PCs dropping off NT network -HELP!

Since we don't really have much info about the NT4.0 network config, the first thing you or your admin might check is the lease expiration setting in your DHCP server. This could cause the behavior your are seeing on your workstations. Netx time is happens trying issuing theis command from a DOS prompt
ipconfig /release
ipconfig /renew
good luck

Check that the Win9x client PCs have Browsing Disabled - Control Panel -> Network Properties -> File and Print Sharing for Microsoft Networks -> Browse Master = Disabled. Make sure that the Workgroup name for the Win9x clients is the same as your NT Domain name. Remove all network protocols except TCP/IP unless you really need them.

I had the same problem, and in my case it was the network cards. In one of the computers, the NIC was blown. In the other, the drivers needed updating. What NICs are you using? It is the same problem as mine if you are using 3 COM cards (3c905b-TX or 3c905c)

Thanks.

1. Follow the instuctions for answer 2.

2. Make sure logon hours in user manager are set correctly for each user account on the domain.

3. Try removing the Netbois protocol and reinstalling it.

4. Apply service pack 6a to you server.

Hope this helps.

If you are using auto detect for frame type turning off auto detect and manually setting it to the correct frame type. I had this problem once before too. and once I manully configred the setting instead of using the auto detect for frame type and speed eveything was fine. Not sure which one fixed it. But problem went away and haven't seen it back since.

Right away we know that you are not loosing your IP by being able to ping other machines. Not being able to browse by netbios names tells you that the wins resolution is not taking place. Try enabling Netbuei on a couple of the machines, when these computers seem to drop of the network try browesing the other PC's with netbuei enabled,if you can you know right away it is a server based problem and not hardware. The first thing that came to my mind was a licensing issue,if you have more PC's than licenses its a first come first serve basis, meaning if you had two more PC's than lic's you would always have two compters appearing to have problems. Good Luck.

Point value changed by question poster.

CHECK THE CABLING, NOT JUST THE PATCH CABLE , BUT ALSO THE IN THE WALL OVER THE CEILING. I WOULD REPUNCH THEM DOWN. I WOULD ALSO MAKE SURE THEY ARE 568B. A DIRTY/CORODED END MAY CAUSE A SIMILAR ACTIONS. BE SURE THE CABLES ARE SECURE. YOU MIGHT ALSO WANT TO SWITCH PORTS ON THE HUB/SWITCH THE WORKSTATIONS ARE PLUGGED IN TO.

GOOD LUCK

what other software do have running along with the server..?

I have closed all processes on the clients except for systray and explorer.

Microsoft Security Bulletin (MS01-003)
Patch Available for "Winsock Mutex" Vulnerability

Originally posted: January 24, 2001

Summary
Microsoft has released a patch that eliminates a security vulnerability in Microsoft? Windows NT 4.0. The vulnerability could allow a malicious user to run a special program to disable an affected computer?s network functionality.
Frequently asked questions regarding this vulnerability and the patch can be found at http://www.microsoft.com/technet/security/bulletin/fq01-003.asp

Issue
Like all other objects under Windows NT 4.0, mutexes ? synchronization objects that govern access to resources ? have permissions associated with them, that govern how they can be accessed. However, a particular mutex used to govern access to a networking resource has inappropriately loose permissions. This could enable an attacker who had the ability to run code on a local machine to monopolize the mutex, thereby preventing any other processes from using the resource that it controlled. This would have the effect of preventing the machine from participating in the network.
The attacker would require interactive logon access to the affected machine. This significantly limits the scope of the vulnerability because, if normal security recommendations have been followed, unprivileged users will not be granted interactive logon rights to critical machines like servers. Unprivileged users typically are granted interactive logon rights to workstations and terminal servers. However, a workstation would not be a tempting target for an attacker, because he could only use this vulnerability to deny service to himself. The machines most likely to be affected would be terminal servers.

Thought you might be interested

I am not even sure that NBTStat is available in win9x, but if so the following are articles on MSKB that discuss using NBTStat with respect to name resolution.

Q119493
Q163409 List of NetBios suffixes
Q119495 Lists of Names registered with Wins Service
Q188598 Renewing Wins registration with NBTSTAT ?RR

You should be able to compare the name caches between these machines and the machines that work. If nothing else, these articles are some interesting reading.

Your problem might be better descibed as an anomaly versus a failure so it leads us to the architecture discussion of "what is going wrong".
In review of the facts we must remind ourselves what components are in question. The Windows 95/98 environment is not network aware. They can be made to be used on the network only with the addition of device drivers that were supplied by the network card manufacturer that not only enabled the physical device but also defined and modified the interface drivers for your network stack.
Since Netbios and TCP/IP do not run at the same network layer (there are seven and it may be worth researching this topic) it is easily possible that the combination of
motherboard/NIC/sowftare drivers are failing toperform at the higher level of Netbios and still function for TCP/IP. There is along list of actions that you can take here and you may spend more time debugging those machines than simply replacing or upgrading to network enabled Operating Systems (ie Windows 2000,Linux,UNIX,etc) that typically do not have these issues.
If you are game:
1. Check the NIC manufacturer for driver updates (if the NIC is embedded check with the motherboard manufacturer)
2. Check the BIOS revision level of your motherboard. Most systems support some method of Flash BIOS update.
3. Bring in an outside Networking Consulting company
4. Reapply any service packages that you have on these machines
5. Give up this "mad quest" to drag "ancient technology" into a latest technology demanding market place. ie upgrade to Windows 2K
Good Luck

Hi, you might check to see if NT 4 server created a computer account for the computers that are disappearing. I had two machines that I had to replace network cards in, after the new cards were installed and seemingly operating correctly, they couldn't log in or actually access any resources. I deleted the corrupted computer account for each machine, then had the workstations log back in. That corrected the problem. Also, your might try stripping the microsoft client, adapter and tcp-ip andreinstall. If you have all ready done that, try adding the microsoft client for netware. that sounds crazy, but it has worked for me at times. you can remove IPX-SPX later, if it works for you

This question was closed by the author