Ultra slow browsing

[kathanon]

Hi I wonder if anyone can help

In the last few days our network has become very very slow for some machines. I am not sure why but I am also getting certain errors about no default server credential existing on the system Event ID 36872

Other events are also to do with the browser service -8003 about elections being forced.

I don't know why. The only thing I can think of that has been done is that we started to run a password hacking programme as part of a security audit after hacking attempts showed up in the security. I think it was Lopht but not absolutely sure. I don't know if that has anything to do with it. The network was absolutely fine before but now some users are having real problems accessing network resources.

Any help would be gratefully received

Kathy

 

[jimw32]

Your Secutiry program maybe the problem. If you have set it up to go and try and hack your local users PC's to check for weak passwords.It could be flooding your network. WHat are the ping times from the slow clients machine to your router. If they are slow that would be indication of that.

If you have any packet anyaizing software set it up to monitor your net work for port scans.

If you don't have anything like this you can get snort form snort.org for free, it is a IDS program that will monitor your network and tell you which I.P. is doing the scanning.

Is all your anti virus up to date? If not I would be sure to get them upgraded and to start checking for virus's just to be safe.

Hope this helps

Jim

 

[ReddLefty]

Check your Master Browser. Make sure your election is forced onto one server only. In the support tools for Microsoft, there is a Domain Browser utility that will list the Master Browser and the Backup Browser. Make sure it's your DC's #1 and #2.

Check the registry key of your primary DC (the one with the PDC service on it) for the following entry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters]
"IsDomainMaster"="TRUE"

(restart the Computer Browser service after editing)

There should only be ONE master browser. All other DC's should have FALSE (if entry exists).

Possible problems: SAMBA servers. They tend to want the master browser role also.

If you find other computers that are winning the election of the master browser, you can turn off the Computer Browser service on that computer.

Good luck.

 

[koquito]

do they all have teh same DNS server settings?

A+, MCP, CCNA
marbinpr@hotmail.com

"I just know that I know nothing"
Socrates (469-399 B.C.E.)

 

[kathanon]

Thanks everyone, this has been driving me nuts. I am going to try some of the things mentioned tomorrow morning. It is nearly time to go home here.

I do know that different ports on the switch seem to work and then not work. I don't understand why. I am not sure if one of the machines is flooding the network. Am going to try setting up a new switch and troubleshooting tomorrow

Thanks

Kathy

 

[Jpoandl]

You first Event View message has to do with SSL. I would think that this is causing a problem on you network.

However, the browsing election could be related to your problem. Check this out:

http://www.jsiinc.com/SUBB/tip0500/rh0585.htm

I would also make sure that your clients are using the proper IP settings. Make sure you disable NetBueueeueue

The most important setting in the DNs settings.

Joseph L. Poandl
MCSE 2000

If your company is in need of experts to examine technical problems/solutions, please check out

http://www.esavio.com

 

[ReddLefty]

Only if you have a Certificate Authority Server installed could you have SSL problems.

If you don't, you can ignore the first message: Event ID 36872.

If you do, then you should concentrate on looking at your certificate server, as Jpoandl mentionned.