I am having an odd issue that I hope someone can help with. I have an older 32bit Windows Server 2003SP2 server that cannot access any shares on our 64bit Windows Server 2012R2 domain controller. The 2003 server can access shares on other 2012R2 servers fine, it is just the one server it has problems with. Also, the 2012R2 server can access shares on the 2003 server fine. There is no firewall or AV on the 2003 server but the 2012R2 server has both the firewall and Symantec Endpoint Protection installed on it. No other clients have problems access the 2012R2 server (although all the other machines access it are Win10/Win2012R2).
I have checked the event log on both machines and there are no messages. If I try and access a share with Windows Explorer, I get the error "Windows cannot find '\win2012R2\sharename'. Check the spelling and try again, or try searching for the item by clicking the Start button and then clicking search." If I try from the command line using NET USE, I get the error "System error 64 has occurred. The specified network name is no longer available". I can ping the 2012R2 server from the 2003 server fine. DNS lookups also work fine.
Is there some sort of SMB access logging I can look at?
EDIT:
I installed Wireshark and recorded the following traffic when from the 2003 server when trying to connect to the 2012R2 server:
No. Time Source Destination Protocol Length Info
6361 79.400489000 2003srvr.domainname.lcl 2012r2srvr.domainname.lcl TCP 62 12575->netbios-ssn [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1
Frame 6361: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0
Ethernet II, Src: Vmware_9b:7e:e5 (ff:ff:ff:9b:7e:e5), Dst: 192.168.112.6 (ff:ff:ff:9b:08:04)
Internet Protocol Version 4, Src: 2003srvr.domainname.lcl (192.168.112.10), Dst: 2012r2srvr.domainname.lcl (192.168.112.6)
Transmission Control Protocol, Src Port: 12575 (12575), Dst Port: netbios-ssn (139), Seq: 0, Len: 0
No. Time Source Destination Protocol Length Info
6363 79.400812000 2012r2srvr.domainname.lcl 2003srvr.domainname.lcl TCP 62 netbios-ssn->12575 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 SACK_PERM=1
Frame 6363: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0
Ethernet II, Src: 192.168.112.6 (ff:ff:ff:9b:08:04), Dst: Vmware_9b:7e:e5 (ff:ff:ff:9b:7e:e5)
Internet Protocol Version 4, Src: 2012r2srvr.domainname.lcl (192.168.112.6), Dst: 2003srvr.domainname.lcl (192.168.112.10)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: 12575 (12575), Seq: 0, Ack: 1, Len: 0
No. Time Source Destination Protocol Length Info
6364 79.400822000 2003srvr.domainname.lcl 2012r2srvr.domainname.lcl TCP 54 12575->netbios-ssn [ACK] Seq=1 Ack=1 Win=64240 Len=0
Frame 6364: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on interface 0
Ethernet II, Src: Vmware_9b:7e:e5 (ff:ff:ff:9b:7e:e5), Dst: 192.168.112.6 (ff:ff:ff:9b:08:04)
Internet Protocol Version 4, Src: 2003srvr.domainname.lcl (192.168.112.10), Dst: 2012r2srvr.domainname.lcl (192.168.112.6)
Transmission Control Protocol, Src Port: 12575 (12575), Dst Port: netbios-ssn (139), Seq: 1, Ack: 1, Len: 0
No. Time Source Destination Protocol Length Info
6366 79.400881000 2003srvr.domainname.lcl 2012r2srvr.domainname.lcl NBSS 126 Session request, to 2012R2SRVR<20> from 2003SRVR<00>
Frame 6366: 126 bytes on wire (1008 bits), 126 bytes captured (1008 bits) on interface 0
Ethernet II, Src: Vmware_9b:7e:e5 (ff:ff:ff:9b:7e:e5), Dst: 192.168.112.6 (ff:ff:ff:9b:08:04)
Internet Protocol Version 4, Src: 2003srvr.domainname.lcl (192.168.112.10), Dst: 2012r2srvr.domainname.lcl (192.168.112.6)
Transmission Control Protocol, Src Port: 12575 (12575), Dst Port: netbios-ssn (139), Seq: 1, Ack: 1, Len: 72
NetBIOS Session Service
No. Time Source Destination Protocol Length Info
6368 79.401133000 2012r2srvr.domainname.lcl 2003srvr.domainname.lcl NBSS 60 Positive session response
Frame 6368: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Ethernet II, Src: 192.168.112.6 (ff:ff:ff:9b:08:04), Dst: Vmware_9b:7e:e5 (ff:ff:ff:9b:7e:e5)
Internet Protocol Version 4, Src: 2012r2srvr.domainname.lcl (192.168.112.6), Dst: 2003srvr.domainname.lcl (192.168.112.10)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: 12575 (12575), Seq: 1, Ack: 73, Len: 4
NetBIOS Session Service
No. Time Source Destination Protocol Length Info
6369 79.401226000 2003srvr.domainname.lcl 2012r2srvr.domainname.lcl SMB 191 Negotiate Protocol Request
Frame 6369: 191 bytes on wire (1528 bits), 191 bytes captured (1528 bits) on interface 0
Ethernet II, Src: Vmware_9b:7e:e5 (ff:ff:ff:9b:7e:e5), Dst: 192.168.112.6 (ff:ff:ff:9b:08:04)
Internet Protocol Version 4, Src: 2003srvr.domainname.lcl (192.168.112.10), Dst: 2012r2srvr.domainname.lcl (192.168.112.6)
Transmission Control Protocol, Src Port: 12575 (12575), Dst Port: netbios-ssn (139), Seq: 73, Ack: 5, Len: 137
NetBIOS Session Service
SMB (Server Message Block Protocol)
No. Time Source Destination Protocol Length Info
6371 79.401507000 2012r2srvr.domainname.lcl 2003srvr.domainname.lcl TCP 60 netbios-ssn->12575 [RST, ACK] Seq=5 Ack=210 Win=0 Len=0
Frame 6371: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Ethernet II, Src: 192.168.112.6 (ff:ff:ff:9b:08:04), Dst: Vmware_9b:7e:e5 (ff:ff:ff:9b:7e:e5)
Internet Protocol Version 4, Src: 2012r2srvr.domainname.lcl (192.168.112.6), Dst: 2003srvr.domainname.lcl (192.168.112.10)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: 12575 (12575), Seq: 5, Ack: 210, Len: 0
Maybe someone with more SMB knowledge can help but it looks like the 2003 server is closing the connection after trying to negotiate the protocol.
Best Answer
This does sound like a possible SMB issue. Yes there is SMB logging. You want to look in Event Viewer on both file servers and filter by Event ID. There are five Event IDs related to SMB. The Event IDs are 2011 2022 2504 2505 and 2506.
https://technet.microsoft.com/en-us/library/dd364961(v=ws.10).aspx
You should make sure that you have a common version of SMB enabled (in your case you need SMB1 enabled because you are using a Windows Server 2003 platform).
You can change the version of SMB the server uses in HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters by setting the value data to "0" (disable) or "1" (enable) for the value name SMB1 or SMB2.
Your Wireshark logs appear to indicate the two servers are not able to negotiate a common SMB version. If that is the cause then enabling SMB1 on the 2012 server should get things working.
https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012