Home / server / Questions / 735315
In Process
Daniel
Asked: 2015-11-11 09:05:43 +0800 CST

LAN with AD server: recurring slow link problems, how to diagnose?

  • 772

I have a multi-site Active Directory domain. All domain controllers across all sites are running Windows 2012 Standard R2.

Site 1 and 2: everything works fine

Site 3: I just setup and I’m having consistent problems across various computers where

  1. First login to a computer sometimes takes a long time (initial account setup of a domain user on a new computer)
  2. Group policy mapped drives do not appear, even though gpresult reports that the group policy was correctly applied
  3. gpupdate will often take a long time to apply.

I have confirmed that the sites are setup correctly in AD, and that only the two local AD servers are attached to the local site. Furthermore, I have confirmed via echo %logonserver% that my local machines are only using the local AD servers to login.

I can ping the AD servers consistently with <1ms response time. All network cable in the building is recently installed and CAT6, and the symptoms do not seem to consistently affect one computer above the others: it is quite random. Sometimes mapped drives load successfully, sometimes not. There are only about 15 computers in the building, and all pass through a 48-port gigabit Cisco switch which is running the latest firmware available.

The AD servers themselves are running on a VM atop an Intel i5, RAID SSDs, and each have 8GB of memory apportioned.

The only common clue I see when running gpresult is that I am getting a slow link detected warning, which seems silly considering everything is on the LAN and connected via gigabit. In my research it seems that it is to be expected that mapped drives will not reliable appear under slow link connections.

How can I go about diagnosing the cause of this problem?

active-directory

2 Answers

  1. LogonServer or even nltest /dsgetdc may not accurately reflect which domain controller is used for pulling group policies. I've seen scenarios where the local domain controller is correctly being used for authentication, but a domain controller in another site for group policies.

    You need to perform:

    Enabling UserEnv Logging in Windows 7

    In Windows 7 GPO processing is performed by a service called "Group Policy Client" . A log file can be written by the service when implementing the following registry value:

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Diagnostics]  
"GPSvcDebugLevel"=dword:00030002

    The resulting log file will be %WINDIR%\debug\usermode\gpsvc.log

    • 1

  2. Well, I decided to try something... Reset my Cisco Switch to factory defaults and the slow link problem went away. Just to be safe, I then decided to swap out the entire switch with an identical backup Switch that I have on-site, also running factory defaults. gpresult now identifies the link as high speed. However, I am still experiencing problems where gpupdate takes way to long to apply (sometimes 10 seconds, sometimes 120 seconds), and also my drive map only intermittently show up.

    I’m thinking maybe I should repost with a different title since the slow link symptom doesn’t seem to be as critical as I thought.

    • 1