SBS2008 and the mysterious DNS drops: Resolved

I finally managed to get onto the router... a Draytek Vigor 2900... I looked through all the settings and found nothing timing out.

Looking through the Ethernet log... I could see one PC calling up numerous destinations on the internet, TCP/UDP port 16650 and destination in the 50,000s... 57874.?

I found out the PC name on the network and connected via Explorer to the admin share to look at Program Files and see if there were any nefarious software installed... 

BitTorrent... oh dear... Dates of the files appear to match the times of the DNS dropping out.

I was called at the time, their DNS has been down for 2 hours whilst I was investigating.  So I blocked all traffic from that PC's IP address to the internet.  Immediately I could browse to www.google.com on the server.

My colleague gets a call from one member of staff... everyone's internet has come back except hers... he let her know we'd look into it...

So I blocked all traffic up from 1024 to 65535 from that IP address... at least she'll get mail, DNS, web surfing... but I think she might have a few more problems... downloading large files on company ISP.. killing an online application used by others that is the vital for the company... furthermore the size of the files over only 25 days could have had their ISP block all further traffic... Business Usage Policies n all that...

The router was still showing DNS calls to the internet... the Forwards were working.. but because of all the heavy torrent traffic, all DNS calls were timing out.  The DNS Forwarding has a timeout of 3 or 5 seconds.

BitTorrent is known to kill a connection when it's not been limited in the torrent app... 

So restarting the DNS Server on the SBS2008 box was simply killing the torrent connection and then it would all start going again .. and perhaps the only reason it's starting getting worse is because the user's PC was set to go directly via the router?  SBS2008 was limiting the Torrent connections.. once it was out of the picture the torrent was allowed to keep the connection killed and restarting the DNS Server no longer had a lasting effect.

Staff should be kept aware of the company's internet policy... and some should know better.

The answer is always so simple in retrospect.

SBS2008 and the mysterious DNS drops

I've been asked to look into an install of SBS2008 which is occasionally failing to forward DNS requests from clients. Apparently there are two workarounds. 1) A registry change and 2) set up forwarders to DNS servers... My colleague couldn't remember the details...

Hmm.. Google: 945 results from EggHeadCafe alone for SBS2008 DNS. 118 in the past year. 22 in the past month. None in the last week... so it's a dying topic...?

Is XP losing its binding to the DNS Servers in DNS? Is SBS2008 failing to forward the request? There are some Mac OSX... is Mac OSX losing its binding to DNS?

Restarting DNS solves it... so DHCP is not a problem and the problem can't be on the client-side because restarting DNS on the server wouldn't fix it. All clients are affected.

Event Log... DNS.. the Event ID sequence 3,2,4 (DNS Shutdown/Start/Ready) have occurred frequently over the last few days, and every 2 or 3 days for at least a month back... That has to be a manual action, doesn't it?

Apparently a user is restarting the DNS service... and has been for some time... I've gone through the log and noted into Excel the date and time when the user has restarted the DNS Service... then convert that into a simple dot chart...

The clumping is occurring with 2 day intervals between the events... except the last clump which is occurring more frequently because of a 'fix' put in place specifically to correct this... it's a weird clumping... 2 days later the users experience the same fault but about 30 mins later in the day.  It recurs 2 days and 30 minutes after restarting DNS?  That would equate roughly to a TTL, somewhere, of 2900 (rather than 2880)...?

These events occur between 09:30 and 20:10 purely because no-one is around to restart the DNS outside of those times.

FRS (File Repl. Svc) reported space issues (almost daily) on C drive between 23rd Oct and 1st Nov... but there are about 30gb free on C drive now... Shadow Copies is using its maximum of 10gb...
(Note if space is an issue then DNS might be prevented from working properly...)


Event Source: NETLOGON      ID: 5781
Description:
Dynamic registration or deletion of one or more DNS records associated with DNS domain 'DomainDnsZones.mydomain.local.' failed.


Possible causes of failure include:  
- TCP/IP properties of network connections contain wrong IP addresses of the preferred and alternate DNS servers 
- Specified preferred and alternate DNS servers are not running 
- DNS server(s) primary for the records to be registered is not running 
- Preferred or alternate DNS servers are configured with wrong root hints 
- Parent DNS zone contains incorrect delegation to the child zone authoritative for the DNS records that failed registration  


There's one of these for each DnsZone... and these appear when the DNS service starts up on the SBS2008 server.  But they occur when the service starts so they are related but not a cause.  They occur simply because the NETLOGON service doesn't receive a 'Success' signal back from the DNS Server that owns the zones of the records that are being registered.  The zones in question are owned by this server?  So this server is not responding to itself?

I've just discovered a utility called DNSLint.exe from Microsoft via (I won't repeat it here):
http://www.computerperformance.co.uk/w2k3/services/DNS_dnslint.htm

Hmm.. DNSLint on 2008?  I have no DVD to hand...  DNS Tools:
http://technet.microsoft.com/en-us/library/dd197560(WS.10).aspx

ok.. back to error 5781 - it appears that this only occurs when the DNS service starts because the server's DNS on its own network connection is pointing towards itself... and since the DNS service hasn't yet begun, it can't register on that server... so I'm going to ignore that ... you can make the NetLogon service depend on the DNS service... http://support.microsoft.com/kb/259277 but it'll try and re-register 5 minutes later anyway.

After some searching around I've found a couple of root-server addresses in Root Hints that are using IP addresses for l.root-server.net. from 2 years ago... maybe the tech at Microsoft who put SBS 2008 together didn't know?  Resolve all the Root servers to check...

Also I switched off DNS from listening on IPv6 interfaces for DNS requests... nothing IPv6 on the network... if so I'll find out tomorrow.

I also found a registry entry in HKLM\Systems\CurrentControlSet\Services\DNS\Parameters... called MaxCacheTtl... the MS KB (http://support.microsoft.com/kb/968372) says it's MaxCacheTTL ... does it make a difference?  I could get ProcessSpy running to see if DNS Server on SBS2008 is making calls for MaxCacheTTL or Ttl... it's set to 172800 seconds = 2880 minutes... which is the timeout value I questionned earlier... (2900 minutes = 2 days and 20 minutes) ... what about the 20mins?  It's 2 days and 20 mins between restarts of DNS... so that's 2 days for the TTL and 20 minutes for the users to realise something is wrong and restart DNS again...

Is this TTL value killing the DNS?  Can it?  We'll find out tomorrow... or in 2 days time...  Then we'll find out if it's a problem with AVG or not.. :)  or perhaps it's the router...

Exchange 2007 SP2 on SBS 2008: OWA not working again after today's Rollup 4...

Damn... now OWA has been broken again by a reapplication of the same Rollup 4 that broke the system last time...

Different problem... it's connected the Exchange virtual folder to \\.\BackofficeStorage\domain.local\MBX ... not sure that is correct...

But I can get into OWA via the Remote ... the OWA virtual folder is ok.

I will have to rebuild them yet again.... cheers Microsoft Exchange Team for thoroughly testing your patches yet again..

Exchange 2007 SP2 on SBS 2008: OWA not working after Update Rollup 4

The server is running SBS 2008 and Exchange 2007.

This morning SP2 was applied followed by Update Rollup 4 for Exchange 2007 SP2 (kb981383).  I was called because OWA stopped working and Entourage clients could no longer connect...

After comparing with another pre-SP2 server, I discovered that in IIS Manager, Default Web Site was running but the site, SBS 2008 Web Applications, was not running.  The former has WSUS and Sharepoint components, the latter has Remote, OWA, OMA, OAB, Autodiscover etc.  Autodiscover is required by Entourage clients.

The reason SBS 2008 Web Applications was not starting was because https on 443 had been enabled for Default Web Site by either SP2 or the Update Rollup 4.  Presumably these updates haven't been tested thoroughly enough on SBS...?  Initially I stopped Default Web Site and the SBS site started... and everything was back to normal.  The server at another client that I compared with did not have a binding on Default Web Site for https (no domain) on port 443.  So I removed that and Default Web Site started up...

Thinking that was enough, I was then told that OWA, Entourage, etc no longer worked again.  After removing https from Default Web Site.  I could not access webmail externally nor internally.  Entourage clients were no long connected to Exchange...

It appears that removing https from Default Web Site also removed the SSL self-signed certificate from https bound to SBS 2008 Web Applications - crazy ... So after editing bindings for the SBS site, edit the https 443 binding... add a certificate back... everything got working again.

My guess is that SP2 or the Update Rollup 4 forgets that SBS has its own default web site... and applies https to Default Web Site... and for a quicker fix...

1. Open IIS manager
2. Open Web Sites
3. Right click SBS 2008 Web Applications and select Edit Bindings 
4. Select https .... 443 and click Edit
5. Make a note of the SSL certificate being used - click Close/OK
6. Right click Default Web Site and select Edit Bindings
7. Select https .... 443 and click Edit
8. Make a note of the SSL certificate being used - click Close/OK
9. Delete https 443 in the Default Web Site bindings..
10. Right click SBS 2008 Web Applications and select Edit Bindings
11. Select https ... 443 and click Edit
12. Make sure that the SSL certificate you noted down is selected... click ok close
13. Start up whichever Web Site is stopped... all done ... if not restart IIS...

For once .. AVG is not involved... :)