Klaptrap's questions

Windows 2003 SP2 file server - no recent network / hardware / software updates suddenly becomes inaccessible to laptop users running Windows 7 Pro. Don't know if this is relevant. Other users on standard XP desktops continue to see server and shares with no issue. Users security and network policies not recently changed - only a desk swap. Network via wifi and ethernet all ping and trace to other devices in network neighbourhood. Server in question appears in the network list but any of the following fail:

• \\servername
• double click on server in neigbourhood - intermittent
• double click on share
• ping to IP
• ping to servername

I have checked for viruses on the server, rebooted the server, unchecked SMP on NIC, disabled IPv6, ensured firewall is off, checked wifi router and cabling, check LAN cabling but to no avail.

I have also check for DHCP collisions etc etc. Occasionally, I can get one of the laptops to connect if I remove it from the domain and then add it back in again. User has 5 minutes of connectivity with the server and then access denied and the machine is not longer contactable although visible.

Laptops are 2 x HP ProBook and 1 x Some DELL - all new

Weird!

Now that we have applied an internal to external rule blocking all users access to the internet, other than those users in a whitelist, we have the obvious issue of non authenticated users, not on our domain, i.e.; domain-less guests not being able to access the internet. Other than configuring each machine to use our alternative gateway - which would require a member of IT to be onsite everytime a guest arrives - can this be done through ISA adn AD?

I have a rule to deny all access from internal and local host to external. I do no apply a user group and the rule is added to the configuration but obvious does not come into play.

As soon as I add a user group to the rule - even an empty one with no local or active domain users - the rule comes into force and no one has internet access.

This cannot be correct, any suggestions?

Our Sonicwall vendor supplied and networked the NSA240 when we required a DMZ in our infrastructure. This was configured and appeared correct although VPN users periodically dropped DNS and Terminal Services. The vendor could not resolve and so the call was escalated to Sonicwall.

The Sonicwall support engineer took a look and concluded that the X0 (LAN) and X2 (DMZ) intefaces were cabled to the same switch and so this is the issue. What he observed is a ping request to the LAN Domain Controller, from a connected VPN user, is forwarded (x0) from the VPN client IP to the DC IP but the ping response from the DC IP to the VPN client IP is on X2, a copy of the log is detailed below:-

02/02/2011  10:47:49.272  X1*(hc)  X0  192.168.1.245  192.168.1.8   IP  ICMP  --  FORWARDED
02/02/2011  10:47:49.272  --       X0* 192.168.1.245  192.168.1.8   IP  ICMP  --  FORWARDED
02/02/2011  10:47:49.272  X2*(i)   --  192.168.1.8    192.168.1.245 IP  ICMP  --  Received

• X0 - LAN
• X1 - WAN
• X2 - DMZ

The Sonicwall engineer concluded that we either need a seperate switch for X2 or we use a VLAN switch for both.

I am the companies software engineer and we have yet to have heard back from the vendor, so I am lost at sea at the moment. Do we need to buy this additional equipment or is there another configuration on the NSA240 we can use?

Dell PowerEdge 2900 with IBM Ultrium DTO III installed. Tape drive ejects and accepts tapes and backup software successfully writes to tape but I have a red 3 on the LED of the tape unit and a flashing amber light. I have tried the online support at Dell and IBM but cannot find any article - even Google reveals nothing. Any ideas on how to diagnose the issue - tape drive unit appears in in device manager although in other devices I do have an unknown - this could be something to do with it - or perhaps not?

Base licence configured CISCO ASA 5505 is not capable of routing based on interpretation of the inbound http request headers - affectively host header redirect - am I correct?

If I am correct will an upgrade from the base licence help me - or is device not the best for this type of requirement, and if so, please recommend a similar device (budget wise) that is.

If am not correct, and a base licence configure Cisco ASA 5505 will do this, please advise...

Thanks.

I am a developer not a sysadmin but I was recently asked to lock down the workstations - in terms of stopping users from adding software. I followed the online articles on adding domain admins and specific users to the restricted group category in the GPO and now all hell has broken looose. I have users that cannot change the time, access mydocuments and server services that cannot start. The servers are most puzzling as the services are set to run with accounts that are members of domain admins.

I am now faced with regressing the GPO policy which does not seem to have a long-term affect and then address the issue all over again.

I have created a new domain controller with my single domain forest. I have also made it DHCP and DNS ready - all 3 services have synchronised with the existing W2K8 domain controller.

I even migrated the FSMO roles and thought everything was fine. Indeed all machines on network appear to obtain DHCP and DNS from new server and the AD is working on the new server as my internal website uses it for login authentication.

I have just noticed, via BgInfo - Sys Internals - that the new server is showing as "backup" and the old as "primary" - I thought I had already achieved this. Have the FSMO roles swapped back - as I have yet to have removed the old server from AD (dcpromo).

Do I need to do anything before I run dcpromo on the old server?

Any thoughts appreciated....