TCP/IP NetBios Helper Service required for server on DNS-only domain

  • Thread starter Thread starter randy benson
  • Start date Start date
R

randy benson

I've been lurking here for weeks searching for the reasons for a strange set
of symptoms and event id 1000's
(without an accompanying 1001 or 1202) in the application event log of a W2K
server, and I've learned a lot from the posts I've read, but I haven't seen
this exact solution, except on eventid.net, under Event ID:1000 -

Source: Userenv
Type: Error
Description: Windows cannot access the registry information at
\\mydomain.com\sysvol\mydomain.com\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\Machine\registry.pol with (<error code>).

At the very bottom of the list of solutions for event 1000 'with 53', was
this post by Josh Tanski:

Setting the TCP/IP NetBIOS Helper Service to manual startup caused this and
related events for me, as it prevented me from accessing DFS shares. I set
the service back to automatic startup to solve the problem.

I thought I'd share the answer and ask a question.

My list of symptoms:

Domain controller checks out fine when Netdiag and DCdiag are run _from_
itself, but fails when run from problem server. Netdiag log says: 'Domain
Controller is down', but all other tests are o.k.
All member computers can browse both the DC and the problem server by FQDN
and by host name.
The problem server can ping the DC, and can even browse the DC, but only by
its ip address, not by FQDN or host name.
The event id 1000 in the problem server's event log had "...with 53",
meaning "network location cannot be reached".
Various other problems, all stemming from not being able to find the DC.

Results of ipconfig /all on problem server was (and is)

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : HobieWan
Primary DNS Suffix . . . . . . . : wrbenson.com
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : wrbenson.com

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : wrbenson.com
Description . . . . . . . . . . . : Intel 8255x-based PCI Ethernet
Adapter (10/100)
Physical Address. . . . . . . . . : xx-xx-xx-xx-xx-xx <---[
masked]
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 90.0.0.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 90.0.0.1
DHCP Server . . . . . . . . . . . : 90.0.0.2
DNS Servers . . . . . . . . . . . : 90.0.0.2
NetBIOS over Tcpip. . . . . . . . : Disabled
Lease Obtained. . . . . . . . . . : Thursday, March 04, 2004
10:36:36 AM
Lease Expires . . . . . . . . . . : Friday, March 12, 2004 10:36:36
AM

Cure:
Enable and set the TCP/IP NetBIOS Helper Service to 'automatic' -- (see KB
Article #329866).

Question:
Why is this service necessary to a server on a network where NetBIOS over
TCP/IP is disabled?

Thanks to all the go-to people here for graciously sharing their time and
expertise.
 
Interesting question. It's tied in with the DNS client side resolver. This
also holds true for the DHCP Client Service, which is required for DNS
resolution and DNS Dynamic registration, whether the machine is a DHCP
client or not. Read on...

"Network Location Cannot be Reached" Error Message When You Try to Join a
Domain":
http://support.microsoft.com/default.aspx?scid=kb;en-us;329866

Mpping with FQDN name fail with error 53 or 1231:
http://support.microsoft.com/default.aspx?scid=kb;en-us;817770

Disabling NETBIOS Over TCP/IP... Win2000 Domain...
http://www.serverexpert.com/viewtopic.php?p=2850

http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0080.html
http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0076.html


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
--
=================================



randy benson said:
I've been lurking here for weeks searching for the reasons for a strange set
of symptoms and event id 1000's
(without an accompanying 1001 or 1202) in the application event log of a W2K
server, and I've learned a lot from the posts I've read, but I haven't seen
this exact solution, except on eventid.net, under Event ID:1000 -

Source: Userenv
Type: Error
Description: Windows cannot access the registry information at
\\mydomain.com\sysvol\mydomain.com\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\Machine\registry.pol with (<error code>).

At the very bottom of the list of solutions for event 1000 'with 53', was
this post by Josh Tanski:

Setting the TCP/IP NetBIOS Helper Service to manual startup caused this and
related events for me, as it prevented me from accessing DFS shares. I set
the service back to automatic startup to solve the problem.

I thought I'd share the answer and ask a question.

My list of symptoms:

Domain controller checks out fine when Netdiag and DCdiag are run _from_
itself, but fails when run from problem server. Netdiag log says: 'Domain
Controller is down', but all other tests are o.k.
All member computers can browse both the DC and the problem server by FQDN
and by host name.
The problem server can ping the DC, and can even browse the DC, but only by
its ip address, not by FQDN or host name.
The event id 1000 in the problem server's event log had "...with 53",
meaning "network location cannot be reached".
Various other problems, all stemming from not being able to find the DC.

Results of ipconfig /all on problem server was (and is)

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : HobieWan
Primary DNS Suffix . . . . . . . : wrbenson.com
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : wrbenson.com

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : wrbenson.com
Description . . . . . . . . . . . : Intel 8255x-based PCI Ethernet
Adapter (10/100)
Physical Address. . . . . . . . . : xx-xx-xx-xx-xx-xx <---[
masked]
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 90.0.0.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 90.0.0.1
DHCP Server . . . . . . . . . . . : 90.0.0.2
DNS Servers . . . . . . . . . . . : 90.0.0.2
NetBIOS over Tcpip. . . . . . . . : Disabled
Lease Obtained. . . . . . . . . . : Thursday, March 04, 2004
10:36:36 AM
Lease Expires . . . . . . . . . . : Friday, March 12, 2004 10:36:36
AM

Cure:
Enable and set the TCP/IP NetBIOS Helper Service to 'automatic' -- (see KB
Article #329866).

Question:
Why is this service necessary to a server on a network where NetBIOS over
TCP/IP is disabled?

Thanks to all the go-to people here for graciously sharing their time and
expertise.
Click to expand...
 
AAAaaaahhhhh -- the last paragraph of 8717770 looms large!:

<clip>
"TCP/IP NetBIOS Helper" Service enables support for NetBIOS over TCP/IP
(NetBT) service and NetBIOS name resolution. This service is an extension of
the kernel mode NetBT.
It should be considered an integral part of NetBT, not a normal service. It
does two things for NetBT, which cannot be done in kernel mode:
a.. It performs DNS name resolution
b.. It pings a set of IP address and returns a list of reachable IP
addresses
If this service is disabled, NetBT's clients, including Redirector (RDR),
SRV, Netlogon, and Messenger, could stop responding.
<clip>

RDR, SRV and Netlogon! Who knew that they would depend on NetBT even in an
all-DNS scenario! Thanks much for the additional info -- it now makes a
sort of sense, anyway.

Ace Fekay said:
Interesting question. It's tied in with the DNS client side resolver. This
also holds true for the DHCP Client Service, which is required for DNS
resolution and DNS Dynamic registration, whether the machine is a DHCP
client or not. Read on...

"Network Location Cannot be Reached" Error Message When You Try to Join a
Domain":
http://support.microsoft.com/default.aspx?scid=kb;en-us;329866

Mpping with FQDN name fail with error 53 or 1231:
http://support.microsoft.com/default.aspx?scid=kb;en-us;817770

Disabling NETBIOS Over TCP/IP... Win2000 Domain...
http://www.serverexpert.com/viewtopic.php?p=2850

http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0080.html
http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0076.html


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
--
=================================



randy benson said:
I've been lurking here for weeks searching for the reasons for a strange set
of symptoms and event id 1000's
(without an accompanying 1001 or 1202) in the application event log of a W2K
server, and I've learned a lot from the posts I've read, but I haven't seen
this exact solution, except on eventid.net, under Event ID:1000 -

Source: Userenv
Type: Error
Description: Windows cannot access the registry information at
Click to expand...
\\mydomain.com\sysvol\mydomain.com\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\Machine\registry.pol with (<error code>).

At the very bottom of the list of solutions for event 1000 'with 53', was
this post by Josh Tanski:

Setting the TCP/IP NetBIOS Helper Service to manual startup caused this and
related events for me, as it prevented me from accessing DFS shares. I set
the service back to automatic startup to solve the problem.

I thought I'd share the answer and ask a question.

My list of symptoms:

Domain controller checks out fine when Netdiag and DCdiag are run _from_
itself, but fails when run from problem server. Netdiag log says: 'Domain
Controller is down', but all other tests are o.k.
All member computers can browse both the DC and the problem server by FQDN
and by host name.
The problem server can ping the DC, and can even browse the DC, but only by
its ip address, not by FQDN or host name.
The event id 1000 in the problem server's event log had "...with 53",
meaning "network location cannot be reached".
Various other problems, all stemming from not being able to find the DC.

Results of ipconfig /all on problem server was (and is)

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : HobieWan
Primary DNS Suffix . . . . . . . : wrbenson.com
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : wrbenson.com

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : wrbenson.com
Description . . . . . . . . . . . : Intel 8255x-based PCI Ethernet
Adapter (10/100)
Physical Address. . . . . . . . . : xx-xx-xx-xx-xx-xx <---[
masked]
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 90.0.0.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 90.0.0.1
DHCP Server . . . . . . . . . . . : 90.0.0.2
DNS Servers . . . . . . . . . . . : 90.0.0.2
NetBIOS over Tcpip. . . . . . . . : Disabled
Lease Obtained. . . . . . . . . . : Thursday, March 04, 2004
10:36:36 AM
Lease Expires . . . . . . . . . . : Friday, March 12, 2004 10:36:36
AM

Cure:
Enable and set the TCP/IP NetBIOS Helper Service to 'automatic' -- (see KB
Article #329866).

Question:
Why is this service necessary to a server on a network where NetBIOS over
TCP/IP is disabled?

Thanks to all the go-to people here for graciously sharing their time and
expertise.
Click to expand...
Click to expand...
 
In
randy benson said:
AAAaaaahhhhh -- the last paragraph of 8717770 looms large!:

<clip>
"TCP/IP NetBIOS Helper" Service enables support for NetBIOS over
TCP/IP (NetBT) service and NetBIOS name resolution. This service is
an extension of the kernel mode NetBT.
It should be considered an integral part of NetBT, not a normal
service. It does two things for NetBT, which cannot be done in kernel
mode: a.. It performs DNS name resolution
b.. It pings a set of IP address and returns a list of reachable IP
addresses
If this service is disabled, NetBT's clients, including Redirector
(RDR), SRV, Netlogon, and Messenger, could stop responding.
<clip>

RDR, SRV and Netlogon! Who knew that they would depend on NetBT even
in an all-DNS scenario! Thanks much for the additional info -- it
now makes a sort of sense, anyway.
Click to expand...


There you go!

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
Back
Top