Severe "Net Logon" Service Issues

[Punkrulz]

I have been trying to track this problem down to a specific source, and I think I'm really close to it now. We have been having the following problems:

1) When logging into a computer, it states that it can't map the network drives.
2) Computer is not applying some or all of the group policy objects.
3) When Error #1 occurs, another noticible problem is that you are completely unable to change the domain. Sometimes you can't click the Rename option... sometimes you can, but then you can't select workgroup or domain.
4) Computers are entirely unable to browse network. I attempted to connect to another share, and it kept asking me for a login box. I was using Administrator credentials, and even when typing them again it wouldn't allow it.

All 4 of these problems, and I actually believe there are more, can all be resolved simply by restarting the "Net Logon" service. 95% of the time it is in fact started, however restarting the service corrects ALL of these problems. Is there a way to update the service per se, or perhaps restore the service to it's original function? I don't know how these problems are sporratically spreading, but they are to a select few computers. There is no rhyme or reason to it.

 

[Punkrulz]

Does anyone have any ideas? This is a severe problem.

 

[kcnychief]

Rather interesting indeed. I would try running WinsockXPFix and see what happens. The TCP/IP stacks may also be corrupted, but that would be odd on multiple boxes.

Any errors in the event viewer?

 

[j79zlr]

If the winsock was damaged there would be no connectivity at all. I would search through the event viewer and see what errors are occurring. Could be the DC acting funny if this is randomly happening across the network.

 

[Punkrulz]

On the machine, the only errors that I had noticed were:

Crypt32
userenv
DCOM

I already have links to try and resolve those errors tomorrow at the client. I would investigate now, but unfortunately with the current problem the machine doesn't show up on Net view, you can't see it's name, and most of all you can't connect to it with RDP.

Something else I find funny, in WSUS, I know one of the machines that is having a problem is reporting the wrong IP address. I believe the machine is either .28, or .12. Ping -a reveals their name... but on WSUS they both say their IP address is .6 which is the ISA Server.

I am just curious... do you guys think that if I completely remove the networking information, protocol, and let windows reinstall it... will that help? If you feel so, what is the best way to do that, step by step? Please be specific!