Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
Home
Discussion GroupsWindows VistaWindows XPWindows MeWindows 98Windows 95Virtual PCInternet ExplorerOutlook ExpressWindows MediaSecurity
Related Topics
MS Server ProductsMS OfficePC HardwareMore Topics ...

Windows Forum / Windows XP / Networking and Web / August 2005

Tip: Looking for answers? Try searching our database.

two winxp home machines, varied results

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
briansmccabe@gmail.com - 26 Aug 2005 05:42 GMT
Hello all -

 I have two win xp home machines that, up until yesterday, were
networking beautifully together. Both machines have shared directories
and mapped drives etc, and one has a printer that the other also uses.

 Starting some time yesterday, one machine ("brian" is its name) was
able to see the other's (named "heidi") shared dirs, but "heidi" was no
longer able to see "brian"'s shared dirs or "brian"'s printer. I did
absolutely nothing to cause this that I am aware of - I wasn't even
home when this stuff stopped working.

 I have tried everything online that I can find. I ran through a list
of ping commands from each machine to the other. Brian can ping
everything just fine; heidi cannot ping brian by name nor by IP. I have
verified that "enable netbios over tcp/ip" is set to "enable" on both
machines. I have checked done "ipconfig /all" on both machines and have
found that the node type for each machine is "unknown." I verified this
by looking in the registry for both machines.

 I am virtually certain that the problem lies within "brian" and not
"heidi" because port requests that my router is supposed to forward to
"brian" stopped working some time yesterday as well. They continue to
not work. I thought perhaps the network card (which is built into the
motherboard) needed a driver upgrade, so I installed the latest driver
I could find for it. That did nothing.

 this is not the first time this has happened (i.e., everything
networking swimmingly, and then POOF - out of nowhere, everything goes
to hell). The last time it happened, I caved and simply reformatted
both machines. Needless to say, I have no interest in doing that again.
There's got to be a better way.

 One other thing that is worth pointing out is that the last time this
happened, the same scenario unfolded - "brian" could utilize shared
resources on "heidi" but not vice versa; and the router stopped
forwarding port requests to "brian" as outlined in the router's
configuration. "brian" also has a VPN adapter (cisco's latest) so that
I can VPN into work. I don't know if this is relevant or not.

ANY help would be tremendously appreciated. My printer and several
vital shared files are on my machine that my wife has to be able to
access so this is actually pretty important.

Thanks in advance -

Brian Mc
Chuck - 26 Aug 2005 07:42 GMT
>Hello all -
>
[quoted text clipped - 43 lines]
>
>Brian Mc

Brian,

You, quite likely, have a browser problem.  Now I AM NOT Talking about the
program that you use to surf the web.  The browser is the subsystem that
provides the content of Network Neighborhood.
<http://nitecruzr.blogspot.com/2005/04/nt-browser-or-why-cant-i-always-see.html>

Check each computer for misconfigured / overlooked firewalls, and for registry
setting restrictanonymous.
Misconfigured / overlooked firewalls (maybe packaged with the VPN?):
<http://nitecruzr.blogspot.com/2005/05/your-personal-firewall-can-either-help.html>
Registry setting restrictanonymous:
<http://nitecruzr.blogspot.com/2005/07/restrictanonymous-and-your-server.html>

If no help yet, provide "browstat status" and "ipconfig /all" from each
computer, and we'll diagnose the problem.  Read this article, and linked
articles, and follow instructions precisely:
<http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.html#
AskingForHelp
>

Signature

Cheers,
Chuck, MS-MVP [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My        email         is          AT         DOT
  actual       address    pchuck       mvps        org.

Brian McCabe - 26 Aug 2005 14:51 GMT
Thanks for being so willing to help out. I appreciate it!!

I was gonna address this last, but I think I had a bit of a
breakthrough at the end of my research so this info is getting bumped
to the top.

The only firewall I have on my machine *aside* from the Cisco VPN
client (more on that in a minute) is Windows Firewall that came with
SP2. Oh yeah, that reminds me: both machines are WinXP Home with the
latest updates installed. Anyway, regarding the Cisco VPN client -
there was a setting in there called "stateful firewall (always on)"
that was CHECKED. I unchecked it and have tried a few things.
NEWSFLASH: I can now ping "brian" from "heidi" by name and by IP. Also,
port requests on my router that are set up to forward to "brian" are
working again as well. Finally, I attempted to map a drive on "heidi"
to a shared dir that resides on "brian" and was able to do so. To me,
that accomplishes everything I have been trying to keep stable. BUT
that raises another question or two: is it safe to disable the
"stateful firewall" on my VPN client? Perhaps I should check with the
IT guys at work?

I'll go ahead and include the remainder of my findings in this post in
case you want to see them and / or there's something else I need to be
aware of. If you consider the problem solved and do not have the time
to review this info, I understand.

Ok, here's what I found with regards to the restrictanonymous presence
in the registry.

on "brian", the following registry dirs had keys named either
"restrictanonymous" or "restrictanonymousSAM." In each case, the value
for "restrictanonymous" was 0 and the value for restictanonymousSAM was
1.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Furthermore, there were also a pair of dirs that had my search criteria
("restrictanonymous") in the name of the dir itself.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\SeCEdit\Reg
Values\MACHINE/System/CurrentControlSet/Control/Lsa/RestrictAnonymous

which has the following keys and their corresponding values:

(Default)   REG_SZ       (value not set)
DisplayName  REG_SZ   Network access: Do not allow anonymous
enumeration of SAM accounts and shares
DisplayType  REG_DWORD     0
valueType      REG_DWORD     4

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\SeCEdit\Reg
Values\MACHINE/System/CurrentControlSet/Control/Lsa/RestrictAnonymousSAM

which has the following keys and their corresponding values:

(Default)   REG_SZ       (value not set)
DisplayName  REG_SZ   Network access: Do not allow anonymous
enumeration of SAM accounts (NOTE: does NOT say "and shares" at the
end)
DisplayType  REG_DWORD     0
valueType      REG_DWORD     4

The registry findings for "heidi" were identical to that of "brian".

Here is the IPCONFIG and BROWSTAT listings for each machine. NOTE: The
"browstat" command does not appear to have worked.

IPCONFIG info for "brian"

Windows IP Configuration

       Host Name . . . . . . . . . . . . : brian

       Primary Dns Suffix  . . . . . . . :

       Node Type . . . . . . . . . . . . : Unknown

       IP Routing Enabled. . . . . . . . : No

       WINS Proxy Enabled. . . . . . . . : No

       DNS Suffix Search List. . . . . . : hsd1.ut.comcast.net.

Ethernet adapter Local Area Connection:

       Connection-specific DNS Suffix  . : hsd1.ut.comcast.net.

       Description . . . . . . . . . . . : VIA Rhine II Fast Ethernet
Adapter

       Physical Address. . . . . . . . . : 00-E0-4C-97-B6-3B

       Dhcp Enabled. . . . . . . . . . . : Yes

       Autoconfiguration Enabled . . . . : Yes

       IP Address. . . . . . . . . . . . : 192.168.15.102

       Subnet Mask . . . . . . . . . . . : 255.255.255.0

       Default Gateway . . . . . . . . . : 192.168.15.1

       DHCP Server . . . . . . . . . . . : 192.168.15.1

       DNS Servers . . . . . . . . . . . : 192.168.15.1

       Lease Obtained. . . . . . . . . . : Thursday, August 25, 2005
10:09:53 PM

       Lease Expires . . . . . . . . . . : Saturday, August 27, 2005
10:09:53 PM

BROWSTAT info for "brian"

'browstat' is not recognized as an internal or external command,
operable program or batch file.

IPCONFIG info for "heidi"

Windows IP Configuration

       Host Name . . . . . . . . . . . . : heidi

       Primary Dns Suffix  . . . . . . . :

       Node Type . . . . . . . . . . . . : Unknown

       IP Routing Enabled. . . . . . . . : No

       WINS Proxy Enabled. . . . . . . . : No

       DNS Suffix Search List. . . . . . : hsd1.ut.comcast.net.

Ethernet adapter Local Area Connection:

       Connection-specific DNS Suffix  . : hsd1.ut.comcast.net.

       Description . . . . . . . . . . . : Compaq NC3161 Fast Ethernet
NIC

       Physical Address. . . . . . . . . : 00-50-8B-D7-6B-F6

       Dhcp Enabled. . . . . . . . . . . : Yes

       Autoconfiguration Enabled . . . . : Yes

       IP Address. . . . . . . . . . . . : 192.168.15.101

       Subnet Mask . . . . . . . . . . . : 255.255.255.0

       Default Gateway . . . . . . . . . : 192.168.15.1

       DHCP Server . . . . . . . . . . . : 192.168.15.1

       DNS Servers . . . . . . . . . . . : 216.148.227.68

                                           204.127.202.4

       Lease Obtained. . . . . . . . . . : Thursday, August 25, 2005
10:07:07 PM

       Lease Expires . . . . . . . . . . : Friday, August 26, 2005
10:07:07 PM

BROWSTAT info for "heidi"

'browstat' is not recognized as an internal or external command,
operable program or batch file.

 So there you have it. All I have done here is compile information; I
did not edit any registry entries because from following the guide you
provided on the restrictanonymous aspect of the registry, it did not
look like editing anything was neccesary. I included the search
findings here in case you needed to peruse them.
Chuck - 26 Aug 2005 16:58 GMT
>Thanks for being so willing to help out. I appreciate it!!
>
[quoted text clipped - 16 lines]
>"stateful firewall" on my VPN client? Perhaps I should check with the
>IT guys at work?

Brian,

You're asking a very interesting question here.  One that must be analysed in
TWO directions.  Most firewalls are used to protect one environment against
another.  But which environment do you trust?  Are you protecting your home LAN
from your work LAN, or vice versa?

As networks become more complex, and more common, bidirectional protection
becomes more significant.

So what protection does a VPN bundled firewall provide?  What is intended to
provide?  What happens when it is disabled, for convenience?  These are all
issues which I have yet to think about.  Please do discuss this with the IT
guys, and please please do let us know what they say.

>I'll go ahead and include the remainder of my findings in this post in
>case you want to see them and / or there's something else I need to be
>aware of. If you consider the problem solved and do not have the time
>to review this info, I understand.

I'm here to learn.  If there's anything else to learn, I'lll keep posting.  If
you keep posting, I will too.

>Ok, here's what I found with regards to the restrictanonymous presence
>in the registry.
[quoted text clipped - 7 lines]
>HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Lsa
>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

That is called a Registry "Key".  The "CurrentControlSet" key is the relevant
one.  The others were current at some previous time.  Only adjust
"CurrentControlSet".

>Furthermore, there were also a pair of dirs that had my search criteria
>("restrictanonymous") in the name of the dir itself.

The leaf elements are called "values".  The "value" named "restrictAnonymous"
(please note the small "r" in the name!) (Microsoft named this thing) must be
"0".  This is all Microsoft terminology.

Please don't confuse "restrictAnonymous" and "restrictAnonymoussam".  Those are
two separate values!  Please don't change "restrictAnonymoussam", only
"restrictAnonymous", IFF necessary!

>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
>NT\CurrentVersion\SeCEdit\Reg
[quoted text clipped - 25 lines]
>Here is the IPCONFIG and BROWSTAT listings for each machine. NOTE: The
>"browstat" command does not appear to have worked.

<SNIP>

>BROWSTAT info for "heidi"
>
[quoted text clipped - 6 lines]
>look like editing anything was neccesary. I included the search
>findings here in case you needed to peruse them.

Please read instructions about using the Path properly.  Or run browstat
directly from the folder where you copied it.
<http://nitecruzr.blogspot.com/2005/05/using-path-and-making-custom-program.html>
<http://nitecruzr.blogspot.com/2005/05/browstat-utility-from-microsoft.html>
<http://nitecruzr.blogspot.com/2005/06/command-window.html>

But based upon what you say above about the VPN firewall, this point may be
moot.

At any rate, I suspect the problem may be identified, and based upon what you
get from the IT guys at work, may be solved.  Please do let us know what they
say about their needs.  I provide advice so I may learn, and may instruct
others.  Your situation is one which should be of interest to many - WHO is
being protected by a VPN firewall?

Some background: AOL customers, using AOL purely as a portal, but providing
their own ISP, access the AOL servers thru a VPN.  Some time ago, the
effectiveness of this setup became embarrassingly obvious:
<http://nitecruzr.blogspot.com/2005/12/todays-security-alert.html#7/28>

The AOL situation may be relevant to yours.  In both directions.  Please keep us
updated on this.

Signature

Cheers,
Chuck, MS-MVP [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My        email         is          AT         DOT
  actual       address    pchuck       mvps        org.

Brian McCabe - 29 Aug 2005 22:55 GMT
Hi all -

 Thanks again for the assistance. I apologize for the delay in a
followup post.

 Here's what I did. I did not speak to anyone on the IT team. I did,
however, speak to a friend who used to be on the IT team and is now on
my team (web development team). He said if I were to ask the IT guys,
they would definitely say to have the stateful firewall turned on. But
based on the fact that a) I need to be able to have my network at home
running smoothly and b) I need the VPN access to work, I am choosing to
leave it off.

 I think the rationale that IT wants the stateful firewall turned on
is due to them being interested in protecting their network. If someone
VPNs in to the network on a machine that is wide open to all manner of
illicit attacks from various online trojan hives etc, the network's
integrity could become compromised. Hence the overpowering, "always on"
stateful firewall. Sure, it could goof up the user's home network, but
from the perspective of my employer, I am sure their thinking is
"better your network than ours" and perhaps rightly so.

 On the other hand, if a person VPNs in from a machine that is well
protected *independent* of the stateful firewall built into the Cisco
VPN client, I think it is ok to shut off the Cisco stateful firewall.
My home network is adequately firewalled, and there are *zero*
configuration options with the built-in Cisco firewall, so using it is
nothing but a headache. I feel comfortable moving forward having the
stateful firewall disabled.
Chuck - 29 Aug 2005 23:12 GMT
>Hi all -
>
[quoted text clipped - 25 lines]
>nothing but a headache. I feel comfortable moving forward having the
>stateful firewall disabled.

Brian,

If that's what works for you, then it's your decision.  Are there other
employees with your situation?  If so, what are they doing?

It's in your own long term interest to discuss this with IT, and to give them a
chance to find a solution.  Be careful, if you should cause any problem that the
IT group has to resolve, and they find out that you're operating without
protection of the firewall, then you could be at risk.

Signature

Cheers,
Chuck, MS-MVP [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My        email         is          AT         DOT
  actual       address    pchuck       mvps        org.

Brian McCabe - 31 Aug 2005 18:37 GMT
The email that they distribute to employees using a VPN connection
gives pretty explicit instructions in how to set it up, and there's no
mention whatsoever of the stateful firewall - nothing about turning it
on, off, it being optional, etc. Nothing. So I highly doubt my standing
at work would be jeopardized by having this feature turned off.
Besides, I'm *not* operating without firewall protection -- I am
operating without *that* firewall's protection, that's all. The fact
that that particular firewall gives me no configuration options makes
it far too cumbersome to work with. I think the guys in IT would be
inclined to agree with that, as a matter of fact. If they were dealing
with employees who have no computer savvy, I could see them insisting
it be turned on but that's not the case with myself and the other
people on my team who are utilizing it.
Chuck - 31 Aug 2005 18:50 GMT
>The email that they distribute to employees using a VPN connection
>gives pretty explicit instructions in how to set it up, and there's no
[quoted text clipped - 9 lines]
>it be turned on but that's not the case with myself and the other
>people on my team who are utilizing it.

OK, Brian.  Just as long as you know the liabilities.  Stay safe.

Signature

Cheers,
Chuck, MS-MVP [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My        email         is          AT         DOT
  actual       address    pchuck       mvps        org.

Jason_thekiller - 26 Aug 2005 10:11 GMT
Brian,

As chuck said, you need to check for the firewall settings in the Computer
named Brian.

Can you let me know the results of the command ipconfig /all of both the
computers ?

Thanks

> Hello all -
>
[quoted text clipped - 43 lines]
>
> Brian Mc
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.