Your Browser, and Your Voice Modem

Occasionally, we read odd queries in various forums

When I am browsing certain web sites, or running a specific program, my computer starts the modem and dials out. Does anybody know what is happening here?

And those of us who are used to this query reply simply

Go to Internet Properties - Connections tab, and make sure that "Never dial a connection" is selected.

Long ago, when the browser was the only Internet application on the computer that was used with any regularity, the Internet Protocol stack and the dialer were built in to the browser. Even after the IP stack became part of the operating system, Internet Explorer continued to provide the option to have it dial out, automatically, if it detected a lack of Internet connectivity being provided by the operating system and network stack.

Unfortunately, the mechanism for detecting lack of Internet connectivity, from time to time, seems capricious. The oddest circumstances may cause the browser to dial out, leading to some interesting phone bills for some computer owners.

If you have a computer with an internal modem, and you connect your analogue voice service (aka "telephone") to the modem, maybe as a backup to your broadband service, you may occasionally hear the computer chattering away, when you pick up an extension and prepare to dial out. Now, you know why.

You can still have dial capability, as a backup to your broadband service. Simply use the dialer in Settings - Network Connections when necessary, and make sure that the browser is set to "Never dial a connection". Or, if you're interested, you could get a router that uses dialup access as a secondary connection.

>> Top

Windows Vista And The Network Map

Most of us who have computers in our homes also have Internet service (what else is the computer for anyway?). Many of us who have computers have more than one computer, and some of us who have more than one computer need a network management product, like The Dude (what a name for something priced so nicely) to keep track of our computers.

Auto discovery, which automatically generates a graphical display and inventory of the computers on the network, is an expected feature in many network management products like The Dude. Now Auto Discovery is a built in feature of our favourite new operating system, Windows Vista. One of the shiniest features of Windows Vista is The Network Map - its ability to show you a semi graphical display of all of the computers, routers, and switches on the network.

The Network Map uses a new protocol - Link-Layer Topology Discovery (LLTD). Regardless of what firewalls, or other hardware or software protective devices we have on our network, LLTD discovers all devices connected. LLTD has basically the same strengths and weaknesses as other well known alternate protocols IPX/SPX and NetBEUI (neither of which are available for Vista).

• Regardless of what Windows Networking protocol you're using - IP, IPX/SPX, or NetBEUI, LLTD will show you a map of all computers running Windows Vista and Windows XP (when equipped).
• Regardless of what firewalls or routers you may have setup to segment your network, and protect some computers from others, LLTD will pass through to each segment, and will inventory all computers on the segment.
• Regardless of whether LLTD shows you a computer, you won't necessarily have the ability to access that computer, or even determine its network address, for Windows Networking.

The Network Map presents additional challenges.

• It is only available on Windows Vista (and Windows XP, with (KB922120): the optional LLTD Responder).
• Its availability, and the fact that "it simply works", can cause confusion among computer owners, who can't get Windows Networking to work, when a Windows Vista computer is installed.
• People confuse the Network Map with the "Network" wizard (previously known as Windows Explorer in Windows XP and previous Windows editions), which provides a similar functionality, but will display different information.

It's a great tool, but you need to be aware of its limitations.

>> Top

Windows Vista, And Administrative Shares

Under Windows XP and earlier versions of Windows, any administrator of a server could gain access to any portion of any drive on the server, through the network. Even if no share was defined, any drive was always available, in its entirety, to anybody with administrative access.

This ability was known as an administrative share. Besides any explicitly defined shares, every server would have a "C$" share (and a "D$", etc, for additional drives). The shares weren't browsable - they wouldn't show up in Network Neighbourhood, and a server with no explicitly defined shares would even show up, at all, under Windows XP. But anybody with administrative access could map a share to "C$" and have access to the entire C drive, instantly.

Windows Vista has removed the administrative share from the default server configuration. Fortunately for many, this ability can be restored, with a simple registry entry.

For registry key [HKLM\ Software\ Microsoft\ Windows\ CurrentVersion\ Policies\ system], add a DWord value LocalAccountTokenFilterPolicy of "1". Then restart the computer.

>> Top

The NT Browser and Windows Networking

To find the various computers on a LAN, from each other, you generally open Windows Explorer (don't confuse this with Internet Explorer, please), and look in My Network Places. On a fully working LAN, this will work just fine. It doesn't always work that way though.

The contents of My Network Places (Network Neighbourhood, in some cases) are provided by a subsystem known as the NT Browser. The browser depends upon Server Message Blocks, and anything that interferes with SMBs will cause browser problems, and consequent problems in Network Neighbourhood.

In most cases, browser problems are symptoms of more basic network issues. Computer A and B should be equally visible, and accessible, from each other.

In one common scenario, Computer A shows both Computers A and B, as it should, and files on Computer B are accessible. On Computer B, either you don't see Computer A, or when you try to access Computer A, you get an error. You may, or it may not, see Computer B from itself. This visibility problem may be observed constantly, or it may come and go.

• Since Computer B is accessible from Computer A, a permanent physical connectivity issue is unlikely, but still possible.
  
• Besides physical problems, browser problems can have several possible causes. Browser functionality depends upon several relationships:
  
  
  
  • The browser server (ie the browser), and this computer. If this computer can't access its designated browser server, it may lack browse information, and / or have outdated information.
    
  • The browser server, and the client server (ie any computer being enumerated by the browser). A server, remember, is any computer being displayed in Network Neighborhood. If the browser server can't contact a client server, or if the client server uses a different browser, that server may not appear in Network Neighborhood.
    
  • The browser server, and the master browser (if not the same computer). If a browser server can't contact the master browser, it won't get the browse list aggregated by the master browser. Any client computers that use that browser won't have the browse list aggregated by the master browser.
    
  • The master browser for this domain / workgroup, and master browsers for other domains / workgroups. Any master browsers that can't contact other master browsers won't be able to exchange browse lists with them, and their clients won't have the browse lists for the other domains / workgroups.
    
  
  
• Problems with any of the above relationships - now, or in the past - can cause various problems with Network Neighborhood. All computers won't try to access the browser simultaneously; if a browser problem just started, all computers won't reflect the problem immediately. If there is a problem, asymmetrical browse lists should be expected.
  

You will probably best address your problem by continuing with my troubleshooting guide, Irregularities In Workgroup Visibility.

>> Top

Advanced Windows Networking Using Internet Protocol

Windows Networking is the subsystem that lets you share files and printers, between computers running the various versions of Windows. Server Message Blocks, also called SMBs, are the foundation of Windows Networking. SMBs provide several crucial functions.

• Help the computers to share data.
• Let them know what data is available, to be shared.
• Possibly, help them to identify the addresses of the other computers, which have the shared data.

(Note): If you're not familiar with the concept of network layers, take a few moments and read about the OSI Network Model.

SMBs are not transported directly over the various physical networking components, as Layer 1 or 2 traffic. SMBs may be transported over Internet Protocol (IP), as well as alternate protocols like IPX/SPX or NetBEUI.

Windows Networking has historically used NetBIOS Over TCP/IP (NetBT) as an intermediate transport for SMBs over IP. Windows 2000, XP, and Vista however, will transport SMBs over IP, without NetBT, using directly hosted SMBs.

To remain compatible with the older versions of Windows, a Windows Networking client, running Windows 2000, Windows XP, or Windows Vista, can use either directly hosted SMBs, or it can use NetBT. If any server supports directly hosted SMBs, the client computer in question will bypass NetBT, when communicating with that specific server.

This dual compatibility, which allows Windows 2000 / XP / Vista clients to communicate with computers running other editions of Windows, is not without cost. Trying for two communications channels, when establishing a connection with any server, increases program complexity and network traffic. In some cases, it may increase latency.

We need to resolve one major misconception. It may appear that when you Disable NetBT, you are disabling Windows Networking over IP. This is not correct. When you Disable NetBT, you are merely disabling hosting of SMBs over NetBT. You then end up with SMBs hosted directly over IP. But look at address resolution on your LAN, before trying this. Don't make this change blindly.

If your LAN

• Has a domain.
• Has computers running only Windows 2000, Windows 2002 (aka Windows XP), Windows 2003 (aka Server 2003), Windows 2006 (aka Vista), and Windows 2009 (aka Windows 7).
• Uses DNS, properly setup, for name resolution.

then you may wish to Disable NetBT, and (KB204279): use directly hosted SMBs. If any of the above are not true, you should Enable NetBIOS Over TCP/IP. Be consistent on all computers.

In the TCP/IP Properties - Advanced wizard, WINS, select Disable NetBIOS Over TCP/IP. Alternately, if you have the Default NetBIOS setting selected (instead of "Disable" or "Enable") on your client computers, and you have a DHCP server (not a NAT router with DHCP), you can disable NetBT from a DHCP server setting.

If you use directly hosted SMBs, whether alternately or exclusively, be aware of the security implications.

• NetBT uses TCP and UDP ports 137 - 139.
• Direct hosted SMBs use TCP port 445.

Be sure that all personal firewalls have the proper ports opened.

Here are the relevant ports used by SMBs over NetBT, per IANA port number allocation:

netbios-ns 137/tcp NETBIOS Name Service
netbios-ns 137/udp NETBIOS Name Service
netbios-dgm 138/tcp NETBIOS Datagram Service
netbios-dgm 138/udp NETBIOS Datagram Service
netbios-ssn 139/tcp NETBIOS Session Service
netbios-ssn 139/udp NETBIOS Session Service

And the relevant ports used by directly hosted SMBs:

microsoft-ds 445/tcp Microsoft-DS
microsoft-ds 445/udp Microsoft-DS

Similar to the effect of a personal firewall, SMBs can be setup to use secure channel communication, by using SMB Authentication and Encryption. If you ever see

The account is not authorized to log in from this station.

then check SMB Encryption and Signing settings.

And, if you have an integrated security suite (previously sold as anti-virus protection), you may have an anti-worm component protecting you. Anti-worm protection, if not correctly configured, may interfere with any or all of the above NetBT traffic. Different brands of products will cause different problems.

For more information:

• General information about NetBT and SMBs: Microsoft: MS Windows NT Browser. Depending upon how your browser displays the page, you may want to use the link at the top of the page Microsoft TCP/IP and Name Resolution.
• Name Resolution: PChuck: Address Resolution on the LAN.
• NT Browser: PChuck: The NT Browser (or Why can't I always see all of the computers on the LAN?).

>> Top

Registry Settings Which Affect Access To Your Server

Windows NT based operating systems (NT, 2000, XP, Server 2003) use Access Control Lists (ACLs) to meter access to files and folders which are NTFS based. If your server uses NTFS (as most do), you should know how to create and modify ACLs, to allow or prevent access to specific files and folders.

Besides the NTFS ACLs, though, there are registry based settings that can affect the ability of your server to be seen, or accessed, by clients on the network. These settings work in addition to, or in spite of, the ACLs.

• The Hidden setting will explicitly instruct the browser to not enumerate your server.
  
• The restrictanonymous setting will affect the ability of your server to be enumerated by the browser, and the ability for it to be accessed by clients using the Guest account.
  
• The RestrictNullSessAccess setting will affect the ability of specific shares to be accessed by clients using the Guest account.
  

If you are experiencing problems with visibility of, or access to, your server, and more obvious settings or personal firewalls are not the problem, check these registry settings.

>> Top

Older Operating Systems - Windows 98, Windows ME, Windows NT

Even though 99% of the patrons of PChuck's Network are looking for help with networking between computers running Windows 2000 or Windows XP, there will always be those with older operating systems. Even though you'd be much better off (on a computer that will support it) upgrading to Windows XP, I will always advise you to only upgrade from a working system.

Do not expect to get rid of problems by upgrading. Fix your problems first. That being an issue, how do you network Windows XP with older operating systems? What are the issues between Windows XP and older operating systems?

• The browser. The browser provides the contents of Network Neighborhood. For all computers to see the same computers displayed in Network Neighborhood, there can be only one authoritative computer - the master browser. Selection of a master browser works best when all computers play by the same rules. If you have 2 computers on your LAN - one running Windows 98, and the other running Windows XP - a computer running Windows XP should always be elected as the master browser.
  
  • The Windows XP operating system is more reliable. It manages resources better, and will provide more diagnostics.
  • A computer running Windows XP is probably newer than one running Windows 98. The hardware will probably be more reliable, and have more power.
  • Since it's newer, you'll probably use a computer running Windows XP more. The browser infrastructure is much more stable, when using a computer that's online constantly.
  
  Since Windows XP is the preferred authority, on any network with mixed population, the browser election process should always favour a Windows XP computer for master browser. The Windows XP browser process uses this reasoning. Unfortunately, the Windows 98 browse master does not do this, reliably.


• File sharing. Once you get past the issue of seeing what's available on the LAN, you'll want to access what's available.
  • Computers running Windows 98 can share files using share level access (one password used by all), or user level access (similar to local accounts in Windows XP). Other older operating systems have other possibilities. This subject is covered in detail in the referential Microsoft white paper File and Printer Sharing with Microsoft� Windows.
  • If you're using a client computer running Windows 98, trying to access a server running Windows XP, and you're asked for the IPC$ password, the server needs the Guest account activated for network use.
  • A computer running Windows 9x will use either Guest authentication, or it will use non-Guest authentication, at your discretion. But understand the differences.
  • Windows 95 / 98 clients will have a problem with (KB160843): share names with more than 12 characters.
    
  • Computers running Windows 95 / 98, and computers running Windows 2000 / XP, will happily use LM Authentication when starting a sharing session. Unfortunately, LM Authentication is not as secure as its successors, NTLM and NTLM V2. If you involve Windows Vista, you'll have a problem, since Windows Vista, by default, only uses NTLM V2.


• More information:
  • Microsoft: Windows 98 on MS Networks
  • PChuck: A Computer For Virginia USA

>> Top

Irregularities In Workgroup Visibility

Let's say you connect 2 computers, running any of the many versions and editions of Windows, with default configurations, in a network. To find each computer from the other, you open Windows Explorer (don't confuse this with Internet Explorer, please), and look in My Network Places (aka Network Neighborhood). On a fully working LAN, this will work just fine. In your case, it may not.

In your case, Computer A shows both Computers A and B, as it should, and files on Computer B are accessible. On Computer B, either you don't see Computer A, or when you try to access Computer A, you get an error. You may, or it may not, see Computer B. This visibility problem may be observed constantly, or it may come and go.

This visibility problem is possible on LANs with Windows 2000, Windows XP, and / or Windows Vista, in any combination.

Now before you start, you should be aware that you will enjoy this more, and frequently will be more successful, when you work on a properly designed and setup network. After you review that tutorial, I recommend that you tackle the task at hand in this order.

• Basic Diagnostics
  
• Intermediate Diagnostics
  
• Advanced Diagnostics
  

Basic Diagnostics

1. Check for a personal firewall problem. A misconfigured or malfunctioning personal firewall, on either computer, can block browser access. Do you have antivirus protection? Make sure that your antivirus is not part of a package that contains a personal firewall, and does not contain a component that acts as a firewall.


2. Look carefully for a hardware firewall, sitting inside your computer. The nVidia nForce is probably the first, but surely not the last, device of this type.


3. Some newer, WiFi routers, have a complete firewall between ALL client computers, connected wired or wireless. Look for an "Isolation Mode" setting, if no computers are visible to each other. Each vendor uses a different name for this feature, so read your user guide carefully, if you suspect that this is a problem.


4. Make sure that NetBIOS Over TCP is consistently set, in TCP/IP Properties for each computer in your network.


5. Does your LAN include any computers running Windows Vista? If so, be aware of the additional issues involved in Windows Vista and Windows Networking.


6. Do you have a share setup on each computer? With Windows XP / Vista, only computers with non-administrative shares (not ending in "$") will be visible in My Network Places (aka Network Neighborhood).


7. Make sure that all computers are in the same workgroup, if you expect to see them in the root of Network Neighborhood (My Network Places).


8. Check for several well known and lesser known registry settings, which will affect visibility of, and access to, your server.


9. Look at the content of the error message. Do you see either "error = 5" (aka "access denied"), or "error = 53" (aka "name not found")? Read the appropriate article.


10. Look again at the complete and exact text in any observed error messages. Some very obscure errors have very simple resolutions.


11. Run, and examine output from, "browstat status", "ipconfig /all", and "net config server" and "net config workstation", for each computer.


12. Post output from the above step for expert interpretation and advice. Include relevant background details in your post. When including diagnostic logs, such as "browstat status", "ipconfig /all", or background details, format them properly when you post them.

Intermediate Diagnostics

1. Make any changes in your network per the advice of the helpers in the forums. Retest as advised.


2. Run, and examine, CDiag output for each computer. If you have more than 3 computers, post diagnostics for at least 3, and try and include some computers which show no symptoms of the problem (if any exist), as a control. The more data here the better.


3. Post output from the above step for expert interpretation and advice. Again, format CDiag logs properly when you post them.


4. Check that all necessary network components and services are provided. The necessary protocols and transports must be loaded and activated. The necessary services should be Started and Automatic.


5. Run, and examine, CPSServ output for each computer. Try and do this on the same computers that you ran CDiag (above) on, to make the diagnostics more effective.


6. Post output from the above step for expert interpretation and advice. Again, format CPSServ logs properly when you post them.


7. Check for, and remove, unnecessary protocols and transports, like IPV6, IPX/SPX, and NetBEUI. Unnecessary protocols and transports can block Server Message Blocks, and cause problems. Check "browstat status" logs for evidence of IPX/SPX or NetBEUI. Check "ipconfig /all" logs for evidence of IPV6. Remove any protocols found. If you solve your immediate problems, you can re in stall any protocols removed, later.


8. Check for LSP / Winsock / TCP/IP corruption. The LSP / Winsock layer in the network, on either computer, can malfunction, and drop SMBs. If you have more than 2 computers, the computer causing your problems may not be immediately apparent. Use CDiag to identify the computers to work on first.

Advanced Diagnostics

1. Learn how to solve network problems.


2. Try my comprehensive troubleshooting guide, Troubleshooting Network Neighborhood Problems. Use CDiag and / or CPSServ logs, to identify the computers to work on first.


3. Read about The NT Browser and Windows Networking.


4. Read about File Sharing Under Windows XP.

NOTE: The comprehensive troubleshooting guides, referenced in Advanced Diagnostics, contain all of the other sections and more, sequenced by network design (ie, physical connectivity issues first, and file sharing permissioning last). The last article talks about problems specific to File Sharing, such as authentication and authorisation, and it is most useful when all other problems (such as are discussed in the previous step) are resolved. This article, as a whole, emphasises the most productive procedures for resolving your symptoms. You are free to try any of the above steps, in any order which pleases you - it is, after all, your network.

These are simply the procedures which currently seem to produce the best results. So become familiar with them, because, if you ask for help and I am involved, I will likely ask you for the diagnostics discussed above. And, if we don't get immediate results here or elsewhere, I'll ask you to repeat each step above, one by one, as I examine the results. Read each linked article.

Now I'm a Networking and Security advisor, and I don't provide advice on security issues casually. Using the Internet, without considering the privacy and security implications, makes trouble for a lot of innocent people. When you're considering the necessity of providing requested details about your computer network, in an open Internet forum, please read this brief Privacy Statement. Help us to help you.

Browsing Across Subnets

One of the causes of browser problems, and the constant complaint "I can't always see all of my computers in My Network Places!", is a backup browser server becoming separated from the master browser. As I stated in my main Browser article, The NT Browser...

Anytime that a backup browser realises that there is no master browser present on the domain, the browser is authorised to hold an election to determine a new master browser.

This behaviour is for 2 reasons.

1. There must be a master browser available at all times, for browsing to work.
   
2. There must be a master browser available on each subnet, for browsing to work.
   

Why is this relevant? It's because browser relationships, in general, do not pass from subnet to subnet. Browser communications, from a server to a backup or master browser, are by broadcasted datagrams. Broadcasted datagrams are sent to all computers on a subnet, but nowhere else. Routers drop broadcasted datagrams, so server advertisements, which are what the master browser depends upon to know that a server exists, stay on each subnet.

The master browser on the subnet assembles all of the server advertisements into the browse list for the subnet. If a domain is segmented, by either multiple subnets or just having multiple master browsers, it is the job of the domain master browser to collect the browse list from each segment master browser, aggregate the lists, and pass the aggregated list back to each segment master browser.

Here is one instance where a workgroup will not perform as well as a domain. If a workgroup is segmented, there will be no domain (workgroup) master browser, and no ability for servers on one segment to be seen from another segment. Segmented workgroups simply can't be browsed across segment boundaries.

Do you maybe have two (or more) routers, but would prefer to have one subnet? If so, then read about File Sharing On A LAN With Two Routers.

Windows Networking

Windows Networking is the suite of programs that provide file and printer sharing between computers running Microsoft Windows (and compatible Network Operating Systems, such as Linux). If you reference the OSI Network Model, Windows Networking runs at the Application level. It uses Server Message Blocks over the lower network layers, such as Ethernet or WiFi, for connectivity.

By default, Windows Networking uses SMBs over NetBIOS Over TCP/IP (NetBT), and TCP/IP, for logical connectivity. It can be customised to use alternate transports, like IPX/SPX or NetBEUI, if you're prepared to deal with the support issues. On a large LAN with a dedicated DNS server for local name resolution, it can use SMBs directly bound to ("hosted on") Internet Protocol.

Whatever transport that you choose, though, all computers need to use the same one.

There are five concepts, which you need to understand, to deal with Windows Networking problems.

• Grouping of computers in a domain or workgroup.
• Resolution How do I address each resource?
• Browsing What resources are there for me to access?
• Authentication / Authorisation Who am I, and should I be allowed to access a resource?
• The Total Picture How do Group Memberships, Browsing, Name Resolution, and Authentication / Authorisation affect me?

Domains / Workgroups
Computers are grouped in domains or workgroups, with membership in either grouping providing benefits.

We can browse My Network Places (known sometimes as "Network Neighborhood"), and see all nearby computers. The workgroup that we are in is the part of My Network Places that is nearest to us - those are the computers that we need access to the most. A workgroup provides a way of identifying the computers that relate closely to our computer.

A domain, on the other hand, is a collection of computers that trust each other. When your computer is joined to a domain, it sets up a two way trust, where the computer and the domain are trained to trust each other.

1. You authenticate (login as a local administrator) to your computer.
2. You allow a domain administrator to authenticate to the domain from your computer.
3. Your computer learns to trust the domain. A "certificate" from the domain is added to your computer.
4. The domain learns to trust your computer. A "certificate" from your computer is added to the domain.

The domain membership also gives workgroup visibility. You see the other members of "your" domain. as you would see the other members of "your" workgroup. But the two way trust in the domain is special.

• You gain access to your computer thru domain authentication - you trust the domain, based upon the certificate from the domain that's now on your computer, and upon the credentials (domain account / password) that you supply.
• You gain access to domain resources in a similar way, from the certificate from your computer that's now in the domain, and from the credentials that you supply.
• Other people in your work area, and presumably in your domain, can potentially access your computer, as you access theirs.
• For an allegorical description of two factor (certificate / credential) authentication, see Designing an Authentication System....

Most small LANs will use workgroups, although small domains are worthwhile. Domain membership provides two components - Authentication / Authorisation, and Browsing. Workgroup membership provides one component - Browsing. Workgroup membership provides no authentication / authorisation; that must be provided by redundant accounts setup on both the client and the server.

Outside of becoming invisible in Network Neighborhood, by changing your domain / workgroup membership, you are not adding to your security at all. Becoming invisible is simply a form of Security By Obscurity. If you're on a network with untrustable computers or people, making yourself invisible won't protect you; you need Layered Protection, including a perimeter and / or personal firewall.

>> Top

Name To Address Resolution
You might call the computer in your kitchen "Kitchen Computer", but it's a safe bet that your equipment will call it something more definitive, like "192.168.0.101" (an IP address), or "06-04-7A-D7-EF-BA" (a MAC address). The IP address, and the MAC address, are used by the various operating systems and network devices, to send message from computer to computer.

The process of translating a name like "Kitchen Computer" to an IP address like "192.168.0.101" is called name resolution. Name resolution is provided independently of domain / workgroup membership. A domain may contain a DNS or WINS server, but that's not a given. Less likely, but still possibly, a workgroup may contain either. Without a name resolution server, all computers use peer-peer name resolution. Please don't confuse peer-peer resolution with Node Type "Peer-Peer", which is just the opposite.

If your network (domain or workgroup) is setup properly, but does not contain a DNS or WINS server, all computers will use peer-peer broadcasts to resolve names. Using IP addresses to refer to computers should not be necessary, except in extreme situations. And, if you're using an alternate protocol, an IP address won't work at all.

>> Top

Browsing
Each domain / workgroup uses a browser server to tell it what resources are out there. For every domain / workgroup on a network, there should be at least one browser server in that domain / workgroup.

You can have computers in a workgroup, sharing a network with a domain. If a workgroup has its own browser server, the computers in the workgroup can see each other, and can see the computers in the adjoining domain.

If a workgroup has no browser server, its members will still be able to see each other, and the computers in the domain, if you make the workgroup name identical to the domain name. If you have a computer that's not a domain member, AND you give that computer a workgroup name identical to the domain name, the browser servers in the domain will provide visibility between that computer and the computers in the domain.

In order for browsing to work properly, several essential relationships have to exist between the various computers on the LAN in question.

Does your domain / workgroup occupy multiple subnets? If so, you need to know about Browsing Across Subnets. Do you maybe have two (or more) routers, but would prefer to have one subnet? If so, then read about File Sharing On A LAN With Two Routers.

>> Top

The Total Picture
Browsing is, arguably, not essential in a small LAN. Without the use of a browser server, a common workaround is to make an adhoc mapping to a share.

• Hit the Start button.
• Hit the Run button.
• Type "\\OtherComputerName" (substituting the Other Computer Name, and less the ""), and hit Enter.

Or, you may make a persistent mapping from Windows Explorer.

• Select Tools, then Map Network Drive, from the Windows Explorer menu.
• Substitute the Server, and Share, into "\\Server\Share" as entered into the Folder: box.
• Select "Reconnect at logon", if desired.
• Select the Finish button.

Name resolution is not essential either. Without the use of name resolution, you can map a resource by substituting the ip address of the server for the name (again, if you're using NetBIOS Over TCP/IP as the transport).

• Hit the Start button.
• Hit the Run button.
• Type "\\OtherComputerIPAddress" (substituting the Other Computer IP Address, and again less the ""), and hit Enter.

But, when you use Network Neighborhood (My Network Places) to provide a neat list of all the shared folders and printers on your network, you select and double click on a share, and you get a connection, you are using, in turn,

• Browsing
• Resolution
• Authentication / Authorisation

If you're having a problem with Network Neighborhood:

• Network Neighborhood is empty, or lacks an entry for one or more computers that you know are there.
• Computer A shows in Network Neighborhood for Computer B, but Computer B doesn't show in Network Neighborhood for Computer A.
• You get an error "(Workgroup) is not accessible..." when opening Network Neighborhood.
• You get a variant (and there are many variants here) of "not accessible / name not found ... access denied" when clicking on an entry in Network Neighborhood.

then you likely have a problem with either browsing, or name resolution. Diagnose Windows Networking first. If, and only if, you can't find any problems with Windows Networking, look at File Sharing. Whenever working on problems with Windows Networking, work from the bottom up.

You may also benefit from reading about Server Message Blocks, and Windows Networking.
>> Top

Authentication and Authorisation
Whether or not you do use the browser to list resources, and / or name resolution to locate the resources, you will still have to setup authentication and authorisation properly, if you wish to actually connect to, access, and change those resources. You can avoid use of the browser, and of name resolution; you cannot avoid authentication and authorisation.

>> Top

RestrictAnonymous and Your Server

To have a truly secure server, you'll want to require proper authentication before allowing access. The restrictanonymous registry setting allows you to control anonymous access, and make authenticated access necessary.

The restrictanonymous registry setting, if not used properly, can affect access to your server in several possibly unanticipated ways.

• Your server son't be enumerated by the browser.
  
• Your server won't be accessible thru Guest authentication.
  
• Your server may not have its name successfully resolved to an address. Other computers may display an "error = 53" when trying to access your server.
  

The browser process is designed to run from a server, which would typically be unattended, and not logged on. It uses anonymous access to enumerate any server under its notice. Since it requires anonymous access, browser operation is subject to interference by the restrictanonymous setting.

Since the Guest account is equivalent to anonymous access, the restrictanonymous setting can likewise interfere with Guest access.

And, in at least one case which I have observed, the restrictanonymous setting can interfere with name resolution.

The Zotob worm, as we are instructed by ISC / SANS Zotob affecting some XP SP2/2003?, uses anonymous SAM enumeration to spread. That ability is controlled by the restrictanonymoussam setting. The ISC article goes further, predicting that one day some currently unknown worm may use anonymous shares enumeration, and recommends setting restrictanonymous to block such expected activity. If you followed such a recommendation, and you are now here, that is why you're here.

Enumeration of your server, and other relationships described above, requires anonymous access.

Look at registry key (spaces added for readability) [HKLM \System \CurrentControlSet \Control \Lsa], value restrictanonymous, on any server with either problem.

For anonymous access to work (for any server to be enumerated by a browser, or for Guest authentication to take place), a server must have a restrictanonymous value of "0". If the value on your server isn't "0", change it and restart the server.

NOTE Only worry about one specific value here: restrictanonymous.

• The relevant key node is CurrentControlSet. ControlSet001, ControlSet002, ... are mirrors of that key, and are not relevant, when you're working on this problem.
  
• The relevant value here is restrictanonymous. The peer value, restrictanonymoussam, is not relevant, when you're working on this problem.
  

Only worry about the restrictanonymous value in the [HKLM \System \CurrentControlSet \Control \Lsa] registry key.

Besides restrictanonymous, though, you might want to be aware of the Hidden, and the RestrictNullSessAccess, registry settings.

For more information, you might want to read:

• JSI FAQ 2625 New Windows 2000 RestrictAnonymous registry value.
• Microsoft RestrictAnonymous.
• Microsoft (KB246261): How to Use the RestrictAnonymous Registry Value in Windows 2000.
• Microsoft (KB296403): The RestrictAnonymous Value Breaks the Trust in a Mixed-Domain Environment.
• Microsoft Threats and Countermeasures Chapter 5: Security Options.

The above articles refer to Windows 2000, and to Server 2003. Remember Win2K is NT V5.0, WinXP is NT V5.1, and Windows Vista is NT V6.0.

>> Top

File Sharing On A LAN With Two Routers

File sharing on a LAN with a single segment (all computers connected to the same router) is fairly simple. Windows Networking uses Server Message Blocks (SMBs) broadcast between all computers. In most networks, SMBs are transported over IP.

• Browser broadcasts help to advertise the existence of a computer to the others. This enables each computer to be displayed in My Network Places / Network Neighborhood.
  
• Name resolution broadcasts help a computer find out the IP address of another computer. With Windows Networking transporting SMBs over IP, accurate and complete IP information is essential.
  

If you use Windows Networking in its native form, by opening My Network Places, and clicking on a server name, to see a list of its shares, you're using broadcasts. If you try to access a server by name, you're probably using broadcasts.

Now, you can't have every computer in the world broadcasting to every other computer. So, SMB broadcasts, by design, don't pass thru routers. One router = one subnet = one broadcast domain.

What if you need to have two or more routers on your LAN, but you need to have just one broadcast domain, so you can share files everywhere?

• The primary router is to be next to the broadband modem, and you have to run a long cable to another room, with a secondary router, to connect wireless computers in there.
  
• The primary router ran out of ports, so you used the secondary router to add capacity to your LAN.
  
• It's simpler to run 1 cable elsewhere, and share that one cable using a router, than to run 2 (or more) separate cables from the primary router.
  
• Your Internet service includes a modem that can only connect to the primary router. The primary router may be a computer running ICS.
  
• The primary router is a wired router, and the secondary router is wireless.
  

In this example, you've got a pair of routers, and 4 computers. Router 1 is connected to your Internet service. Computers A and B, and Router 2, are all connected to Router1. Computers C and D are connected to Router 2. You have Computers A and B on their subnet (LAN 1), in one broadcast domain, and Computers C and D their subnet (LAN 2), in another broadcast domain.

That's a perfectly reasonable setup for Internet service, but it's not-so-great for file sharing. Computers A and B can see, and access each other. Likewise, Computers C and D can see and access each other. But neither Computer A nor B can see nor access C or D, and vice versa. It would be simpler if you would just get rid of Router 2, connect all computers to Router 1, and everything would be fine.

Maybe using 2 routers is something you just can't avoid, but nobody said that they have to both work as routers. What you do is only use Router 2 as a switch (or a WAP, if it's wireless) - you can still connect the computers to it, but Router 1 will be the only functioning router. It's a simple solution.

If you're lucky, and have a high end NAT router, your router may have a switch - maybe physical, maybe set in the router setup - that will put it into "Access Point Mode" or similar. Check your owners manual.

If not, you simply change the way the router is connected, and used.

In this exercise, the Router 1 LAN is 192.168.0.1, and the Router 2 LAN is 192.168.1.1.

• Don't connect the WAN on Router 2 to anything. Connect a LAN port on Router 1, and Computers C and D, as peers, to a LAN port on Router 2.
  
• Disable the DHCP server on Router 2.
  
• Change the LAN on Router 2 from 192.168.1.1, to 192.168.0.254 (or any other address not in use, and not part of any DHCP scope).
  
• Are you using DHCP on your LAN? If so, make sure that the DHCP server, on router 1, has a scope defined large enough to service all of the computers.
  
• Restart each computer, so it gets a new IP address. This may always not be necessary with Windows XP / Vista, but be prepared to do this.
  

In a variant of this setup, Router 2 is distant from Router 1, and you won't be running Ethernet cables between the two. You'll configure Router 2 the same as in the above scenario, then put it into client mode connected to Router 1 by WiFi. Router 2 then becomes a WiFi bridge client, and provides service to Computers C and D, which connect to it by Ethernet.

And that's all you have to do. Router 1 is the only router (remember, the router has to sit between your LAN and the Internet, so that has to be Router 1). Router 2 still provides connectivity for Computers C and D, but it's working now as a switch (or WiFi AP). And all 4 computers - A, B, C, D - are now on the same broadcast domain, and the same subnet.

For another description of this solution, see DSLR Forums Using a Wireless Router as an Access Point (#11233)

>> Top

Hiding Your Server From Enumeration

If you don't want your server to be displayed in Network Neighborhood, add a registry value [HKLM \SYSTEM \CurrentControlSet \Services \LanmanServer \Parameters \Hidden]. Make Hidden a DWORD, with value "00000001". This will prevent it from reporting any shares to the browser.

Conversely, if your server isn't showing up in Network Neighborhood, and you want it to show up there, check for that value. If it exists, make sure that it has a value of "00000000", or delete it altogether.

Windows 9x (95/98/ME) and the Browser

When you have computers running Windows 9x (95, 98, or ME) on the same network with computers running Windows NT (NT, 2000, XP, Server 2003), you should expect browser problems (such as computers not visible, or "access denied", when trying to use Network Neighborhood). The rules for detecting the absence of the master browser ("Browse Master" in Windows 9x) vary between the 2 platforms. This leads to the problems when a working LAN of Windows 9x computers has a Windows XP computer added.

If you don't want to have browser conflicts, you'll need to disable the browser on each of either the Windows 9x, or the Windows NT, computers. Choose intelligently in which group you wish to disable the browser. If you have just 1 or 2 Windows NT computers, and a larger number of Windows 9x computers, you might elect to disable the browser on the Windows NT computers. Conversely, if you have a lot of Windows NT computers, and a couple Windows 9x computers, disabling the Browse Master on the Windows 9x computers would make more sense.

To stop the Windows 9x Browse Master:

• From Control Panel - Network, double click on "File and printer sharing for Microsoft Networks".
  
• In "File and printer sharing for Microsoft Networks Properties", change the Value for Browse Master to Disabled.
  
• Hit OK, and restart the system.
  

Alternatively, you can edit the Windows Registry. Change value [HKLM\ System\ CurrentControlSet\ Services\ Browser\ Parameters\ IsDomainMaster] to False. Then restart the system.

To stop the Browser on a Windows NT/2000/XP system, simply set the Computer Browser service to Stopped and Disabled.

Any time you change the browser setup on your LAN, you may have to wait for up 51 minutes, before all computers are synchronised. If this latency period is unacceptable, you may restart each computer. For maximum reliability, power all computers off; when all computers are off, power each one back on again, starting with the one which you want to serve as the master browser.

Having done this, you may need to deal with Network Neighborhood problems in general, so continue by reading Irregularities In Workgroup Visibility.

If you wish to diagnose this issue, and confirm that it's a problem first, you can run Browstat from any of the Windows NT (NT, 2000, XP, 2003) computers. Browstat won't run on Windows 9x (95, 98, ME) computers, but if you run browstat twice on each computer running NT, you can compensate for that. Run:

browstat status
browstat listwfw workgroup

where workgroup is the name of the workgroup of which this computer is a member, taken from the "browstat status" log.

For more information about Windows 9x browser issues, read the Microsoft white paper Browsing and Windows 95 Networking, or this Microsoft article (KB246489): Frequent Browser Elections When Windows 95 and Windows NT 4.0 Configured in Workgroup.

For more information about the browser in general, read The NT Browser (or Why can't I always see all of the computers on the LAN?).

And for more issues relevant to the various operating systems, see Older Operating Systems - Windows 98, Windows ME, Windows NT

>> Top

Troubleshooting Network Neighborhood Problems

When you try to access a shared folder from Network Neighborhood / My Network Places, and get the dreaded "Access denied..." error, or when other computers don't show up there at all, you could have any one (or more than one) of several problems. Look closely at the complete and exact text, in any observed error messages; this can help diagnose many problems more effectively.

This article, like Troubleshooting Internet Service Problems, is structured like the OSI 7-Layer Network Model. If you have multiple problems with your network, you have to diagnose and fix the lower level problems first. If you don't, how can you diagnose the higher level problems?

Now before you start troubleshooting, note that you will enjoy it more, and frequently will be more successful, when you work on a properly designed and setup network. Once you've reviewed that, I recommend that you tackle the task at hand in this order.

• Physical Network Problems.
  
• Logical Network Problems.
  
• Address / Name Resolution Problems.
  
• Security Problems.
  
• Network Components and Services.
  
• Browser Problems.
  
• File Sharing and Permissions Problems.
  
• Virtual Private Networking.
  
• Identifying the Scope of the Problem.
  
• Asking For Help.
  

So what are the differences between this article, and Troubleshooting Internet Service Problems? Well, there is good new, and bad news. The good news - this problem is one you can solve yourself, without involving your ISP, or LEC. The bad news - there are a lot more network details that you will have to deal with.

>> Top

Physical Network Problems
The content of Network Neighborhood / My Network Places is cached on your computer, and what you see there could have been placed there as much as an hour ago. Since then, the server that you're trying to access could have been:

• Turned off.
  
• Disconnected, intentionally or unintentionally.
  
• Moved out of range, if on a wireless LAN.
  

Make sure that you don't have a simple physical network problem. And make sure that all computers are directly connected, on the same LAN segment, if at all possible.

Try and diagnose physical network problems from the bottom up.

>> Top

Logical Network Problems

Given a little preparation (have the correct device drivers available), you should be able to re install the drivers for the network adapter without too much trouble. This is usually one of the last things tried, but can be one of the easiest.

The content of Network Neighborhood / My Network Places comes from messages ("Server Message Blocks", aka "SMBs") sent from computer to computer. In Windows Networking, SMBs are most frequently transported over TCP/IP, and proper TCP/IP settings are essential. If you're unfamiliar with IP configurations and networking, ask for help.

Note that SMBs are generally sent over NetBIOS Over TCP/IP, aka NetBT. In large LANs, with a properly setup domain structure, SMBs can be bound directly to IP; this is known as directly hosted SMBs.

Also, a corrupt LSP / Winsock layer can have an effect on Network Neighborhood, just as it affects any network activity. If you've just removed adware / spyware, this is always a possibility.

Are all of the computers on the same subnet, physically and logically? Or did you, for some reason, setup a LAN with 2 routers?

>> Top

Address / Name Resolution Problems
In Windows Networking, using SMBs over NetBT, properly configured name resolution is important. Run "ipconfig /all" and verify the Node Type. An inappropriate Node Type will prevent name resolution, or slow it down.

Any time you run a diagnostic like browstat, ipconfig, ping, or anything else that lists a computer name, and the name is garbaged or contains non alphanumeric characters, a corrupt LSP / Winsock layer is a very good possibility. A problem in the Hosts or LMHosts file can have the same effect.

If an actual "error = 53" message is one of your symptoms, this literally means "host name not found", but there are several possible causes for this scenario. Name resolution configuration is just one of the possible causes.

Most of these instructions are written to focus on the needs of workgroup infrastructures, though domains also apply in most cases. If you're using directly hosted SMBs, consider the needs of domain based name resolution.

>> Top

Security Problems
You need a personal firewall on each computer, but your personal firewall has to be properly setup and used. A misconfigured or misbehaving personal firewall, on a computer, can block access to the server that it's protecting.

If you disable your personal firewall, and the problems stop, then you at least know where to start working. But if the problems don't stop, don't assume that the firewall is not the problem. Many personal firewalls do not react properly to being disabled, and will continue to cause problems after being disabled. And look for a previously overlooked firewall, such as one bundled with your antivirus protection. There could even be a hardware firewall, sitting inside your computer. The nVidia nForce is probably the first, but surely not the last, device of this type.

Misbehaving and misconfigured firewalls, and overlooked firewalls, are probably the most common root cause of problems with Windows Networking, in the cases where I have been able to provide assistance.

And remember that, if you're using an alternate transport such as IPX/SPX or NetBEUI, a firewall will provide no protection.

>> Top

Network Components and Services
Windows Networking depends heavily upon half a dozen key networking components and services. Depending upon the role played by any computer, it may require some, or all, of these components and services, to work properly.

If you add or change any network components, run the Network Setup Wizard before continuing.

If you're using a NAT router as the DHCP server (and most of you will be), please Enable NetBT explicitly, except for specific circumstances. Make this setting consistent across your entire LAN.

If your LAN

• Has a domain.
• Has computers running only Windows 2000, Windows 2002 (aka Windows XP), and Windows 2003 (aka Server 2003).
• Uses DNS, properly setup, for name resolution.

then you may wish to disable NetBT, and use direct hosted SMBs.

If TCP/IP can't be used properly, SMBs using an alternate protocol such as IPX/SPX or NetBEUI may provide immediate access to shares, but still cause "access denied" errors here. If you are using an alternate protocol (listed in the network items list in Local Area Connection - Properties), you may have problems with Network Neighborhood / My Network Places. Please remove both IPX/SPX and NetBEUI, unless one is absolutely needed. You certainly should not need both.

There is one exceptional circumstance where IPX/SPX may be needed. Please follow the complete instructions precisely - using TCP/IP here won't help the browser, and it will cause major security problems.

And sometimes when you run the Network Setup Wizard, you may end up with IPV6 aka Teredo Tunneling, which is not compatible with Windows Networking. You must remove IPV6, at least to diagnose the problem.

>> Top

Browser Problems
The content of Network Neighborhood / My Network Places comes from a subsystem known as the browser. At least one computer must be running the browser service, but having too many browsers can result in a browser conflict.

A master browser conflict can cause various problems in Network Neighborhood. A master browser conflict can have numerous causes. Running Browstat is a good way to start looking for browser related problems.

With Windows XP, computers only display in Network Neighborhood if there is actually a share (and not an administrative $ share either) created. Servers with no shares don't get enumerated by the browser, so they won't be seen in Network Neighborhood.

Available and visible shares, on servers in the same workgroup as your computer, will get listed in the root of Network Neighborhood (My Network Places). Other workgroups, with their computers, will be listed under Entire Network - Microsoft Windows Network. If another computer isn't visible where you think it should be, verify the workgroup name (of the other computer, and of your computer) in System Properties - Computer Name.

An "access denied" message, or inability to see a server in Network Neightborhood, can be caused by the restrictanonymous setting. And a totally invisible server can also be caused by the Hidden setting.

A "network path was not found" message, when referring to the master browser in a browstat log, can be caused by the Remote Registry Service not running on the master browser. Running a server with XP Home, as the master browser, is a bad idea - XP Home does not have the Remote Registry Service, as it does not provide for any administrative access thru the network.

Do you have a network with computers running both Windows 9x (95, 98, ME) and Windows NT (NT, 2000, 2003, XP)? If so, you'll need to check for browser conflicts between computers running the two different operating system families.

Does your domain / workgroup occupy multiple subnets? If so, you need to know about Browsing Across Subnets.

The browser can be a tricky problem to tackle. If you're unsure about how to deal with it, ask for help.

>> Top

Sharing - Naming and Permissions Problems

The names used for the shares, and other factors, can make a difference in their accessibility.

Windows 95 / 98 clients will have a problem with (KB160843): share names with more than 12 characters.

Windows NT / 2000 browser servers will have a problem with (KB231312): server comments greater than 48 characters.

You can get "access denied", and other symptoms, from actual lack of permissions to access the desired share. Shares with name ending in a "$" (Administrative shares) won't be accessible, if the server is depending upon Guest authentication, since Guest doesn't have administrative access.

Either the restrictanonymous setting, or the RestrictNullSessAccess setting, can cause lack of access to a share, if you're attempting Guest authorised access. The latter can even affect shares selectively - some may be accessible, others not.

>>Top

Virtual Private Networking
Windows Networking, in general, involves local connectivity. Resource sharing is more effectively done when client and server are physically located near each other.

What if you have two offices, located at distance from each other, and want to use the Internet to provide communications between the two? This would be a point to point connection, formally setup between the two offices. A Virtual Private Network is a pre-configured, secure communications tunnel, through an otherwise insecure network (aka the Internet), between two locations.

A VPN has to be deliberately designed and setup, from both ends. An improperly designed VPN may cause more problems than it solves.

>> Top


Identifying the Scope of the Problem.

I've developed two simple utilities for checking your network, to identify the scope of a network problem. Both utilities are most useful when run from each computer, with output from all runs aggregated, and compared in masse.

The first utility, CDiag, examines your network by knowing the name and address of each computer. CDiag uses native Windows commands only, and runs from each computer without any explicitly granted network access to other computers.

The second utility, CPSServ, examines your network by automatically discovering each computer. CPSServ requires prior download of PSService, which is part of the free SysInternals PSTools utility. Neither CPSServ nor PSTools require any effort to install. PSService does require administrative access to each computer, so it won't be terribly useful on a network with XP computers running XP Home.

Documentation of both utilities is in progress, so be patient. Limited CDiag documentation is currently available.

>> Top

Asking For Help
If you're reading this article because you need help, please start by reading my Privacy Statement.

Spend a few minutes reading about How To Solve Network Problems.

Provide some background information about the problem, and about your network in general.

Ensure that each computer is Physically, and Logically, connected to your network, to your best ability.

>> Top

Next, provide ipconfig information for each computer. You'll do this from a Command Window (or a command window in Windows Vista).

1. Type "ipconfig /all >c:\ipconfig.txt" (less the "") into a command window (or a command window in Windows Vista). Only type the command into a command window - do not type Start - Run - "ipconfig /all...".
   
2. Type "notepad c:\ipconfig.txt" (less the "") into the same command window.
   
3. In Notepad, make sure that Format - Word Wrap is NOT checked!.
   
4. Copy and paste entire contents of the file into your next message, properly formatted.
   
5. Identify operating system (by name, version, and Service Pack level) with each ipconfig listing.
   
6. Please don't munge or omit any detail, as there is nothing provided by ipconfig that could provide help, to any bad guy, in identifying an entry point to your LAN. The good guys, on the other hand, may need any or all of the details, to accurately diagnose your problem. Help Us To Help You.
   

Did you just run ipconfig, and get good output (similar to what's described in the ipconfig article?). Ok, fine, continue and examine the output as instructed below. If you ran it, and got no response, or no output, or if a window opened and closed so quickly you couldn't read anything, please read my article on Using The Command Window.

Take a look at Reading IPConfig and Diagnosing Network Problems, if you're interested. Or, given a complete and unmunged set of "ipconfig /all" logs, I'll simply plan to use CDiag for the next step.

Next, provide "net config server", and "net config workstation", for each computer. You'll do this from a command window (or a command window in Windows Vista).

1. Type "net config server >c:\netconfig.txt" (less the "") into a command window (or in Windows Vista). Only type the command into a command window - do not type Start - Run - "net config...".
   
2. Type "net config workstation >>c:\netconfig.txt" (less the "") into that command window (or in Windows Vista). Note the ">>" here! Only type the command into a command window - do not type Start - Run - "net config...".
   
3. Type "notepad c:\netconfig.txt" (less the "") into the same command window.
   
4. In Notepad, make sure that Format - Word Wrap is NOT checked!.
   
5. Copy and paste entire contents of the file into your next message, properly formatted.
   

Finally, provide browstat information for each computer. You'll do this from a Command Window (or a command window in Windows Vista). Note that, as indicated in the article, you must download browstat (it's free, and small), as browstat.exe is not a normal component in Windows. Read the article, please.

1. Type "browstat status >c:\browstat.txt" (less the "") into a command window (or a command window in Windows Vista). Only type the command into a command window - do not type Start - Run - "browstat status...".
   
2. Do you have any Windows 9x (95, 98, ME) computers? If so, type "browstat listwfw >>c:\browstat.txt" into the command window (NOTE the ">>").
   
3. Type "notepad c:\browstat.txt" (less the "") into the same command window.
   
4. In Notepad, make sure that Format - Word Wrap is NOT checked!.
   
5. Copy and paste entire contents of the file into your next message, properly formatted.
   

Did you just run browstat, and get good output (similar to what's shown in the article?). Ok, fine, continue and examine the output as instructed below. If you ran it, and got no response, or no output, or if a window opened and closed so quickly you couldn't read anything, please read my article on Using The Command Window. If you ran it, and got "invalid command", "'browstat' is not recognized as an internal or external command...", or similar, please read my article on Using The Path.

See The Browstat Utility from Microsoft, for information on downloading, installing, running, and interpreting logs from, browstat.

Both browstat, ipconfig, and net config produce a lot of output - and if you're unfamiliar with networks, it may look like gobbledegook. But all of it may be useful to the folks who want to help you, so be generous and precise. And please provide the information in text, don't make a picture attachment. Attachments are not appreciated in the forums where serious help is given, and some helpers won't be very courteous if you send attachments.

And, if you truly want serious and well thought answers for your problems, learn how to ask serious and well thought questions. Again, Help Us To Help You.

>> Top

The Browstat Utility from Microsoft

If you use Network Neighbourhood / My Network Places to identify the computers on your local network, and / or to connect to shared resources, you depend upon the browser (please don't confuse this with Internet Explorer or any of its peers).

Microsoft gives us the Browstat program, which will show us what browsers you have in your domain / workgroup, at any time. This can help you detect a browser problem, on a LAN with Windows NT/2K/XP.

• Introduction
  
• A Good Example
  
• Multiple Workgroups
  
• A Browser Conflict and Gratuitous Protocol
  
• Unable to determine build of browser master: 5
  
• Unable to determine build of browser master: 53
  
• Unable to determine server information for browser master: 64
  
• Unable to retrieve server list from (servername): 121
  
• Unable to retrieve server list from (servername): 1130
  
• Not Active On Domain
  

>> Top

Introduction

With Windows 95/98/ME, you won't be able to run browstat. But, you can get some diagnostic information, by running browstat on a Windows NT/2K/XP computer.

Browstat is not provided as a standard component in Windows - you have to download it first. It is available on the web from various independent sources.

• Download Browstat.exe from Dynawell.
  
• Download Browstat.exe from Stanford.
  

Browstat is very small (40K), and needs no complicated install procedure.

• Download browstat, as above.
  
• Copy the downloaded file to any folder in the Path.
  
• Run Browstat from a command window (or a command window in Windows Vista):
  

  
  browstat status
  

  
  Only type the command into a command window - do not do Start - Run - "browstat status...".
  
• If you have any Windows 9x (95, 98, ME) systems on the LAN:
  
  
  
  • Look at the output from the previous step. Note the name of your domain / workgroup.
    
  • Run an additional command from a command window (or a command window in Windows Vista):
    

    
    browstat listwfw workgroup
    

    
    Substituting the name of your domain / workgroup for workgroup.
    
  • For instance, for my domain PChuck, I would run
    

    
    browstat listwfw pchuck
    

    
    
  
  
• If you need to produce output to a file, for maybe posting it on the Internet, read about Redirected Output (and Concatenated, Redirected Output, if appropriate).
  

For more information, read the Microsoft article (KB188305): Troubleshooting the Microsoft Computer Browser Service. There you will find a link to the Microsoft Support Tools package, which includes Browstat. If you just downloaded and installed browstat.exe from an independent source (above), don't bother to download or install any Microsoft package.

It may be available as part of the XP Support Tools pack, either on the XP install CD, or from Microsoft, if you have XP SP2 and a validated license. You can install the Support Tools pack, using the Microsoft .msi install, which will put browstat and other programs in a location determined by the install procedure. (Note): The inclusion of browstat as part of the Support Tools pack is not certain. You'll do well to try and get browstat from one of the independent sources above.

If you install the Support Tools pack, you will run browstat (and other tools) from the Support Tools command shell (similar to, but NOT the same as, a Command Window).

• Hit Start.
  
• Hit All Programs.
  
• Hit Windows XP Support Tools.
  
• Hit Command Shell.
  

Did you just run browstat, and get output (similar to any one of the examples below?). Ok, fine, continue and examine the output as instructed below. If you ran it, and got no response, or no output, or if a window opened and closed so quickly you couldn't read anything, please read my article on Using The Command Window. If you ran it, and got "invalid command", "'browstat' is not recognized as an internal or external command...", or similar, please read my article on Using The Path.

Here are a few examples of the output you might see. Don't get confused by the fact that browstat refers to your workgroup as a domain. To browstat, a domain and a workgroup are the same thing.

>> Top

• Introduction
  
• A Good Example
  
• Multiple Workgroups
  
• A Browser Conflict and Gratuitous Protocol
  
• Unable to determine build of browser master: 53
  
• Unable to determine build of browser master: 5
  
• Unable to determine server information for browser master: 64
  
• Unable to retrieve server list from (servername): 121
  
• Not Active On Domain
  

A Good Example
Here's an example of output from "browstat status", run from 2 computers on my LAN.

(From PChuck1)
Status for domain WORKGROUP on transport \Device\NetBT_Tcpip_...
   Browsing is active on domain.
   Master browser name is: PChuck2
       Master browser is running build 2195
   2 backup servers retrieved from master PChuck2
       \\PChuck1
       \\PChuck2
   There are 2 servers in domain WORKGROUP on transport \Device\NetBT_Tcpip_...
   There are 1 domains in domain WORKGROUP on transport \Device\NetBT_Tcpip_...

(From PChuck2)
Status for domain WORKGROUP on transport \Device\NetBT_Tcpip_...
   Browsing is active on domain.
   Master browser name is: PChuck2
       Master browser is running build 2195
   2 backup servers retrieved from master PChuck2
       \\PChuck1
       \\PChuck2
   There are 2 servers in domain WORKGROUP on transport \Device\NetBT_Tcpip_...
   There are 1 domains in domain WORKGROUP on transport \Device\NetBT_Tcpip_...

This shows me:

• My domain (workgroup) is WORKGROUP.
  
• My master browser is PChuck2.
  
• Both PChuck1 and PChuck2 are running the browser.
  
• There are 2 servers (ie PChuck1 and PChuck2) in my domain (workgroup).
  

This is a clean, balanced run. No browser problems indicated here.

>> Top

Multiple Workgroups

(From PChuck1)
Status for domain MSHOME on transport \Device\NetBT_Tcpip_...
   Browsing is NOT active on domain.
   Master name cannot be determined from GetAdapterStatus.

(From PChuck2)
Status for domain WORKGROUP on transport \Device\NetBT_Tcpip_...
   Browsing is active on domain.
   Master browser name is: PChuck2
       Master browser is running build 2195
   1 backup servers retrieved from master PChuck2
       \\PChuck2
   There are 1 servers in domain WORKGROUP on transport \Device\NetBT_Tcpip_...
   There are 1 domains in domain WORKGROUP on transport \Device\NetBT_Tcpip_...

There are 2 problems indicated in this example.

• PChuck1 is in the MSHome workgroup, while PChuck2 is in the Workgroup workgroup.
  
• PChuck1 is not running the browser service. Since there's no browser running for MSHome, that domain (workgroup) can't be enumerated.
  

You simply need to correct the workgroup membership for PChuck1.

>> Top

A Browser Conflict and Gratuitous Protocol

(From PChuck1)
Status for domain WORKGROUP on transport \Device\NwlnkNb
   Browsing is active on domain.
   Master name cannot be determined from GetAdapterStatus.  Using \\PChuck1
       Master browser is running build 2600
   1 backup servers retrieved from master PChuck1
       \\PChuck1
   There are 1 servers in domain WORKGROUP on transport \Device\NwlnkNb
   There are 1 domains in domain WORKGROUP on transport \Device\NwlnkNb
Status for domain WORKGROUP on transport \Device\NetBT_Tcpip_...
   Browsing is active on domain.
   Master browser name is: PChuck1
       Master browser is running build 2195
   1 backup servers retrieved from master PChuck1
       \\PChuck1
   There are 1 servers in domain WORKGROUP on transport \Device\NetBT_Tcpip_...
   There are 1 domains in domain WORKGROUP on transport \Device\NetBT_Tcpip_...
(From PChuck2)
Status for domain WORKGROUP on transport \Device\NetBT_Tcpip_...
   Browsing is active on domain.
   Master browser name is: PChuck2
       Master browser is running build 2195
   2 backup servers retrieved from master PChuck2
       \\PChuck1
       \\PChuck2
   There are 2 servers in domain WORKGROUP on transport \Device\NetBT_Tcpip_...
   There are 1 domains in domain WORKGROUP on transport \Device\NetBT_Tcpip_...

There are 2 problems indicated in the above example.

• Both PChuck1 and PChuck2 have elected themselves as master browsers.
  
• PChuck1 has the IPX/SPX protocol in its stack.
  

If all computers don't list the same master browser, you have a problem. You have three choices now.

• Ask for help.
  
• Troubleshoot the problem.
  
• Read more about the problem.
  

If browstat identifies the presence of either IPX/SPX or NetBEUI, and if you don't have one very special physical network setup, you need to cleanup your protocols.

>> Top

Error 53

(From PChuck2)
Status for domain WORKGROUP on transport \Device\NetBT_Tcpip_...
   Browsing is active on domain.
   Master browser name is: PChuck1
       Could not connect to registry, error = 53        Unable to determine build of browser master: 53
   \\\\PChuck1           .  Version:05.01  Flags: 51203 NT POTENTIAL MASTER
   1 backup servers retrieved from master PChuck1
       \\PChuck1
   There are 1 servers in domain WORKGROUP on transport \Device\NetBT_Tcpip_...
   There are 1 domains in domain WORKGROUP on transport \Device\NetBT_Tcpip_...

Browstat is trying to access the registry on the master browser. An error = 53 says that it can't resolve the name of the master browser. On small LANs, this problem is frequently caused by inconsistently set NetBT.

If the master browser is another computer, it can only do that thru the Remote Registry service. If the other computer is running XP Home (which doesn't have the RRS), or XP Pro with the RRS stopped, this error is normal. On any computer running XP Pro, make sure that the Remote Registry service is running - Started and Automatic.

If the master browser is running on a computer with XP Pro with the RRS running, or if it's running another operating system altogether, continue diagnosing. Since we see "Browsing is active on domain", plus a master browser is identified, we probably don't have physical connectivity issues, so concentrating on the logical issues would seem more productive.

There are other network components and services, which, if absent, will cause an error = 53.

>> Top

Error = 5
Here's a normal problem, which typically results from the browser server using Guest authentication.

Status for domain WORKGROUP on transport
\Device\NetBT_Tcpip_...
Browsing is active on domain.
Master browser name is: PChuck1
could not open key in registry, error=5  unable to determine build of browser master:5
\\\\PChuck1.  Version:05.01  Flags:  51203 NT POTENTIAL MASTER
1 backup servers retrieved from master PChuck1 \\PChuck1
   There are 2 servers in domain WORKGROUP on transport \Device\NetBT_Tcpip_...
   There are 1 domains in domain WORKGROUP on transport \Device\NetBT_Tcpip_...

With PChuck1 using Guest authentication, and with all other problems resolved, an "error = 5" is a normal condition. Since the only symptom here is the "error = 5" from the attempted registry access, more complex problems are less likely.

>> Top

Error 1130
Here's the IRPStackSize error.

Status for domain WORKGROUP on transport \Device\NetBT_Tcpip_...
    Browsing is active on domain.
    Master browser name is: PChuck1
        Master browser is running build 6000
    1 backup servers retrieved from master PChuck1
        \\PChuck1
    Unable to retrieve server list from PChuck1: 1130

>>Top

Unable Because Of Various Problems
Sometimes, you get very cryptic errors.

Status for domain WORKGROUP on transport \Device\NetBT_Tcpip_...
Browsing is active on domain.
Master browser name is: PChuck1
Could not connect to registry, error = 53 Unable to determine build of browser master: 53
Unable to determine server information for browser master: 64
1 backup servers retrieved from master PChuck1
\\PChuck1
Unable to retrieve server list from PChuck1: 121

In Troubleshooting browser Event ID 8021 and 8032 on master browsers, we are told to use "net helpmsg" to translate these mysterious error codes. Upon doing so for various values, we find some familiar translations.

C:\Documents and Settings\pchuck>net helpmsg 5
Access is denied.

C:\Documents and Settings\pchuck>net helpmsg 53
The network path was not found.

C:\Documents and Settings\pchuck>net helpmsg 64
The specified network name is no longer available.

C:\Documents and Settings\pchuck>net helpmsg 121
The semaphore timeout period has expired.

C:\Documents and Settings\pchuck>net helpmsg 1130
Not enough server storage is available to process this command.

>> Top

Not Active On Domain
And finally, sometimes you will get a very brief browstat log.

Status for domain WORKGROUP on transport \Device\NetBT_Tcpip_...
Browsing is NOT active on domain.
Master name cannot be determined from GetAdapterStatus.

The Browser depends upon Server Message Blocks (SMBs). SMBs can be blocked by inconsistent NetBT settings, and by personal firewalls, as well as the obvious physical networking problems.

If SMBs are blocked, you'll get this error from browstat, as well as seeing the symptoms that brought you to this web site. Make sure that NetBT is enabled on all computers.

Next, make sure that at least one computer on your LAN does NOT show this error in browstat, as you need at least one computer running as a browser. Having done that, you may wish to focus on all possible causes of the "error = 5" and "error = 53", eliminating the physical issues first. Using Troubleshooting Network Neighborhood Problems as a guide would be useful in this case. You may also benefit from reading The NT Browser....

>> Top