question

Hello @CristianKarlsson-0763,

The first thing that I would do is to use Event Tracing for Windows (ETW) to trace the Microsoft-Windows-SMBClient provider. It may be that your problem happens before this provider has anything useful to report, but that would at least help to divide the search space for the problem cause.

One way of creating a trace is to use the logman command. Start a trace with the command:

logman start nosmb -ets -p Microsoft-Windows-SMBClient -o why.etl

Then reproduce the problem and finally stop the trace with the command:

logman stop nosmb -ets

You can then either analyze the trace file (why.etl) yourself or make it available here via a URL to OneDrive, Google Drive, etc..

Gary

I'd start with testing connectivity to a Windows server. In Powershell run:

 Test-NetConnection -ComputerName xxxxxx -CommonTCPPort SMB
 net.exe view \\xxxxxx

Are you able to connect? Do you see the share names? What error message do you get?

Did you check the security eventlog to look for logon errors? Are your Active Directory domain controllers alive and well?

nltest.exe /server:xxxxxx /SC_QUERY:YourDomainName

Maybe try other nltest commands to verify that AD authentication is working.

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731935(v=ws.11)

Please run;

Dcdiag /v /c /d /e /s:%computername% >c:\dcdiag.log
repadmin /showrepl >C:\repl.txt
ipconfig /all > C:\dc1.txt
ipconfig /all > C:\dc2.txt
ipconfig /all > C:\problemworkstation.txt

then put unzipped text files up on [OneDrive][1] and share a link.

Hmmm, DNS errors in the etl trace and dcdiag.... But Test-Netconnection was able to resolve dc1.

Random thoughts: What device is not on the UPS and got rebooted when you lost power and might impact networking? Is DC1 your DNS server? Are you using fixed IP addresses or DHCP? Does NSLOOKUP resolve names correctly? You shouldn't have to uninstall/reinstall anything to recover from a power outage. Have you just rebooted any (all?) of the machines? Did you check the security/system eventlogs?

Sorry for the odd set of thoughts, just trying to figure out where I'd look next.

Hello @CristianKarlsson-0763,

Can you make another trace, this time incorporating two more providers? We will need to use a different technique, since one of the providers needs to be started in a special way.

In a PowerShell windows, first issue the five commands:

 New-NetEventSession -LocalFilePath ([System.IO.Path]::GetFullPath("why.etl")) -Name NoSMB
 Add-NetEventPacketCaptureProvider -Level 255 -SessionName NoSMB
 Add-NetEventProvider -Name "Microsoft-Windows-SMBClient" -Level 255 -SessionName NoSMB
 Add-NetEventProvider -Name "Microsoft-Windows-DNS-Client" -Level 255 -SessionName NoSMB
 Start-NetEventSession -Name NoSMB

Now reproduce the problem and, afterwards, issue the two commands:

 Stop-NetEventSession -Name NoSMB
 Remove-NetEventSession

The resulting why.etl file can be shared, as before.

The NetEventPacketCaptureProvider provider (Microsoft-Windows-NDIS-PacketCapture) can generate a lot of trace data, so the trace should be kept as short (in time) as possible.

Gary

Hi,

Thanks for posting in Q&A platform.

Please try the following method:

Open local group policy editor, change the "Restrict NTLM: Outgoing NTLM traffic to remote servers" settings to "Allow all". The path in the local Group Policy Editor is:

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers

If the issue still cannot be resolve, please understand analyze the ETL trace is beyond our forum support level, I would suggest you could contact Microsoft technical support for more deeper investigation of the ETL trace results.

Also, in this way, they can have a clear picture about your issue and your environment by phone communication and live share session.
You may find phone number for your region accordingly from the link below:
https://support.microsoft.com/en-us/gp/customer-service-phone-numbers

Best Regards,
Sunny

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.