Consequences of disabling NetBIOS over TCP/IP in a Windows Server 2008 environment

Is NetBIOS required in a network with 2008 Servers and Windows 7 and Windows 8 computers? 
There are two 2003 and one 2000 server. 
What functionality would we loose? 
What are the major server functions or major applications that use NetBIOS. 
Is there any way to find if any application or server is relying on NetBIOS. 
Any help is much appreciated. 

Generally it is the browser service that populates network neighborhood. This technology is no longer used with newer OS like server 2008, windows 7/8.
Description of the Microsoft Computer Browser Service
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows]
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Similar Messages

  • Curious NetBios over TCP/IP issues and Windows SMB shares

    Hi all.
    I've got two Win 2003 R2 SP2 member servers on our AD domain. Each has shared network folders on them which are accessed by both Windows and Mac users.
    Both servers - lets call them ALPHA and BETA - are identically setup: same hardware, configuration etc. but exist on different subnets.
    Alpha has never had a problem with Mac clients connecting to any of its shares.
    Beta has, up until recently, only ever had Windows clients, but now has a couple of Snow Leopard Mac clients. When a Mac client attempts to connect via SMB or CIFS to any share on Beta - they get the prompt to authenticate and then "Connection Failed. There was an error connecting to the server Beta. Check the server name or IP address and then try again". Of course the same thing happens when I try to connect by IP.
    Curiously, the only way I can get Mac clients to connect to shares on Beta is to go into the network adapter settings on Beta, advanced, WINS and then disable NetBios over TCP/IP. Unfortunatley this breaks some unrelated stuff and I eventually have to go back in and set NetBios back to Default (enabled) and the whole thing screws up again in a few hours time again for my beloved Mac users.
    The other server Alpha never gives me any problem with Mac clients, and as I say, they are setup identically. I have been testing this with 10.6.3 clients, not sure if my 10.5 or 10.4 clients are affected.
    Can anyone offer some suggestions as to why my shares aren't accessible to my Mac clients on both servers?

    Generally it is the browser service that populates network neighborhood. This technology is no longer used with newer OS like server 2008, windows 7/8.
    Description of the Microsoft Computer Browser Service
    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows]
    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

  • Need solution for solving TIME_WAIT in TCP/IP ports in Windows Server 2008 Standard Service Pack 2

    In one of our windows machine( OS : Windows Server 2008 Standard (Service Pack 2)-32bit), we are facing TIME_WAIT in all the TCP/IP ports and it is not getting closed.
    On analyzing the issue, we found solution for this from the below link,
    https://support.microsoft.com/en-us/kb/2553549
    In this page, we are able to get the hotfix for Windows Server2008 R2 SP1 but i can't able to get for  Windows Server 2008 Standard SP2(32bit). If we try to apply the hotfix vailable for SP1, it is showing "The update does not apply to your System".
    Kindly provide us the solution for solving TIME_WAIT issue in the machine. 
    OS Details : Microsoft Windows Server 2008 Standard
    Version : 6.0.6002 SP2 Build 6002
    System Type : 32 bit(x86-based PC)
    Awaiting for the response.
    Thank you,
    Pushpalatha.A

    Download correct version from Microsoft Update Catalog. Run it with elevated rights.
    M.

  • How could I create a Compliance Settings that enforces NetBIOS over TCP/IP?

    Hello Everyone,
    I need to be able to enforce NetBIOS over TCP/IP on some collections. I've created a batch script  with one line that disable NetBIOS over TCP/IP but I also need to make sure this is enforced. How could I do the enforcement using Compliance Settings?
    This is the line I use to disable it;
    "wmic nicconfig where (TcpipNetbiosOptions!=Null and TcpipNetbiosOptions!=2) call SetTcpipNetbios 2"
    Thank you everyone in advance for any help

    I could probably help you with a CI for discovery and remediation, but I need (or you need to define) an additional parameter.
    If I were to run this as a powershell discovery script:
    $adapter=(gwmi win32_networkadapterconfiguration | where {$_.ipenabled -eq "1"})
    Foreach ($nic in $adapter) {
    write-host $nic.TcpIPNetBiosOptions
    what's echo'd out (in my testing) is a 0, a 1 , or a 2.
    0 means "default--use what your dhcp is offering"
    1 = enabled
    2 = disabled.
    So... from your standpoint... is a 0 or 1, (either one) acceptable?  or is only a value of 1, a hard-coded at the client (not whatever the default is from dhcp) the only acceptable value?
    fyi, the remediation script, if 1 is the only acceptable answer, would probably be this:
    $adapter=(gwmi win32_networkadapterconfiguration | where {$_.ipenabled -eq "1"})
    Foreach ($nic in $adapter) {
    $adapter.settcpipnetbios(1)
    Standardize. Simplify. Automate.

  • Netbios over tcp/ip and over wlc-4402

    dear gentlemen,
    i have one wlc-4402 controller and some clients. how to configure the netbios over tcp/ip in the controller, so that the clients can assiciate the network.
    thank?s in advance
    michael

    Nothing, you dont have to configure anything regarding Netbios. Regards

  • Issue with disabling teredo with Windows Server 2008(non R2)

     Hello,
    I am not able to disable teredo on Windows Server 2008 (non R2) .When I try to run the same set of commands on Windows Server 2008 R2 it works fine.I have followed the instructions as in the below link
    http://technet.microsoft.com/en-us/library/cc770710(v=ws.10).aspx
    C:\Windows\system32>netsh interface teredo show state
    Teredo Parameters
    Type                    : client
    Server Name             : teredo.ipv6.microsoft.com.
    Client Refresh Interval : 30 seconds
    Client Port             : unspecified
    State                   : offline
    Error                   : client is in a managed network
    C:\Windows\system32>netsh interface teredo set state disabled
    Ok.
    C:\Windows\system32>netsh interface teredo show state
    Teredo Parameters
    Type                    : client
    Server Name             : teredo.ipv6.microsoft.com.
    Client Refresh Interval : 30 seconds
    Client Port             : unspecified
    I have also tried changing the below registry to disable teredo , that didnot work as well.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\DisabledComponents DWORD value set to 8.But the teredo status for the netsh command remains the same even after reboot.
    When I try to disable the 6to4 or isatap it works fine.I have checked in device manager ->network adapters with show hidden devices enabled, but I dont see teredo adapter even when teredo is enabled as per netsh.Also I dont see teredo adapter in add
    legacy hardware- > network adapters - > Microsoft devices , but I see isatap and 6to4 adapters in there.
    Can someone please help me..
    Thanks in Advance

    Hi,
    In device manager, add legacy hardware, install Teredo adapter, update the drivers. Reboot and check if you can modify the status.
    If this failed, reset tcp/ip stack.
    http://support.microsoft.com/kb/299357
    Hope this helps.

  • Unable to print to local Printer over RDP - Windows Server 2008

    Hi,
    Windows 2008 Foundation R2.
    Started to have issues with printing to a Local printer over RDP.
    The problems started on Friday 11th April. The only possible issue I can identify is that around that time LogMeIn was updated on the server, including the LMIPrinter DLL's.  I have contacted Logmein for instructions on how to uninstall LMI completely
    and followed these but am still experiencing the problem.
    When attempting a Test Page print the confirmation that the Test Print has been sent to is displayed and the print appears then disappears in the Print queue but nothing appears on the Local PC print queue or event logs.
    On the server the Event Log shows the following error;
    The document Test Page, owned by admin, failed to print on printer Canon MG7100 series Printer (redirected 2/copy 1). Try to print the document again, or restart the print spooler.
    Data type: RAW. Size of the spool file in bytes: 142691. Number of bytes printed: 0. Total number of pages in the document: 1. Number of pages printed: 0. Client computer: \\ONESTAGE-TS01. Win32 error code returned by the print processor: 2147500037. Unspecified
    error
    I have searched for possible solutions to RDP printing problems and where relevant implemented them but no change.
    I have access to a second customer who uses RDP and am able to log onto that and print to my local printer so am pretty sure there is nothing wrong with the local printer or settings.  On the Server with the problem the problem affects all RDP users
    and all printers (including Adobe PDF printer and MS XPS printer).  All printers are defaulting to the EasyPrint Drivers.
    Grasping at straws I think the LMI update has banjaxed something with the RDP remote printing and an LMI uninstall hasn't fixed it.  Is there a way to reinstall the RDP Printing?  Would uninstalling & reinstalling .NET have that effect?

    Hi,
    Thank you for posting in Windows Server Forum.
    What’s your client OS and RDP version in your environment?
    First of all suggest you to run “sfc /scanow” with this link to check whether which file causing the issue. Check the RDP version on the RDP client computer as well as the .NET framework version with respect to the operating system used (as explained above).
    Also verify that the RD Session Host / Terminal Server role is installed if the host computer is running Windows Server 2008 R2 or Windows Server 2008.
    The setting “Use Remote Desktop Easy Print printer driver first” must be set to “Enabled” for Easy Print redirection, and it has to be “Disabled” for Legacy Print. For “Not configured”, Easy Print is chosen by default.
    Check The Remote Desktop Configuration Tool (tsconfig.msc) settings to ensure that the “Windows Printer” option is not disabled (it is not disabled by default). 
    Make sure that the “Printers” check box in the client (mstsc.exe) window on the “Local Resources” tab is checked. The corresponding setting in the associated RDP file is “redirectprinters:i:1”.
    More information:
    Using Remote Desktop Easy Print in Windows 7 and Windows Server 2008 R2
    http://blogs.msdn.com/b/rds/archive/2009/09/28/using-remote-desktop-easy-print-in-windows-7-and-windows-server-2008-r2.aspx?Redirected=true
    Hope it helps!
    Thanks.
    Dharmesh Solanki

  • How Do i disable ""enable advance Printing features on windows server 2008 ""

    Hi ,
    I have a windows server 2008 which is used as  a terminal server . Users at remote locations log on to this server via "" DYNDNS"" to user our ERP and company files. We use ""DOT MATRIX PRINTERS "" to print  . As we all know that ""enable advance
    printing feature"" is checked by default on windows server 2008 the format of our ""DOT MATRIX PRINTOUTS "" CHANGE  which creates a big mess. 
    I would like to know if there is any way where i can disable this feature permanently. 

    In previous operating systems, that setting was for designed for  disabling and enabling GDI rendering on the server.  Since you are using a TYPE 4 print driver, there is no GDI rendering and thus this setting is not configurable. 
    If you would like to change this setting, you will need to use a TYPE 3 print driver that does not use XPS rendering.  Then the previous configuration methods you were using will work.
    Alan Morris Windows Printing Team

  • How to add a cloud machine as a node to existing windows fail over cluster having on-premise node in Windows server 2008 R2

    Hi All,
    We have a windows fail over cluster having one windows machine on local network as one of its node.
    I want to add a virtual cloud machine available on microsoft azure as another node to this existing cluster.
    Please suggest how to do this?
    Thanking all in advance,
    Raghvendra

    Before you even start working on the SQL side, you will need to create a Windows Server 2008 R2 cluster with no shared storage.  You can actually test that in-house.  Create a VM running 2008 R2 and cluster it with your physical (from your description,
    I am assuming physical) 2008 R2 machine. Create it with a file share witness for quorum. Then configure your environment to see that it works as expected.
    Once you know how to configure the cluster between physical and VM with a file share witness, build it to Azure.  The location of the FSW gets to be an interesting choice.  To have a FSW in Azure means that you will need another VM in Azure to
    host the file share, meaning you have two quorum votes in Azure and one in-house.  Or, you could create a file share witness on an in-house system, giving you two quorum votes in-house and one in Azure.
    In the FSW in Azure scenario, if you have a loss of the in-house server, automatic failover occurs because two quorum votes exist in Azure.  With FSW in-house, depending on the loss you have in-house, you might have to force quorum to get the Azure
    single-node cluster to run.  Loss of access to Azure reverses those scenarios.  Neither one is optimal, but it does provide some level of recoverability.
    . : | : . : | : . tim

  • Disable OCSP in Windows Server 2008 / IIS7

    Is it possible to disable OCSP Stapling on Windows Server 2008 / IIS7?
    The problem is that
    FF30 does not allow access to a secure site if the server supports OCSP Stapling and the user's computer time is in the past.  The error is sec_error_ocsp_future_response.  So users are not able to access our site simply because their time is incorrect! 
    If they don't report the error to us, we can't tell them what to do about it and we lose customers.  So we need to disable OCSP Stapling.
    I've tried these thing with no luck:
    add RequestOCSP of type DWORD and set it to
    0 to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\
    certutil –setreg chain\ChainCacheResyncFiletime @now
    certutil -urlcache ocsp delete
    OCSP Stapling is commonly disabled (for example,
    sites such as amazon and google disable it). Please let me know how to disable
    OCSP Stapling on IIS7.

    Hi, please check on iis.net's forum. You will have a bigger audiance than there. I unfortunaly cant move the thread there.
    Thanks you for your understanding
    Regards, Philippe
    Don't forget to mark as answer or vote as helpful to help identify good information. ( linkedin endorsement never hurt too :o) )
    Answer an interesting question ? Create a
    wiki article about it!

  • Windows Server 2008 R2 - Active Directory Replication over DynDNS

    Hello,
    I have one server that Windows Server 2008 R2 - Active Directory / DNS
    Now some users shifted to new office with the server
    Some users still in the original place that now don't have ADDS/DNS
    i want to install one replication server in the original place to retrieve AD/DNS form new office via DynDNS
    is that possible of not?
    Best regards,

    Badr, I don't think you want AD replication occurring over the internet - even if that was possible the server would need access to all the SRV records, a records, And all the ports required for communication - See here for an exhaustive list
    http://social.technet.microsoft.com/wiki/contents/articles/584.active-directory-replication-over-firewalls.aspx - I don't think I have to tell you how bad opening all these ports to the internet would be.
    You may want to look at Setting up a vpn or DirectAccess from the original site to the new site. This will give you more security and generally won't cost to much.
    http://technet.microsoft.com/en-us/network/dd420463.aspx
    Another thing that may work for you would be if you setup remote desktop services in the new location and had the original location remote into via a gateway server -
    http://blogs.technet.com/b/windowsserver/archive/2012/05/09/windows-server-2012-remote-desktop-services-rds.aspx as a starting point. With RDS your users would be able to access the new location from anywhere, although there would be upfront costs associated,
    licensing and server being part of them - I don't recommend turning your domain controller into an RDS server.These are just some ideas to help you with your issue

  • Configuring NetBIOS over TCP/IP

    How do I disable NetBIOS using netsh?
    Thank you,
    Alex

    I had issues trying to set an XP box with WMIC command-line utility as well.  If the box is Vista or 'better' you can use WMIC to do just about anything.
    Here's what I use - not much different than everyone else's suggestion:
    wmic nicconfig where (IPEnabled=TRUE) call SetTcpipNetbios 1
    wmic nicconfig where (IPEnabled=TRUE) call SetWINSServer "IP1","IP2"
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("IP1","IP2","IP3","IP4","IP5")
    wmic nicconfig where (IPEnabled=TRUE) call FlushDNS
    Obviously, I've sanitized our network settings from this.
    You can search through the settings for netsh on each level with the '/?'.
    Example:
    c:\Scripts>netsh /?
    Usage: netsh [-a AliasFile] [-c Context] [-r RemoteMachine] [-u [DomainName\]Use
    rName] [-p Password | *]
                 [Command | -f ScriptFile]
    The following commands are available:
    Commands in this context:
    ?              - Displays a list of commands.
    add            - Adds a configuration entry to a list of entries.
    advfirewall    - Changes to the `netsh advfirewall' context.
    branchcache    - Changes to the `netsh branchcache' context.
    bridge         - Changes to the `netsh bridge' context.
    delete         - Deletes a configuration entry from a list of entries.
    dhcpclient     - Changes to the `netsh dhcpclient' context.
    dump           - Displays a configuration script.
    exec           - Runs a script file.
    firewall       - Changes to the `netsh firewall' context.
    help           - Displays a list of commands.
    http           - Changes to the `netsh http' context.
    interface      - Changes to the `netsh interface' context.
    ipsec          - Changes to the `netsh ipsec' context.
    lan            - Changes to the `netsh lan' context.
    nap            - Changes to the `netsh nap' context.
    netio          - Changes to the `netsh netio' context.
    p2p            - Changes to the `netsh p2p' context.
    ras            - Changes to the `netsh ras' context.
    rpc            - Changes to the `netsh rpc' context.
    set            - Updates configuration settings.
    show           - Displays information.
    wcn            - Changes to the `netsh wcn' context.
    winhttp        - Changes to the `netsh winhttp' context.
    wins           - Changes to the `netsh wins' context.
    winsock        - Changes to the `netsh winsock' context.
    wlan           - Changes to the `netsh wlan' context.
    The following sub-contexts are available:
     advfirewall branchcache bridge dhcpclient firewall http interface ipsec lan nap
     netio p2p ras rpc wcn winhttp wins winsock wlan

  • Temporarily disable Digital Signature Checks to Install MS SQL Server 2008 with no Internet Access

    I am attempting to install a licensed copy of MS SQL Server 2008 in a Private Enclave that does NOT have Internet access on a Win2008 R2 SP1 server (that is VM - thus I can't reboot and press F8 to select "Disable Driver Signature Enforcement"
    ). The installation fails with an error of the vc_red.cab file being found either corrupt or a bad digital signature.  The file is good, but the signature has an expiration of 2011.   I understand that a DOTNET SDK v1.1 program called setreg.exe
    will enable disabling the digital signature check, but I am not permitted to use that program. 
    I might be permitted to use the "Signtool.exe" utility, but it is not clear what command sequences are necessary to disable and then re-enable the Digital Signature checks.
    I saw a thread that recommended using the command:
    bcdedit.exe /set nointegritychecks ON
    However, the comments indicated that this might not have worked.
    Are there Registry settings I can use with regedit to make the necessary changes to be able to install the application?  I anticipate running into this problem with other software when I do not have Internet connectivity.   I already tried
    downloading the Microsoft CRL files; updated the lists on the Server; and rebooted.  This did not solve my problem.  

    Hi,
    As far as I know, it is not recommended to disable digital signature check.
    Since we are not familair with installing MS SQL server, please also refer to SQL forums below to see if experts there have more insights regarding the matter.
    https://social.technet.microsoft.com/Forums/sqlserver/en-US/home
    Best Regards,
    Amy
    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • TCP/IP Connection Issue on Windows Server 2008 SP2

    Hi All,
        We got the following error with our monitor application. Monitor application tried to make a TCP/IP connection to another server, and runs out of all local ports.  We can not  close these connections without
    rebooting.  This will happen if the windows server didn't reboot in 500 days. (We tested in our data center by some servers. )
       Please explain why it is exact 500 days??? We are looking for a solution to fix it without reboot.
    Thank yoU!
    Bill
    TCP/IP failed to establish an outgoing connection because the selected local endpoint was recently used to connect to the same remote endpoint. This error typically occurs when outgoing connections are opened and closed at a high rate, causing all available
    local ports to be used and forcing TCP/IP to reuse a local port for an outgoing connection. To minimize the risk of data corruption, the TCP/IP standard requires a minimum time period to elapse between successive connections from a given local endpoint to
    a given remote endpoint.

    Hi Bill,
    Thank you for your post.
    The event 4227 means that the application open up more ports but not closing them in timely fashion.
    Windows 2008 default dynamic port range specify start port 49152 end port 65535. So you monitor it try to make connection via 65535 port.
    To resolve this issue, please restart your application service or set
    TcpTimedWaitDelay to a lower value via registry 
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters  
    If there are more inquiries on this issue, please feel free to let us know.
    Regards,
    Rick Tan

  • TMS 14.3.2 - No HTTPS Response from devices (again) - Looks like permissions issues (but possibly down to NetBIOS over TCP/IP)

    Hi All,
    Sometime ago I posted regarding an issue I was seeing on our TMS , where most of the remote devices seemingly showed up as loosing remote connection (no HTTPS Response - https://supportforums.cisco.com/discussion/12290956/tms-lost-https-communciation-devices-not-really). However, I could not figure out the root cause of the error, and now I have managed to break things again - probably due to a Java upgrade which broke TMSPE (see https://supportforums.cisco.com/discussion/12404166/looks-latest-update-java-8-update-31-will-break-tmspe-11).
    However, I thought I would look at little more closely this time to see if I could figure out the problem.
    I am seeing a lot of entries in the Security Log in TMS that seem to indicated that my the account used from a TMSPE connection has a bad or invalid password (this is set in "Administrative Tools --> Configuration --> Provisioning Extension Settings", but this password is correct (I can log into TMS with this account, and reset and restarted services etc).
    The computer attempted to validate the credentials for an account.
    Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
    Logon Account: tmspeconnect
    Source Workstation: TMS
    Error Code: 0xc0000064
    and
    An account failed to log on.
    Subject:
    Security ID: IIS APPPOOL\TMSNet40AppPool
    Account Name: TMSNet40AppPool
    Account Domain: IIS APPPOOL
    Logon ID: 0x214b6
    Logon Type: 8
    Account For Which Logon Failed:
    Security ID: NULL SID
    Account Name: tmspeconnect
    Account Domain: TMS
    Failure Information:
    Failure Reason: Unknown user name or bad password.
    Status: 0xc000006d
    Sub Status: 0xc0000064
    Process Information:
    Caller Process ID: 0x860
    Caller Process Name: C:\Windows\SysWOW64\inetsrv\w3wp.exe
    Network Information:
    Workstation Name: TMS
    Source Network Address: 127.0.0.1
    Source Port: 62114
    Detailed Authentication Information:
    Logon Process: Advapi
    Authentication Package: Negotiate
    Transited Services: -
    Package Name (NTLM only): -
    Key Length: 0
    This event is generated when a logon request fails. It is generated on the computer where access was attempted.
    The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
    The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
    The Process Information fields indicate which account and process on the system requested the logon.
    The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
    The authentication information fields provide detailed information about this specific logon request.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.
    - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
    I just wanted to check this like file/folder NTFS permissions, or any specific IIS permission . Is there a list of NTFS folder permissions for which the TMS required with regard to the "IIS APPPOOL", and perhaps what may need to be check in IIS?
    Oddly, the error list above refers the our "TMSPEConnect" account from the TMS domain, however this is incorrect - TMS is the machine name. Still we ARE seeing similar error which reference the actual domain name, such as:
    An account failed to log on.
    Subject:
    Security ID: IIS APPPOOL\TMSNet40AppPool
    Account Name: TMSNet40AppPool
    Account Domain: IIS APPPOOL
    Logon ID: 0x49e55
    Logon Type: 8
    Account For Which Logon Failed:
    Security ID: NULL SID
    Account Name: tmspeconnect
    Account Domain: mydomain
    Failure Information:
    Failure Reason: Unknown user name or bad password.
    Status: 0xc000006d
    Sub Status: 0xc000006a
    Process Information:
    Caller Process ID: 0xb18
    Caller Process Name: C:\Windows\SysWOW64\inetsrv\w3wp.exe
    Network Information:
    Workstation Name: TMS
    Source Network Address: 1.1.1.1 (changed external IP)
    Source Port: 47620
    Detailed Authentication Information:
    Logon Process: Advapi
    Authentication Package: Negotiate
    Transited Services: -
    Package Name (NTLM only): -
    Key Length: 0
    This event is generated when a logon request fails. It is generated on the computer where access was attempted.
    The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
    The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
    The Process Information fields indicate which account and process on the system requested the logon.
    The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
    The authentication information fields provide detailed information about this specific logon request.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.
    - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
    Idea welcome.
    Cheers
    Chris

    Hi all,
    After a long a fraught weekend trying to fix things, I am not that much further on, but I am beginning to understand what it isn't........ I think :(
    It looks as though the "DatabaseScanning" service, or anything that runs under the credentials of the "nt authority\network service" seems to have a problem.
    The Audit log show lot of entries where services such as"TMSWebPublic" running under the ISS Application pool "tmsnet40apppool", and actions launched under our own credential appear to communicate just fine with the device, only for the 'network service' to time out the connection a short while later. The same goes for some (not all) of the Phone book updates, which also looks as though it runs under the credentials of the 'Network Service' account.
    26/01/2015 08:30:54
    nt authority\network service
    Update
    System
    our-ctrl1
    System status
    NoResponse
    TMSDatabaseScannerService
    26/01/2015 08:30:54
    nt authority\network service
    Update
    System
    our-ctrl1
    Connection status
    NoHTTPSResponse
    TMSDatabaseScannerService
    26/01/2015 08:29:06
    tmsnet40apppool
    Update
    System
    our-ctr1l
    System status
    Idle
    TMSWebPublic
    26/01/2015 08:29:06
    tmsnet40apppool
    Update
    System
    our-ctrl1
    Connection status
    OK
    TMSWebPublic
    However, I still don't know at this point is this is related to the actual TMS front end, something to do with the domain and policies that have been applied to TMS, or the actual database, or even just communication with the back end database??? I did try running the services under a domain user (service) account, but then ran into other issues as I couldn't log into TMS.
    BTW, removing TMS, and IIS and reinstalling did fix my second issue relating to the 'Communication Errors'.
    Chris

Maybe you are looking for