are described in the "Symptoms" section.
Vazy Gee (Last update 8/5/2003):
I had this event for users were connecting to our RRAS service. The end user could connect to RRAS and could ping hosts, nslookup hosts, tracert, etc... However, when the user tried to access any network resources in our Windows 2003 Active Directory that actually required authentication, it would fail. After a support call with Microsoft, it was determined that somewhere between his home machine and our RRAS server, the Kerberos UDP packets were being fragmented, hence any authentication was failing (recall he could ping, nslookup, etc). We set the following reg key to a value of 1 to force Kerberos authentication to use TCP instead of UDP and everything worked perfectly.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LsaKerberos\Parameters\MaxPacketSize=1
Note: On his XP Professional w/SP1 client, I had to create the Parameters subkey and MaxPacketSize DWORD value manually.
See Q244474.
Anonymous
In our case, one of our customer reports that they are periodically seeing slow logon times, (defined as the time between entering the password and hitting enter on the “Logon on to Windows Screen” and the disappearing of that screen) sometimes1 -3 minutes on Windows XP SP1. Windows 2000 Pro computers are unaffected. The domain these computers are logging onto is a Windows 2000 AD Native Mode Domain with AD Integrated DNS zones. Checking the event log of a machine reveals these 40960 errors in the system log.
Soluton: User Logon Failures must be enabled.
By looking at the logon failure audit event logged at the same time as the SPNEGO event, more information about the logon failure can be obtained. Windows XP performs a reverse lookup on the DNS Server it is configured for as part of its own blackhole router detection. In the case where the DNS Server used does not have the Reverse Lookup Zone and/or no PTR Record for their DNS Server, the request gets forwarded out to the Internet.
The response comes back with one of the following server names:
prisoner.iana.org
blackhole-1.iana.org
blackhole-2.iana.org
These servers own the public PTR records for the 192.168.x.x zones. Since they have no record of your DNS Server, they reply with a "Server does not exist" reply, which causes LSASRV to log the error.
Solution: On the local DNS Server, create a Reverse Lookup Zone, and enter a record for your DNS Server.
Anothe case: The client was pointed to the ISP's DNS servers which contained a zone for the customer's domain. We removed the External DNS server addresses and ensured that DHCP was only assigning the Internal DNS server address. For testing we manually configured the DNS server address on a workstation which overrides the DHCP values. We can reference the following Knowledge Base Articles - Q291382 Frequently Asked Questions About Windows 2000 DNS.
Another case: Check the time on the workstation. Ensure that the day, time, time zone, AM/PM, year are correct. In my case the year was incorrect everything else was correct.
Last case: In this situation they actually were not authenticating to the DC. They were being logged in with cached credentials.
Greg Martin
Had this on a WinXP workstation which could no longer access domain resources. The fix was changing the DNS settings to point to a Win2k DNS which was tied into Active Directory. Apparently the workstation could no longer locate SVR records for the kerberos authentication server. These records were not in our UNIX DNS but were in the Win2k DNS. Related directly to Event 40961 - LsaSrv
Links Q291382 , Q244474 , Q823712 , Q824217 , Kerberos FAQ, EventID 40961 from source LsaSrv, Microsoft event 40960 from source lsasrv
-----------=aNgEl=------------
- Houska
- Začátečník
-
- Registrován: 04. čer 2003
- Kontaktovat uživatele:
- Houska
- Začátečník
-
- Registrován: 04. čer 2003
- Kontaktovat uživatele:
http://support.microsoft.com/default.as ... -us;244474
áááleluja aleluja aleluja
všem zúčastněným díky
áááleluja aleluja aleluja
všem zúčastněným díky
---- DIE YOU SON-OF-A-BITCH ----
