Trouble with DNS/NetBIOS name resolution over VPN

Question

I’ve got one for the DNS/WINS gurus out there who are also familiar with VPN connections.
We have a VPN setup on our Mikrotik RouterBoard 532 for a number of employees running Windows 7 Pro laptops. Unfortunately the Mikrotik is maintained by our ISP so I don’t have access to it, but I can call them to make changes. Anyhow, I do not believe it
is a problem with the Mikrotik.
The problem is with resolving NetBIOS names (UNC paths, drive letters, etc…) over the VPN from remote locations, and ONLY with laptops joined to our
abc.local domain. If I use my home PC or disjoin the domain laptop from the
abc.local domain and return it to WORKGROUP, keeping the same Windows VPN client settings, I am able to resolve paths just fine.
For example, when I type \\server1 from Start>Run, it fails and tells me “server1 is not accessible. You might not have permission to use this network resource.” Using the FQDN is no problem at all, which makes me believe the problem is with NetBIOS resolution
and takes me to the WINS servers on the network.
The VPN hands out primary and secondary WINS servers, and they appear to be configured correctly in our Server 2003/2008/2012 environment. When I run
nbtstat –A IPAddressOfLaptop from a WINS server it resolves the laptop, and the same command from the laptop looking to the server resolves OK too.
What’s strange is that when I ping “server1” I get a valid response from server1.abc.local, as expected, but for some reason I still can’t browse to it from start>Run… “\\server1”.
The DNS suffix abc.local is in the “DNS suffix or this connection” field in the properties of the VPN client since the Mikrotik VPN is unable to deal this to clients.
I have ruled out Group Policy as the culprit because even after removing any group policy from applying to one of the laptops the result was the same.
I’ve used every resource and tool that I could to try and find where the problem lies and can’t seem to solve it. Everything looks properly configured.
I would greatly appreciate some assistance!

Answer 1

When you run an ipconfig /all, do you see the WINS server addresses being provided? How about the connection specific suffix for the domain, domain.local (or whatever it is called)?
I assume that you are using the Microtik as the VPN server and you are not using AD accounts for authentication. I would highly suggest to do that, otherwise, there will be a mismatch.
What VPN client is being used?
What is offering DHCP, a Windows Server or the Microtik?
FYI, using NetBIOS connection method, such as \\server1, will use the current logged on account for authentication. If the VPN credentials are not AD credentials, but the VPN client is setting the logged on credentials account
(some of them do that), then it will cause issues.
From what I see that NetBIOS is not being blocked, so that doesn't appear to be an issue, but it's coming down to credentials. Maybe in the mapped drive you can preset the credentials, and might be one way around it.
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/
This post is provided AS-IS with no warranties or guarantees and confers no rights.