Sharing problems Windows server 2016, SMB?

Question

I'm having problems with my clients SMB share ever since a power outage, even though it's connected to UPS and never shut off.

We are running this server as a Hyper-V host for 4 virtual servers, all of which are backed up to a Netgear ReadyNAS 2120.

I can browse to the NAS interface

I can ping the NAS using both IP and hostname.

But I can't access it trough file explorer and therefore Veeam can't access the backup repository.

I can't access other SMB shares on the fileserver or even the fileserver.

All other servers are working fine, they can access all shares, the NAS and the other servers.

The other servers can access the Hyper-V host.

I've uninstalled SMB1 feature and reinstalled it.

Tried turning off the firewall.

Tried editing the SMB in regedit.

Tried every suggestion Google can provide.

I still feel like it's a SMB issue I'm not able to find.

I'm grateful for any and all suggestions!

Answer 1

Hello @Cristian Karlsson ,

Considering the potential implications of the STATUS_NOINTERFACE error, I would suggest changing the "start" trace commands to this:

New-NetEventSession -LocalFilePath ([System.IO.Path]::GetFullPath("why.etl")) -Name NoSMB  
Add-NetEventPacketCaptureProvider -Level 255 -SessionName NoSMB  
Add-NetEventProvider -Name "Microsoft-Windows-SMBClient" -Level 255 -SessionName NoSMB  
Add-NetEventProvider -Name "Microsoft-Windows-DNS-Client" -Level 255 -SessionName NoSMB  
Start-NetEventSession -Name NoSMB  
Add-EtwTraceProvider -Guid {F818EBB3-FBC4-4191-96D6-4E5C37C8A237} -MatchAny 0xFFFFFFFFFFFFFFF -Level 255 -SessionName  NoSMB  
Add-EtwTraceProvider -Guid {E4AD554C-63B2-441B-9F86-FE66D8084963} -MatchAny 0xFFFFFFFFFFFFFFF -Level 255 -SessionName NoSMB  

This adds the MRxSMB and MRxSMB20 WPP ETW providers. I believe that mrxsmb.sys handles the WSK requirements of the SMB driver; adding mrxsmb20.sys tracing might add some more context to the trace data.

There is no need to change the "stop" trace commands.

Gary

Answer 2

Hello @Cristian Karlsson ,

The first thing that I would do is to use Event Tracing for Windows (ETW) to trace the Microsoft-Windows-SMBClient provider. It may be that your problem happens before this provider has anything useful to report, but that would at least help to divide the search space for the problem cause.

One way of creating a trace is to use the logman command. Start a trace with the command:

logman start nosmb -ets -p Microsoft-Windows-SMBClient -o why.etl

Then reproduce the problem and finally stop the trace with the command:

logman stop nosmb -ets

You can then either analyze the trace file (why.etl) yourself or make it available here via a URL to OneDrive, Google Drive, etc..

Gary

Answer 3

I'd start with testing connectivity to a Windows server. In Powershell run:

Test-NetConnection -ComputerName xxxxxx -CommonTCPPort SMB  
net.exe view \\xxxxxx  

Are you able to connect? Do you see the share names? What error message do you get?

Did you check the security eventlog to look for logon errors? Are your Active Directory domain controllers alive and well?

nltest.exe /server:xxxxxx /SC_QUERY:YourDomainName

Maybe try other nltest commands to verify that AD authentication is working.

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731935(v=ws.11)

Answer 4

Please run;

Dcdiag /v /c /d /e /s:%computername% >c:\dcdiag.log
repadmin /showrepl >C:\repl.txt
ipconfig /all > C:\dc1.txt
ipconfig /all > C:\dc2.txt
ipconfig /all > C:\problemworkstation.txt

then put unzipped text files up on [OneDrive][1] and share a link.

Answer 5

Hmmm, DNS errors in the etl trace and dcdiag.... But Test-Netconnection was able to resolve dc1.

Random thoughts: What device is not on the UPS and got rebooted when you lost power and might impact networking? Is DC1 your DNS server? Are you using fixed IP addresses or DHCP? Does NSLOOKUP resolve names correctly? You shouldn't have to uninstall/reinstall anything to recover from a power outage. Have you just rebooted any (all?) of the machines? Did you check the security/system eventlogs?

Sorry for the odd set of thoughts, just trying to figure out where I'd look next.