|
|
|
Question : Why are Win 7 clients dropping connections, event 4634, laggy network, freezing clients
|
|
|
|
I have a customer who is having random network sharing issues. They will open a file on the network (2008 std) and it will sit about a minute or so before opening the file. All Win7, all fresh installs. Sometimes it's instant, sometimes they have to wait. Its every user. It seems to correlate with the security events (destroyed sessions type-3) so I have included that log to let you have a look.
Im wondering if it's a switch issue, because I haven't seen anything else that I know of that would cause this. Any help would be appreciated.
Last night I swapped switches and it worked perfect for over an hour. They came in today and had 2 users have the issue about 5 AM. Around 2 they had another user have the issue, but this time it froze excel, and then again at 5 a user had a word document open from the server and " Opened with an error message “ cannot be accessed. The file may be corrupted, located on a server that is not responding, or read only.” And offered me a Retry button or Cancel button. I hit retry, even though it was already open, and it kept popping up the same error message. I hit cancel and the error message disappeared and the file stayed open." -User
It is dropping sessions for some reason that I cant figure out. I have included a snippet of the 400,000 entries from the security log in a 24hr period. ANY help would be appreciated!
----------------------------
Audit Success 5/10/2010 4:44:57 PM Microsoft-Windows-Security-Auditing 4634 Logoff "An account was logged off.
Subject:
Security ID: TWIN\wsiegel
Account Name: wsiegel
Account Domain: TWIN
Logon ID: 0x579dd45
Logon Type: 3
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer."
Audit Success 5/10/2010 4:44:57 PM Microsoft-Windows-Security-Auditing 4624 Logon "An account was successfully logged on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
New Logon:
Security ID: TWIN\wsiegel
Account Name: wsiegel
Account Domain: TWIN
Logon ID: 0x579dd52
Logon GUID: {81A0200B-EB47-B5C4-1609-522D8F9720C0}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name:
Source Network Address: 192.168.5.112
Source Port: 49201
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested."
Audit Success 5/10/2010 4:44:57 PM Microsoft-Windows-Security-Auditing 4624 Logon "An account was successfully logged on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
New Logon:
Security ID: TWIN\wsiegel
Account Name: wsiegel
Account Domain: TWIN
Logon ID: 0x579dd45
Logon GUID: {81A0200B-EB47-B5C4-1609-522D8F9720C0}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name:
Source Network Address: 192.168.5.112
Source Port: 49200
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested."
Audit Success 5/10/2010 4:44:57 PM Microsoft-Windows-Security-Auditing 4624 Logon "An account was successfully logged on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
New Logon:
Security ID: TWIN\wsiegel
Account Name: wsiegel
Account Domain: TWIN
Logon ID: 0x579dd35
Logon GUID: {81A0200B-EB47-B5C4-1609-522D8F9720C0}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name:
Source Network Address: 192.168.5.112
Source Port: 49198
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested."
Audit Success 5/10/2010 4:44:57 PM Microsoft-Windows-Security-Auditing 4769 Kerberos Service Ticket Operations "A Kerberos service ticket was requested.
Account Information:
Account Name: [email protected]
Account Domain: TWIN.LOCAL
Logon GUID: {19157A5E-998A-7ABB-7076-240723D8ECDF}
Service Information:
Service Name: TWINDC$
Service ID: TWIN\TWINDC$
Network Information:
Client Address: ::ffff:192.168.5.112
Client Port: 49199
Additional Information:
Ticket Options: 0x40810000
Ticket Encryption Type: 0x12
Failure Code: 0x0
Transited Services: -
This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.
This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.
Ticket options, encryption types, and failure codes are defined in RFC 4120."
Audit Success 5/10/2010 4:44:57 PM Microsoft-Windows-Security-Auditing 4624 Logon "An account was successfully logged on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
New Logon:
Security ID: TWIN\wsiegel
Account Name: wsiegel
Account Domain: TWIN
Logon ID: 0x579dce3
Logon GUID: {2E0C65FC-A9D2-F398-4586-7EF942DBDC9F}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name:
Source Network Address: 192.168.5.112
Source Port: 49172
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested."
Audit Success 5/10/2010 4:44:57 PM Microsoft-Windows-Security-Auditing 4769 Kerberos Service Ticket Operations "A Kerberos service ticket was requested.
Account Information:
Account Name: [email protected]
Account Domain: TWIN.LOCAL
Logon GUID: {19157A5E-998A-7ABB-7076-240723D8ECDF}
Service Information:
Service Name: TWINDC$
Service ID: TWIN\TWINDC$
Network Information:
Client Address: ::ffff:192.168.5.112
Client Port: 49197
Additional Information:
Ticket Options: 0x40800000
Ticket Encryption Type: 0x12
Failure Code: 0x0
Transited Services: -
This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.
This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.
Ticket options, encryption types, and failure codes are defined in RFC 4120."
Audit Success 5/10/2010 4:44:57 PM Microsoft-Windows-Security-Auditing 4634 Logoff "An account was logged off.
Subject:
Security ID: SYSTEM
Account Name: TWINDC$
Account Domain: TWIN
Logon ID: 0x579dcc3
Logon Type: 3
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer."
Audit Success 5/10/2010 4:44:57 PM Microsoft-Windows-Security-Auditing 4624 Logon "An account was successfully logged on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
New Logon:
Security ID: SYSTEM
Account Name: TWINDC$
Account Domain: TWIN
Logon ID: 0x579dcc3
Logon GUID: {C987ED0B-EECD-EEB8-7DB2-4AEB7E0F3D17}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name:
Source Network Address: fe80::8de5:e439:1ad4:b665
Source Port: 61872
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested."
Audit Success 5/10/2010 4:44:57 PM Microsoft-Windows-Security-Auditing 4672 Special Logon "Special privileges assigned to new logon.
Subject:
Security ID: SYSTEM
Account Name: TWINDC$
Account Domain: TWIN
Logon ID: 0x579dcc3
Privileges: SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
SeEnableDelegationPrivilege"
|
|
|
|
Answer : Why are Win 7 clients dropping connections, event 4634, laggy network, freezing clients
|
|
I think I've found the cause - I disabled TCP offloading and RSS on the NIC - we will do some testing and I'll post the results.
|
|
|
|
|
