Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to figure out what is causing 5 of my servers to attempt to connect to an external LDAP server. I inherited these servers when another employee left the company. As far as I know these servers were built in the same way as other servers in the data center. None of affected servers have internet connectivity.

The traffic is blocked by my firewall, but 3 of the servers are a XenApp 5 farm and seems to be causing a noticeable lag in some instance, like opening the Citrix Console. I have 3 other farms configured identically, as far as I can tell, that do not have this issue. The farms are W2K8 and the other servers are W2K3. I see the access attempts in both in the firewall and in ProcMon when I capture the traffic and open the Cert Manager.

ProcMon Capture

The capture above is when I attempt to expand the Cert Manager tree, it takes 45-60 secs before the tree expands, while on non affected systems the tree expands instantly.

Since the firewall logs don't always correspond to times when users would be logged into servers I suspect that it maybe related to somehow to when a cert is accessed in someway and Windows attempts to validate it somehow. Unfortunately I haven't found any reference to this type of behavior and I haven't found any cert that references the IP listed in the capture above. A reverse look up of the IP doesn't provide any additional information either. Since internet access isn't allowed with these systems the standard root cert updates are not pulling, nor I'm finding is the WSUS server the servers are attached to providing them either. As far as I can tell Microsoft hasn't provided a way to update root certs for non internet connected servers.

I want to stop this behavior as it will never connect and in some cases is impacting performance.

Any ideas?

Edit: I had checked the CAPI2 event log, but didn't realize it wasn't enabled by default. I enabled and opened the Cert Manager plug in. I then got errors in the CAPI2 event log pointing to a McAfee Cert. I'm currently chasing this down now. I'll up date with what I find. I'm still open to any additional help out there.

Follow up to edit: Corrected McAfee cert issue, but original problem continues.

share|improve this question
I'd suggest a Wireshark capture of the IP of the external LDAP, you can get more insight into the nature of the calls being made (you won't get much w/o pinholing the firewall temporarily, but it might be enough.) Or, since you've said these servers were built to a standard image... rebuild 'em. Nuke and pave. – George Erhard Jan 30 '13 at 22:05
I'm not familiar with Wireshark, other then a general idea what it does, what more will it tell me? Rebuilding isn't an option. They were built from the same base OS image, but since have had Citrix XenApp and a custom 3rd party software installed. The systems are in production, so the required down time and cost to pay the vendor to reinstall are not an option. – Randy K Jan 30 '13 at 22:39
Well basically Wireshark allows you to sniff packets across the network, and reconstruct network 'conversations' based on those packets. It's VERY good at figuring out traffic flow between servers and clients (we use it to diagnose multicast join issues, keyflow issues, caller ID notifications, client set-top-box provisioning, and so on and so on). With the firewall in the way you'd only see one side of the conversation, but you could zero in on what port is being used, what process, and all that. – George Erhard Jan 31 '13 at 23:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.