I'm trying to figure out what is causing 5 of my servers to attempt to connect to an external LDAP server. I inherited these servers when another employee left the company. As far as I know these servers were built in the same way as other servers in the data center. None of affected servers have internet connectivity.
The traffic is blocked by my firewall, but 3 of the servers are a XenApp 5 farm and seems to be causing a noticeable lag in some instance, like opening the Citrix Console. I have 3 other farms configured identically, as far as I can tell, that do not have this issue. The farms are W2K8 and the other servers are W2K3. I see the access attempts in both in the firewall and in ProcMon when I capture the traffic and open the Cert Manager.
The capture above is when I attempt to expand the Cert Manager tree, it takes 45-60 secs before the tree expands, while on non affected systems the tree expands instantly.
Since the firewall logs don't always correspond to times when users would be logged into servers I suspect that it maybe related to somehow to when a cert is accessed in someway and Windows attempts to validate it somehow. Unfortunately I haven't found any reference to this type of behavior and I haven't found any cert that references the IP listed in the capture above. A reverse look up of the IP doesn't provide any additional information either. Since internet access isn't allowed with these systems the standard root cert updates are not pulling, nor I'm finding is the WSUS server the servers are attached to providing them either. As far as I can tell Microsoft hasn't provided a way to update root certs for non internet connected servers.
I want to stop this behavior as it will never connect and in some cases is impacting performance.
Edit: I had checked the CAPI2 event log, but didn't realize it wasn't enabled by default. I enabled and opened the Cert Manager plug in. I then got errors in the CAPI2 event log pointing to a McAfee Cert. I'm currently chasing this down now. I'll up date with what I find. I'm still open to any additional help out there.
Follow up to edit: Corrected McAfee cert issue, but original problem continues.