-2

We have an SBS 2003 server, with a Windows XP Professional (domain-joined) PC connecting from a remote site via VPN (LogMeIn Hamachi).

One domain user account is unable to browse any shares on the server from the remote PC (despite having the same security group membership as the other domain user accounts).

Browsing "\\server\share" is successful with all other domain user accounts on this PC, and this user account works perfectly on all PCs in the main office (just not on this remote PC connecting via VPN).

This is the error I get when trying to browse network shares with this account:

enter image description here

Pinging the server is successful (has no trouble resolving hostname to IP).

I have deleted and recreated the domain user profile on this PC- but it made no difference (so not a corrupted profile issue).

Disabling the firewall on the server and workstation made no difference.

I have not posted the results of ipconfig here as they are identical for the problematic user account and all the working domain user accounts.

  • browsing to "\\server" does not list any shares on the server (whereas it does with all other domain accounts).

enter image description here

  • browsing the server by IP (rather than hostname) also fails ("\\192.168.1.50\share"), suggesting this is not a NetBIOS issue.

  • rejoining the PC to the domain did not resolve the issue

  • resetting the password on this domain user account did not resolve the issue

  • browsing to "\\server" does work when testing the problematic domain user account using a different Windows XP PC on the domain.

We only have 1 PC at the remote site that connects via VPN, so it is difficult to say if the (fairly slow) VPN connection is somehow causing the issue here, or if there is something wrong with the PC itself.

The other PC I tested today was in the main office (on the LAN, rather than relying on VPN to communicate with the DC).

If necessary, I can move the problematic PC up to the main office temporarily so we can narrow down if the problem is related to VPN or the PC itself.

Any suggestions of further troubleshooting steps I can try would be much appreciated.

Update:

I just noticed something very strange when doing further troubleshooting:

When this domain user is added to one particular security group, they can no longer see any shares on the server. However, if the user is not a member of this security group, then ("\\server") does show a list of all shares on the server.

How could being a member of a security group cause network shares on a server not to be displayed when browsing by UNC path? We have been using this security group for over 4 years without problems (and, even now, it does not affect other users in this way).

Also, the Application Log on the workstation has errors stating that the DC cannot be contacted- but this only seems to be happening when the logged in user is a member of the problematic security group:

enter image description here

Improve this question
7
  • It should be mandatory to leave a comment when downvoting a question. This is clearly-explained, genuine issue- which is well within the scope of Server Fault. If anyone has a problem with this question being asked- then they should say what it is so I can try not to offend the pour souls again!
    – Austin ''Danger'' Powers
    Jul 9, 2013 at 20:42
  • 2
    Agree about down-voting. The same thing happens on Stack Overflow. Back to your question, to remove NetBIOS name resolution from the equation, can you see if the VPN client works when referring to the UNC with an IP address, e.g.: \\10.x.y.z\share ?
    – Simon Catlin
    Jul 9, 2013 at 20:53
  • Good question. Yes- it still fails when browsing by the server's IP address. Apparently this isn't a NetBIOS issue. I have updated my question with this information.
    – Austin ''Danger'' Powers
    Jul 9, 2013 at 21:12
  • Another downvote from someone with too few braincells to say WHY he downvoted it. I'm going to complain on meta about this. People who take issue with a question (which complies with all the posting rules of the site) should have to explain downvotes so others people can know what they are doing "wrong". Apparently the only reason they make downvotes anonymous is to prevent something called "retaliation votes". You couldn't make it up. If this was a site for teenagers I might understand, but I thought this was a place for people with more maturity than that.
    – Austin ''Danger'' Powers
    Jul 10, 2013 at 2:10
  • 1
    a quick test for the VPN (though not a very good one) might be to share out a folder on the troublesome workstation and see if the server can access it. Another option might be to try nbtstat -A <ip> and see if it can query the server from the workstation.
    – MikeAWood
    Jul 10, 2013 at 2:35

2 Answers 2

Reset to default
2

You should consider tailoring your troubleshooting to the subsystem at hand; of course it isn't a problem with their profile.

Frequently, issues like this are caused by problems with the workstation (or occasionally, the server) service on the workstation .Ensure these services are running. As well, if there is a domain, sometimes this can be caused by the inability to establish a secure channel (consider resetting the workstation's computer account password in the domain, or removing it from the domain and joining it back).

Also, you should check whether the user can browse all the shares on the server (\\server\), and just can't see anything. This can determine whether there is actually an issue establishing a CIFS connection or whether it might be permissions.

Also consider testing from another workstation, and testing another user account from the same workstation. Sometimes, OS corruption can cause this.

Looking at your update, it looks like there is something wrong with this workstation's configuration for sure. OS corruption is possible, certainly, but it might also be something else. For instance, netbios over tcp/ip might be disabled on the interface which would be used to connect to the server. In windows 7 you can disable file sharing and network discovery based on the profile of the connected network (eg. public, home, domain, or work), though I don't believe this applies to XP.

It's also possible that the client for microsoft networks provider on the interface might be disabled, or file and print sharing for microsoft networks. Also check the network discovery option in the network and sharing centre control panel item.

Improve this answer
6
  • Connecting to remote file shares is a function of the Workstation service not the Server service.
    – joeqwerty
    Jul 9, 2013 at 15:41
  • I seem to recall something about the server service also being used if kerberos was in use, but I may be wrong.
    – Falcon Momot
    Jul 9, 2013 at 15:42
  • AFAIK, the Server service is used by the host hosting the shares and the Workstation service is used by the host accessing the shares.
    – joeqwerty
    Jul 9, 2013 at 15:44
  • @Falcon: The "server" service is running on both the server and workstation. The problematic account cannot browse any shares on the server (\\server)- nothing is displayed. All share and NTFS permissions look good on the server for the problematic domain user. This was a clean install of XP last week so my feeling is there is no OS corruption (especially as no other accounts are affected). I will try rejoining the PC to the domain and resetting the account password after office hours today and let you know how it goes.
    – Austin ''Danger'' Powers
    Jul 9, 2013 at 20:56
  • I have updated my question with more information. It seems the problem only happens on one PC- however, this is also the only PC connecting via VPN. Is there any way I can narrow down the issue further without moving this PC to the main office to take VPN out of the equation? It is very strange how only one domain user account cannot browse network shares. There must be something I can delete or reset to fix this.
    – Austin ''Danger'' Powers
    Jul 10, 2013 at 2:01
0

I had a similar problem, it turned out that the user had mistakenly set invalid credentials for connecting to the domain controller. I opened credential manager, removed the credentials stored for that connection, logged off and logged on again, and voila! fixed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .