Losing connectivity with server very sporadically

Jim 271 Reputation points
2022-08-11T17:29:37.017+00:00

Server 2012
Version 6.2 Build 9200

Last night I went to remote into our file/DC server to check it. I couldn't connect using RDP even though the Sonicwall VPN showed me connected. I then tried my backup Chrome Remote Desktop to connect and could not. I shut down and restarted my Global VPN Client (GVC) and when I tried to enable it it prompted me for my password, which is saved on this computer. Putting in the password did not work.

I drove into the office and tried to connect to the server from the LAN. Same result. The server showed nothing on its monitor. So I restarted it. This fixed it and all was good.

I got on it again this morning around 09:00 and it appeared to be fine.

About 10:30 I got a call from a user that they could not connect to the internet. Their network showed "no internet". Restarted laptop, same thing. Ran the troubleshooter, no IP address. Then others started to complain. I could not wait to drive in so I just had the user power cycle the server. Again, all was good.

Now, looking at all the logs from 09:00 to 10:30 this morning the only errors I find are:
Error: TerminalServices - Printers ID 1111 These are always there and reflect my home printers not having drivers on the server
Warning: 1014 DNS Client Events "Name resolution for the name _ldap._tcp.dc._msdcs.BostonEnv.local. timed out after none of the configured DNS servers responded."
Warning: 6038 LSA (LsaSrv)
"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 70.
Error: 8193 VSS. Volume Shadow Copy Service error: Unexpected error calling routine RegOpenKeyExW(-2147483646,SYSTEM\CurrentControlSet\Services\VSS\Diag,...). hr = 0x80070005, Access is denied.
Warning: 10020 This computer has at least one dynamically assigned IPv6 address.For reliable DHCPv6 server operation, you should use only static IPv6 addresses.
2 Winlogon warnings about The winlogon notification subscriber <GPClient> took 75 second(s) to handle the notification event (CreateSession). and The winlogon notification subscriber <GPClient> is taking long time to handle the notification event (CreateSession).

These all occurred from 09:42 to 10:33. I got the call and restarted it.

After restart I had a bunch of TLS errors "A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 70." some also had a code 40

I have looked all across the DHCP and DNS logs, nothing.

I suspect LDAP and/or DHCP/DNS.

I have changed nothing on this server for weeks

Last night I went to remote into our file/DC server to check it. I couldn't connect using RDP even though the Sonicwall VPN showed me connected. I then tried my backup Chrome Remote Desktop to connect and could not. I shut down and restarted my Global VPN Client (GVC) and when I tried to enable it it prompted me for my password, which is saved on this computer. Putting in the password did not work.

I drove into the office and tried to connect to the server from the LAN. Same result. The server showed nothing on its monitor. So I restarted it. This fixed it and all was good.

I got on it again this morning around 09:00 and it appeared to be fine.

About 10:30 I got a call from a user that they could not connect to the internet. Their network showed "no internet". Restarted laptop, same thing. Ran the troubleshooter, no IP address. Then others started to complain. I could not wait to drive in so I just had the user power cycle the server. Again, all was goood.

Now, looking at all the logs from 09:00 to 10:30 this morning the only errors I find are:
Error: TerminalServices - Printers ID 1111 These are always there and reflect my home printers not having drivers on the server
Warning: 1014 DNS Client Events "Name resolution for the name _ldap._tcp.dc._msdcs.BostonEnv.local. timed out after none of the configured DNS servers responded."
Warning: 6038 LSA (LsaSrv)
"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 70.
Error: 8193 VSS. Volume Shadow Copy Service error: Unexpected error calling routine RegOpenKeyExW(-2147483646,SYSTEM\CurrentControlSet\Services\VSS\Diag,...). hr = 0x80070005, Access is denied.
Warning: 10020 This computer has at least one dynamically assigned IPv6 address.For reliable DHCPv6 server operation, you should use only static IPv6 addresses.
2 Winlogon warnings about The winlogon notification subscriber <GPClient> took 75 second(s) to handle the notification event (CreateSession). and The winlogon notification subscriber <GPClient> is taking long time to handle the notification event (CreateSession).

These all occurred from 09:42 to 10:33. I got the call and restarted it.

After restart I had a bunch of TLS errors "A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 70." some also had a code 40

I have looked all across the DHCP and DNS logs, nothing.

I suspect LDAP and/or DHCP/DNS.

I have changed nothing on this server for weeks.

Any ideas what this could be?

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,205 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,932 questions
Windows DHCP
Windows DHCP
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.DHCP: Dynamic Host Configuration Protocol (DHCP). A communications protocol that lets network administrators manage centrally and automate the assignment of Internet Protocol (IP) addresses in an organization's network.
1,023 questions
0 comments
Accepted answer
  1. Dave Patrick 426.1K Reputation points MVP
    2022-08-12T15:33:45.577+00:00

    Looks mostly Ok. On DC2 I'd add server's own static ip address (192.168.187.5) listed for DNS, then do ipconfig /flushdns, ipcofig /registerdns, and restart the netlogon service. There were a few access denied so some items were not reported because the user that ran scripts did not have permissions. In general I'd check the system and DFS Replication event logs for errors and try to clear up any found.

    --please don't forget to upvote and Accept as answer if the reply is helpful--

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Dave Patrick 426.1K Reputation points MVP
    2022-08-12T13:53:13.257+00:00

    Please run;

    Dcdiag /v /c /d /e /s:%computername% >C:\dcdiag.log
    repadmin /showrepl >C:\repl.txt
    ipconfig /all > C:\dc1.txt
    ipconfig /all > C:\dc2.txt
    ipconfig /all > C:\problemworkstation.txt

    then put unzipped text files up on OneDrive and share a link.

    0 comments
  2. Jim 271 Reputation points
    2022-08-12T15:18:28.41+00:00
    0 comments
  3. Jim 271 Reputation points
    2022-08-13T16:35:23.837+00:00

    OK, I made the changes you suggested (see image)

    Yeah, I thought that was odd in that I ran the script and I'm a Domain Admin.

    As for the logs I do notice on DC2 I have a ton of 4015 errors in the DNS logs on 8/10 and 8/11. I first noticed I started having connectivity issues to DHCP and LDAP (maybe one affected the other) on the 10th. We went into the office on the evening of the 10th to install a new firewall and had issues doing that so, in the interest of time, I just restarted the server and we finished the install without issue. Then, on the morning of the 11th, I got a call that people in the office could not connect to the server. Again, as I was offsite I had them restart the server. No issues since then, and nothing in the logs past the time of the second reboot on the 11th. I didn't want to mention the firewall install as I really think that had nothing to do with it as the issue happened both the day before and the day after the install, and the problem was internal to the office.

    Anyway, I will mark this as an answer for now and monitor this closely for the next week or so and report issues here.

    Again, thank you so much for the help.

    230837-image.png