Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I keep finding that on our small company LAN (7 users, 3 servers) that some servers keep becoming "not accessible" for the purposes of file sharing. They display the message "\SERVER is not accessible. You might not have permission to use this network resource. The user name could not be found". But I don't know why "the user name could not be found" as all the machines are on the same domain and the PDC and BDC seem to be behaving OK.

EDIT:

VPN seems to be the cause:

It turns out I can see the server if I use the IP address (\\1.2.3.4\ etc) or the FQ active directory name (eg \server.domainname.local) but not if I use the server name on its own or a mapped network drive originally created from the "short" name. Oddly though, my machine has no issue resolving the server's DNS name as I can ping the machine name OK and it immediately comes back with the IP, however nslookup seems to fail.

It seems to be a problem with how Windows looks up machine names when connected to VPNs. When I'm connected to a VPN, windows seems to use the DNS assocated with the VPN and not the one on the domain controller. This behavior to me, seems incorrect as surely that would mean connecting to any VPN would break any ability to lookup local machine names for servers and printers etc. So I guess the real question now is, how can I make my machine still search the local Active Directory DNS (the PDC) even when connected to a VPN?

More info in my comments below.

share|improve this question

migrated from superuser.com May 24 '13 at 13:50

This question came from our site for computer enthusiasts and power users.

    
CALs wouldn't have anything to do with it since that applies to terminal services and not the file sharing. As a domain admin, are you able to access say, \\server\c$ consistently? –  Nathan C May 24 '13 at 13:55
    
Check your DNS settings on the workstations that get this error message. Ensure that it is pointing to an internal DNS and not an external one. If I use Google DNS instead of the internal DNS it will tell me I do not have permission and that a possible security breach is detected. –  Travis May 24 '13 at 15:27
    
I can ping and Remote Desktop to the servers OK. It's only file sharing which isn't working properly. I don't see how I can connect as a domain admin as it's not even getting that far (normally it would prompt for credentials after you've connected to the resource). –  NickG May 24 '13 at 15:54
    
When the issue occurs, can you connect using the server ip address? \\n.n.n.n\share –  Greg Askew May 24 '13 at 16:24
    
Yes! Turns out I can see the server if I use the IP address but not the server name. Oddly though, my machine has no issue resolving the machine name as I can ping the machine name OK and it immediately comes back with the IP. –  NickG May 28 '13 at 12:47
show 14 more comments

7 Answers

With some VPN setups, it is required that you go through the VPN gateway. That is how they maintain a safer network environment by not allowing you to download stuff from potentially threatening sites.

If you have a lax VPN setup, you can also uncheck the box that uses the VPN's default gateway, so any requests first hit your gateway (and domain dns) before hitting the VPN's gateway and DNS.

  • In Windows 7, I click the network icon to view my connections, right-click the VPN and choose 'Properties.'
  • Next, click the 'networking' tab.
  • for each IPv6 and IPv4 (if they are enabled), double click the item, click 'advanced,' then uncheck the 'Use default gateway on remote network' checkbox. Click OK twice and follow the steps for the remaining IP versions.

Disconnect and reconnect to the VPN, if you had it active.

If you notice any connectivity issues, reenable the default gateways. As I said previously, the VPN may require this to be enabled.

share|improve this answer
    
This option is already unchecked. However the default gateway has nothing to do with DNS so not sure why this setting would affect it anyway. –  NickG May 29 '13 at 8:07
add comment

Does your DNS server for VPN clients is the same as DNS server for Lan clients?

I think your problem is that the VPN clients use their DNS server from ISP, not from your VPN's DNS. You can make the VPN client use VPN's DNS by this step:

  • Find this registry key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage

  • Double click Bind
  • Move "\Device\NdisWanIp" item to top os the list
  • Restart client.

or use simple reg file:

%systemroot%\system32\reg.exe ADD HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage /f /v Bind /t REG_MULTI_SZ /d \Device\NdisWanIp\0...

Remember backup your registry before doing anything in it.

share|improve this answer
    
I don't have a key called NDisWanIP... They're all GUIDs. eg \Device\{34D64604-4F4A-4C85-B5E0-9088F583F1F1} –  NickG May 29 '13 at 8:08
    
Do you see it in HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters –  Gnouc May 29 '13 at 8:36
    
But doesn't this do the same thing as just changing the binding order using the binding order dialog? (ncpa.cpl [Menu] > Advanced Settings). If so, the binding order in that dialog already seems to be correct, with LAN prioritised over Remote Access Connections. –  NickG May 29 '13 at 8:48
    
No, move the Remote Access Connections above Lan –  Gnouc May 29 '13 at 9:04
    
But I want it to check my LAN DNS before the RAS DNS? –  NickG May 29 '13 at 12:35
add comment

Change the binding order so that your physical NIC is higher than your VPN interface. You may have to manually (or via script) poke things around further, depending on what the VPN software does.

share|improve this answer
    
might as well poke this with a 2x4 since none of what you say would work. –  tony roth May 28 '13 at 17:33
1  
I read this as, the questioner trying to prioritize the local DCs to be the DNS providers when a given machine is connected to a VPN that connects to an outside organization. Did I misunderstand the question and edits? –  mfinni May 28 '13 at 17:55
    
After rereading his last reponse you maybe correct! –  tony roth May 28 '13 at 18:11
    
If my reading of the scenario is correct, then I have been in similar positions, and my solution worked. –  mfinni May 28 '13 at 18:32
    
It looks to be correct according to the GUI. The NIC is above the RAS connections but not sure that affects DNS priority - only routing priority? –  NickG May 30 '13 at 8:40
add comment

I had a similar issue where DNS resolved, but could not ping or tracert the IP. The way I solved my problem was by re-checking the IP settings on the server. Turns out it did not have a default gateway and setting it resolved the issue.

share|improve this answer
add comment

Setup UseRasCredentials=0 as discribed here: https://www.conetrix.com/Blog/post/Access-Domain-Resources-When-Connected-to-VPN.aspx

share|improve this answer
    
Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Scott Pack Oct 7 '13 at 14:06
add comment

If you are only not able to connect to the share using the "short" name, IE NetBIOS name, then I would recommend using a WINS server as it will allow you to resolve NetBIOS names over the VPN, as long as your VPN adapter allows you to specify a WINS server. For me, I have our internal AD DNS server also configured as a WINS server and our VPN server (Sonicwall) publishes both a DNS and WINS server to our VPN clients. With this configuration we are able to resolve both the NetBIOS names as well as the FQDN.

The other thing you can do is change your DNS suffices in the advance TCP properties on your network adapter. This will have your Name resolution of short names:

  1. WINS
  2. DNS using suffix 1
  3. DNS using suffix 2
  4. DNS using suffix N

Hope that helps

share|improve this answer
add comment

I think you need to set the firewall to use the PDC as its DNS so that it gives out that DNS server to the VPN clients. Or you could forward VPN requests to the PDC and make it a RAS server to use SSTP so that the clients are definitely going to have a consistent experience regarding DNS whether on VPN or LAN.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.