Dear all I have a customer who has a W8K SP1 x64 server, the server is running exchange 2007 and some folders are shared from the server. All users on the network have a mapped drive to this server and at least twice a day every user will experience a PC crash and when this server is restarted the problem is alleivated. I have taken a look at one of the clients and mapped drive is disconnected and when I try to naviagte to the path via unc I am un-sucessfull I have tried both hostname and ip address, the strange thing is that I can ping the server, I have restarted the clinet PC when the problem arises to no effect, I have taken a look at the application and system logs on the server and there is nothing critical that I can go by. I initially disabled the AV which was SEP and now I have uninstalled is just in case a low level file was causing an issue. The other strange thing is that the last time the issue took place I also connected to the DC which is a W3K server and I could connect to the server via unc \\server Can anyone offer any help / advise

Hello, personal i would not use an Exchange server also as file server for the users. In case you have to reboot Exchange also the files are not available and any changes are not saved or the complete document is destroyed. Better move the files to another member server. How exactly do you realize the "PC crash", this description is not helpful? As there are seems to be network related problems please post an unedited ipconfig /all from the Exchange server, the DC/DNS servers from the domain and a problem client, so we can verify some settings. Btw, why din't you install Windows server 2008 SP2? Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Hi mika, Thanks for posting here. When did the problem begin? Were there any recent hardware or software changes made? Are all clients and servers affected or only certain ones? Is the network share available when accessed via the command line as opposed to via mapped drive? Is the drive mapping done via login script or manually by the user? Please attempt to access the share by the following methods and record the results of each: <\\ServerFQDN\sharename> from the server console <\\ServerFQDN\sharename> from a network client <\\ServerNetBIOSname\sharename> from the server console <\\ServerNetBIOSname\sharename> from a network client <\\IPAddressofServer\sharename> from the server console <\\IPAddressofServer\sharename> from a network client By default, mapped drives are disconnected if inactive for a certain period. This is configurable via the server-side Autodisconnect and client side KeepConn registry values. See article 297684 for a description of Autodisconnect Mapped Drive Connection to Network Share May Be Lost http://support.microsoft.com/kb/297684 If the SMB session is inactive for 15 minutes the server will send a TCP reset to close the connection. Until the Autodisconnect timer is reached, the server will send an NBT keep-alive packet every two minutes. If a client or server application is not written to properly handle network delays, it may terminate the session prior to the default timeout period. Please also test in Safe Mode with Networking or booted with msconfig in diagnostic startup to isolate applications causing the disconnection. Thanks. Tiger Li TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

The problem appeared again twice today and I managed to check some of the events in the application log - login failed for user the user is not assoicated with a trusted SQL server connection (Event ID 18452) I will post the results of the ipconfig /all later today, however I was unable to unc onto the server from the DC...

ipconfig info: DC - Host Name . . . . . . . . . . . . : servername Primary Dns Suffix . . . . . . . : domainname.local Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : domainname.local Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : HP NC7781 Gigabit Server Adapter Physical Address. . . . . . . . . : 00-11-0A-A0-A0-06 DHCP Enabled. . . . . . . . . . . : No IP Address. . . . . . . . . . . . : 10.10.26.5 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 10.10.26.254 DNS Servers . . . . . . . . . . . : 10.10.26.5 10.10.26.3 Primary WINS Server . . . . . . . : 10.10.26.5 Secondary WINS Server . . . . . . : 10.10.26.3 PC with connection problem - Windows IP Configuration Host Name . . . . . . . . . . . . : pcname Primary Dns Suffix . . . . . . . : domainname.local Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : domainname.local ingimex.local Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : domainname.local Description . . . . . . . . . . . : Broadcom NetXtreme 57xx Gigabit Controller Physical Address. . . . . . . . . : 00-18-8B-8A-69-C3 Dhcp Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IP Address. . . . . . . . . . . . : 10.10.26.58 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 10.10.26.254 DHCP Server . . . . . . . . . . . : 10.10.26.5 DNS Servers . . . . . . . . . . . : 10.10.26.5 10.10.26.64 Primary WINS Server . . . . . . . : 10.10.26.5 Lease Obtained. . . . . . . . . . : 02 February 2011 06:50:44 Lease Expires . . . . . . . . . . : 06 February 2011 06:50:44 Exchange with problems - Windows IP Configuration Host Name . . . . . . . . . . . . : servername Primary Dns Suffix . . . . . . . : domainname.local Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : domainname.local Ethernet adapter Local Area Connection 3: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : HP Network Team #1 Physical Address. . . . . . . . . : 00-21-5A-5C-2B-46 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::d40:619e:383:5832%12(Preferred) IPv4 Address. . . . . . . . . . . : 10.10.26.64(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 10.10.26.254 DNS Servers . . . . . . . . . . . : 10.10.26.5 NetBIOS over Tcpip. . . . . . . . : Enabled Tunnel adapter Local Area Connection* 8: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : isatap.{FA4A6C1A-9C47-41C9-B1BC-CFB69A88E8EA} Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes

Hi mika, Thanks for posting here. Is this exchange server multihoming or have set NIC teaming? What’s the error prompt when attempted to access exchange server form other computers? Please post full error message ,especially error code. Which version SEP were installed on that server ? We have experienced that some particular version SEP could cause this issue : Unable to access Shares "The specified network name is no longer available" when Symantec Endpoint Protection prior to 11.0.4202 (MR4-MP2) or Symantec Antivirus 10.2 are installed on a Windows 2003, 2008 or 2008 R2 Server http://support.microsoft.com/kb/961293 You mentioned that you can ping these exchange server , have you tried ping hostname ,IP address or FQDN name ? and what the result . Before test , please set static ARP entry for this server on client side by perform the commands below first: ARP –d 10.10.26.64 ARP –s 10.10.26.64 00-21-5A-5C-2B-46 Meanwhile, is there any problem with accessing exchange server form itself ? Thanks. Tiger Li TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

The version of SEP that was installed was 11.0.304.2224 and yes I can access exchange from itself when the problem is present, I have only tested this once

Hello, why does the client use the Exchange server as DNS on the NIC? Use only the domain DNS servers instead. Also set the second DNS on the Exchange server NIC.Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Hi I took a look at the following artlicle http://support.microsoft.com/kb/961293 and the server was using SEP 11.0.3001 also installs teefer2 drivers on the NICs when I try to uninstall these nics they do not uninstall

Hi mika, Thanks for update. Please try the steps which included in the Symantec article below to manually remove Teefer driver and it also discussed how to manually remove SEP form 64bit windows host : How to manually uninstall the Symantec Endpoint Protection client from Windows Vista, Windows 7, and Windows 2008 R2 64-bit http://www.symantec.com/business/support/index?page=content&id=TECH91038&locale=en_US Remove the Teefer driver 1. Click Start > Search, type cmd, and press Ctrl+Shift+Enter to start a command prompt with Administrator privileges. 2. Type pnputil -e to list the Symantec drivers in the driver store. 3. Type pnputil -f -d oem<n>.inf to remove Symantec drivers from driver store, where <n> is a number corresponding to one of the Symantec drivers listed in the previous step. 4. Type exit to close the command prompt. 5. In the Windows registry editor, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}. 6. Delete any keys that have a value of ComponentId that is set to symc_teefer2mp. 7. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}. 8. Delete any sub keys that have a name containing SYMC_TEEFER2MP. 9. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{cac88424-7515-4c03-82e6-71a87abac361}. 10. Delete any sub keys that have a name containing SYMC_TEEFER2MP. 11. Close the Windows Registry Editor. 12. In the Device Manager (devmgmt.msc), go to Network Adapters, and delete all entries with "teefer" in them. 13. Delete any network adapters to which teefer was attached. This causes the adapters to be reinstalled. This step must be done in order for there to be network connectivity after you restart the computer. 14. Restart the computer into normal mode. Important Note: This response contains a reference to a third party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites; therefore, Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. There are inherent dangers in the use of any software found on the Internet, and Microsoft cautions you to make sure that you completely understand the risk before retrieving any software from the Internet. Thanks Tiger Li TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi mika, If there is any update on this issue, please feel free to let us know. We are looking forward to your reply. Tiger Li TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

I contacted symantec support and they talked me through removing the drivers via the registry, since then the problems with the network connections seem to be ok, hwoever the teefer2 devices are still visiable in the devices list and two windows services do not start com+ system application system event notification service

Hi mika, Thanks for update. Glad you make some progress! So have you tried manually removing this virtual device form device management console? Have you also tried setting startup type of these both services ? what if manually start it up? Thanks. Tiger Li TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.