[Misc] Ricoh 2075 SMB Auth failures after extended power outage?

[Guest]

DC running Server 2003 R2, all clients running XP pro R3, multiple network scanners (Ricoh 2075 & Lanier LD520c) using SMB authentication to reach shared folders on server. Everything has been working fine since setup 8 months ago. Then 16 hour power outage results in scanners not being able to see the server (I can see the domain from the touch screen, and all the client machines in the domain, just not the server). Everything else tests out fine after the power failure and I can't think of anything that would change/reset due to the long power outage, but I still can't scan either . . . so after a week of reading and searching on the forums, I'm ready to give up and start asking questions. I think I've read every post on this subject and tried every suggestion - nothing seems to work and this seems like it should be an easy fix (though I have no idea why a setting would change or be 'lost' due to the power failure).

I was thinking this was a problem with SMB authentication, but after checking and rechecking that strict naming was disabled and every other SMB tip I could find on the forums, I noticed that although all the XP clients connect and work just fine as they did before the power outage, they too do not show the server when searching the network. I can navigate to the domain (which shows up) and then see all the connected client PCs, but no the server. I can ping the server by IP and/or name, so it doesn't appear to be a DNS problem..

Oddly, if I enter the server IP or name in a windows explorer address bar, all the shares show up immediately, they just don't show up if I browse the network under the domain.

The DC is also our DHCP server and the clients are all in the same scope and seemingly working fine. the scanners are outside the scope on fixed IP addresses.

No firewall running on the server or clients (or scanner).

I can scan to any of the clients on the domain (though I have to use the local machine admin account and password - so again, the AD auth isn't working), so I've ruled out the switches and/or cables. Its definitely an issue with the server but I just can't determine what setting is off.

I've completely wiped out one 2075 scanner and put it back to factory-fresh settings in an attempt to figure this out. I guess worst case, I do have ScanRouter Pro sitting in the server room, I've just never bothered to install it based on the difficulties/complaints I've heard.

I'm open to suggestions - its been a week without scanning and the paper is really piling up!

[Vulkor]

Is if possible that some Windows Updates were Downloaded to your Server, but you Never Restarted the Server after the Updates and the Sudden Power Loss borked some of the Network protocols of the Server??
I've seen Windows Updates not install properly and really hose Server and Desktop OS's.

[Miescha]

Updates

Excellent thought - I had it also :-(

I've poured over the logs and windows updates history. The last update to the server was 2-days prior to the outage and included a reboot. There was a second reboot the morning of the outage (no updates though - just part of a weekend backup I had going). I was still scanning all day prior to the outage (and after the two reboots and one update). So I've ruled out the update as a problem.

I'm contemplating using my backup from the day of the power failure (about 14 hours prior to the failure) and restoring the server - but I'd like to avoid that if possible as there were a lot of data changes during the day after the backup completed and I'm worried I'll miss something - I'm still hopeful I'll find the problem to be a setting/service somewhere that is off.

I've confirmed the following services are running on the server:
Computer Browser
Network Connections
Network Location Awareness
Remote Procedure Call
Server

I'm not sure it matters, but the "Remote Procedure Call Locator" service is NOT running - not sure if this matters, but I may start it just to see.

[Vulkor]

Well it can't hurt to start it. Also did your routers/switches lose power? You may need to reload firmware on them. They could have their DNS or Port Forwarding and Firewall settings reset to Factory. Are these basic home router/switches or your programmable managed types. Counts have some issues there as well.

[KenB]

Maybe a Master Browser Election issue?

I don't remember the command to force one, but it couldn't hurt.

[Vulkor]

Maybe a Master Browser Election issue?

I don't remember the command to force one, but it couldn't hurt.

Yeah rarely happens, but yeah. Wouldn't turning off all network stuff and then turning server on first fix that.

[Miescha]

Well it can't hurt to start it. Also did your routers/switches lose power? You may need to reload firmware on them. They could have their DNS or Port Forwarding and Firewall settings reset to Factory. Are these basic home router/switches or your programmable managed types. Counts have some issues there as well.

Sadly, I did not think of the switches until I had been trouble-shooting for several days. What I did to rule out the switches (which are business-class managed switches) was to move the server and scanners to a simple non-managed switch I had available - no change. I also took the sonicwall firewall out of the setup - no change. In a final moment of desperation, I rolled one of the 2075 machines to the server room door and connected to the server with a cross-over cable - also no change. I figured this pretty much ruled out any possible issues with in-wall wiring, switches, router, etc. . . so I went back to trouble shooting the server and scanners. And I really think it is a server issue as ALL the scanners have the same issue (but they are also all made by Ricoh/Lanier so maybe they all just reset or lost settings in the same manner).

I've tried so many things in the past two weeks that I can't remember all of them. But I'll post a list of the event errors found on the server in hopes that might help.

[Vulkor]

Definitely Sounds like Server. Very unlikely that all Machines just quit functioning.

[Miescha]

I don't know if any of the errors I've found will ring a bell for anyone on the forum, but it can't hurt.

The following services are running (though some are set for manual start rather than auto). All have been stopped and restarted numerous times. DNS has also been restarted numerous times. No updates within two days prior to this problem which showed up after power failure, and no problems after the last windows update patch. No updates since power failure.

Server
Computer Browser
Network Connections
Network Location Awareness
Remote Procedure Call (Remote Procedure Call is running, but NOT the RPC Locator service - not sure if this is important, I'll have to do some more research/reading.

I've also poured over the event logs, there are several errors immediately after the power failure, but most relate to scheduled tasks that could not run. I'm still chasing down the following errors:
3013 - Windows Search Service
19011 - MSSQL&BKUPEXEC
53258 - MSDTC

2505 Duplicate name on network. This is still a prime suspect for me, but I can't duplicate the error and there is simply no other computer on the network with the same name as the server. Our domain is 'office' and the DC is 'officeserver' and all clients are 'office##' where the ## is a two-digit number. This error reappeared six (6) days later, then again eight (8) days later, but has not reappeared.

40960 - LsaSrv "No Logon Server Available" - This was coupled with the 2505 above.

4321 - NetBT "The name 'OfficeServer :0' could not be registered on the Interface with IP address 192.168.1.10. The machine with the IP address 192.168.1.124 did not allow the name to be claimed by this machine." .10 is the 'officeserver' DC and .24 is a fixed IP printer (not scanner though) on the domain. Again, I initially thought this was simply the network not coming up fast enough. However, this error occured again several days later, but with a different IP address (another printer - but non-scanner) as the blocking IP.

7000 - Network load balancing failed to start

1126 - NTDS General: Active Directory was unable to establish a connection with the global catalog. Error value: 1355 The specified domain either does not exist or could not be contacted. Internal ID: 3200cf3. Again, this seems a likely cause of my authentication errors, but I cannot duplicate the problem (though it has occurred twice more since the power failure), and never previously. Oddly, the client PCs can all reach the network, and if AD on the DC was not functioning, I would think the clients would also fail to connect for lack of user authentication (we rarely give rights to the 'everyone' group in lieu of 'authenticated users').

4015 - DNS server has encountered a critical error from the AD. This did not occur on startup after power failure, but six (6) days later, then eight (8) days later and not again. See the pattern emerging with error 2505 above????

4004 - DNS server was unable to complete directory service enumeration of the zone (always coupled with 4015 error).

I appreciate any help.

[Vulkor]

Sure sounds like you have someone renaming the PC to the same name as another PC on the network. DNS issues are never fun. I doubt you are using Network Load Balancing Anyways. How many Network cables plugged into Server? If not using it turn it off under the NIC properties.

and Error 40960 can mean bad issues with passwords.

"sasrv.dll is an important security DLL which decrypts all local password hashing schemes on the computer.


Recommendation

lsasrv.dll should not be disabled, required for essential applications to work properly."

The Duplicate Names on the network however wouldn't effect you using JUST a Crossover as you mentioned above so ignore that for the moment.

[Vulkor]

Kinda wondering about DNS and Error 2505 Duplicate Name. Ever think your DNS is resolving names incorrectly and freaking out. Read Event ID 4004

I am betting DNS Service. The Desktops are Running DNS fine right?, but the server DNS is popping errors.

[Miescha]

Only one cable plugged into server, using the integrated NIC. The second 'backup' NIC is a PCI gigabit NIC card and is currently disabled and has no cable connected. Though perhaps I should get it connected and working for better performance, but that will be long after the current problem is resolved.

[Miescha]

SOLVED: Ricoh 2075 SMB Auth failures after extended power outage?

Really old thread I know, but someone just sent me a PM asking about whether I ever resolved and I realized that I never posted the resolution.

So, in the odd chance that anyone else runs into this problem in the future, and finds this thread, here is the final resolution. . . .

The problem was in fact the 2505 Error "duplicate name on network."

When the power came back on, one of the printers on the network (a rarely used Ricoh 1515) powered up and somehow took the IP address of the server - since the printer booted much faster than the server, it got the IP and the server got the duplicate name error 2505. I had checked and re-checked all the clients and server for duplicate names/IP address with no luck, but I never thought to check the printers (I know, I Know).

I never figured out how all the clients were printing through the server (print server) and how the 2075 could see the network but not the server, b/c once I found the rogue printer with the wrong IP address, I turned off the printer and rebooted the server to test and it worked first try - no 2505 duplicate name error and the 2075 could see the server and authenticate for scanning.

I changed the IP address on the rogue 1515 and called it a day!

Hope this helps someone else