Losing Net Share Constantly

[suedaisy]

Hi,

Every 5 minutes or so we lose net share on only one of our Win2k servers.
I have scanned it for viruses numerous times. and it comes up with something on the M:\ drive (its our Exchange) and it quarantines it.
I even have a different scanner to check for trojans specifically and that's not finding anything either.
I don't know what else to do. And the big problem is that computer is used to authenticate all my users (not sure how THAT happened).
So my questions are.. 1) How can I get my net shares back and to stay? or 2) Can I make that computer stop being the primary authenticate for the end users?
All of my users are on Win98.. and the servers are Win2k Advanced Server.
Thanks for your help!!

 

[ChicagoTechNet]

posting he result of net share command on the server when it is disconnected here may help.

Robert Lin, MS-MVP, MCSE & CNE
Windows, Network, Internet, VPN, Routing and How to at

http://www.ms-mvps.com

 

[suedaisy]

I hope this is what you're asking for..


Share name Resource Remark

-------------------------------------------------------------------------------
F$ F:\ Default share
print$ C:\WINNT\system32\spool\drivers Printer Drivers
Resources$ C:\Program Files\Exchsrvr\res "Event logging files"
D$ D:\ Default share
C$ C:\ Default share
Address C:\Program Files\Exchsrvr\address
"Access to address objects"
MYMAIL.log C:\Program Files\Exchsrvr\MYMAIL.log
"Exchange message tracking logs"
NETLOGON C:\WINNT\SYSVOL\sysvol\ourdomain.com\SCRIPTS
Logon server share
SonicWall D:\SonicWall
SYSVOL C:\WINNT\SYSVOL\sysvol Logon server share
tools F:VPHOME D:\PROGRA~1\SAV Symantec AntiVirus
VPLOGON D:\PROGRA~1\SAV\logon Symantec AntiVirus
HPLaserJ IP_192.168.168.58 Spooled HP LaserJet 4
The command completed successfully.

 

[suedaisy]

Help? Anyone? Please???

 

[tangostar]

Is there any reason that this server is a Domain Controller?

 

[suedaisy]

I have no idea why.. it was set up like this. It's our Exchange server and backup server.. and that's the only function it performs.
I wish I could just stop it from authenticating users. Plus we use Active Directory..

 

[tangostar]

By backup server do you mean, Backup Domain Controller or a Server were you backup files to?

 

[suedaisy]

Oh. I meant Veritas.

 

[tangostar]

Do you have any other DC's in the network?

 

[suedaisy]

2 others. 1 is the primary.. and the other is our SQL server. we tried to undo the domain controller on the SQL server but then we couldnt gain access to anything on that computer.. so we made it a DC again.

this network is built really funny. as you can tell.

 

[tangostar]

well then, if you run dcpromo on your exchange server and demote it from being a DC, users will no long authenticate to that server.

 

[suedaisy]

OK.. I can do that. And in case something screws up can I re-promote it to being a DC again?
Exchange server doesnt need to be a DC right?

 

[tangostar]

Exchange does not have to be on a DC in fact it's better not to.

 

[tangostar]

Exchange does not have to be on a DC in fact it's better not to.
Make sure you have a good backup before you make any changes.

 

[ChicagoTechNet]

Sorry for the delay. The net share doesn't list IPC$ that is the porblem. Comparing it with other good computer you will see what different. If this is correct, the server gets a virus.

Robert Lin, MS-MVP, MCSE & CNE
Windows, Network, Internet, VPN, Routing and How to at

http://www.ms-mvps.com

 

[suedaisy]

Yea.. I have to keep typing net share ipc$ into the command prompt in order to let people in.
I ran Norton i don't know how many times, and now it's completely clean, no issues. I applied fixes for everything (but always says "not found") and still.. no go.

 

[xmsre]

This really belongs in the E2K forum. You lose the M: drive mapping because IS goes offline. IS goes offline because you are scanning the M: drive. That's a big no no in the E2K world. Exclude it from your scans.

In that you have been scanning your M: drive, and ripping stuff out via the IFS, and IS doesn't like that and goes offline, odds are your store is corrupt.

You also want to exclude exchange database and logs. If your av quarantines an exchange log file, your stores will go offline. Bottome line, USE AN EXCHANGE AWARE AV PROGRAM TO SCAN EXCHANGE.

 

[suedaisy]

I have Enterprise edition of Symantec. I have it to scan my computer ONLY (which excludes M: drive) and one especially for exchange server to scan all email and mailboxes.

And I don't have the problem of my stores going offline. Just my net shares and it only deals with authenticating users to log on. The email is coming through just fine.

 

[xmsre]

Form the original post:

"I have scanned it for viruses numerous times. and it comes up with something on the M:\ drive (its our Exchange) and it quarantines it. "

Are you also rumming realtime scanning on the server outside of exchange? That would be where the problem is.

 

[suedaisy]

My own typo. Not the M: drive.. the C: drive.

Yes, I am running realtime scanning on the server outside of exchange.
You think disconnecting that will allow the ipc and admin net shares to stick?
Wouldn't I be then left unprotected without real time scanning?