MCSA/MCSE Troubleshooting 20 Questions

I have an idea for a thread I think you guys will like. Back in the day I was jr. instructor at a company that offered classes for the MCSA/MCSE exams. One of the things I did, which the students really enjoyed, was to play a game similar to 20 questions. I would take situations from real life and the students would ask questions until they were able to figure out the solution to the problem. I think this a very good way for more experienced people to share with those who might be coming up through the ranks.
Here are the rules:
1. Be respectful of less experienced members. Do not spout out answers just because you think you know what is going on.
2. Ask questions before you offer an answer. ONE QUESTION AT A TIME.
3. Wait 24 hours after your last question, before you post a solution.
4. Post your question with a link to the original problem as a quote.
5. Read all the questions posted by other members so you don’t duplicate efforts.
6. If you have an example problem please PM me. I will post your problem and then you will be in charge of responding to questions.
I will begin with an example situation and a typical question.

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

RobertKaucher

You are the IT support for a small company with around 100 client PCs. There are two sites. One is the Corporate headquarters and the other is the warehouse facility/maufacturing plant. You are the lead in the IT department which consists of you and a part-time intern. It is 8:00 AM. You receive a call from a user in the office stating she cannot get online. What do you do.

RobertKaucher

RobertKaucher wrote: »

You are the IT support for a small company with around 100 client PCs. There are two sites. One is the Corporate headquarters and the other is the warehouse facility/maufacturing plant. You are the lead in the IT department which consists of you and a part-time intern. It is 8:00 AM. You receive a call from a user in the office stating she cannot get online. What do you do.

Can I ping www.google.com?

RobertKaucher

RobertKaucher wrote: »

Can I ping www.google.com?

Pings to google fail.

SteveO86

RobertKaucher wrote: »

Pings to google fail.

Did the ping timeout or did it not resolve the name google.com?

CT06

Are other users experiencing the same problem?

Psoasman

RobertKaucher wrote: »

Can I ping www.google.com?

Can she ping the loopback?

willhi1979

Results of IPConfig /all?

Jack2

willhi1979 wrote: »

Results of IPConfig /all?

agreed also check:

Can you get to other network resources on the network? Check DHCP address is it on the right network segment?

Check the default gateway and that you have working DNS internally and externally.. "nslookup google.com"

The least common denominator question if you computer worked would be: Is her computer turned on? but are you really going to go there first.. I have seen it though lol :P

RobertKaucher

SteveO86 wrote: »

Did the ping timeout or did it not resolve the name google.com?

Unresolved. Very good question.

CT06 wrote: »

Are other users experiencing the same problem?

You sent the ping from your PC. So presumably, yes. Another good question.

apena7

Since other users are having the same problem, did I or the part-time intern make any recent changes overnight?

RobertKaucher

willhi1979 wrote: »

Results of IPConfig /all?

On which PC?
Yours looks like this. You are also in the main office.

 Physical Address. . . . . . . . . : 00-24-D2-34-6E-BA
 DHCP Enabled. . . . . . . . . . . : Yes
 Autoconfiguration Enabled . . . . : Yes
 IPv4 Address. . . . . . . . . . . : 192.168.1.101(Preferred)
 Subnet Mask . . . . . . . . . . . : 255.255.255.0
 Lease Obtained. . . . . . . . . . : Saturday, January 22, 2011 5:46:22 PM
 Lease Expires . . . . . . . . . . : Monday, January 24, 2011 8:53:38 PM
 Default Gateway . . . . . . . . . : 192.168.1.1
 DHCP Server . . . . . . . . . . . : 192.168.1.4
 DNS Servers . . . . . . . . . . . : 192.168.1.5
 NetBIOS over Tcpip. . . . . . . . : Enabled

Jack2 wrote: »

agreed also check:

Can you get to other network resources on the network? Check DHCP address is it on the right network segment?

Check the default gateway and that you have working DNS internally and externally.. "nslookup google.com"

The least common denominator question if you computer worked would be: Is her computer turned on? but are you really going to go there first.. I have seen it though lol :P

Ping to DFG returns (192.168.1.1)
NSLOOKUP times out

Do you guys have a set of external IPs that you ping in cases like this? I always use 8.8.8.8, which is one of Google's public DNS servers.

So far so good. We are starting to get to the issue.

RobertKaucher

Psoasman wrote: »

Can she ping the loopback?

Yes. In the real situation I did not ask this question as I was also experiencing the issue.

SteveO86

RobertKaucher wrote: »
On which PC?
Yours looks like this. You are also in the main office.
 Physical Address. . . . . . . . . : 00-24-D2-34-6E-BA
 DHCP Enabled. . . . . . . . . . . : Yes
 Autoconfiguration Enabled . . . . : Yes
 IPv4 Address. . . . . . . . . . . : 192.168.1.101(Preferred)
 Subnet Mask . . . . . . . . . . . : 255.255.255.0
 Lease Obtained. . . . . . . . . . : Saturday, January 22, 2011 5:46:22 PM
 Lease Expires . . . . . . . . . . : Monday, January 24, 2011 8:53:38 PM
 Default Gateway . . . . . . . . . : 192.168.1.1
 DHCP Server . . . . . . . . . . . : 192.168.1.4
 DNS Servers . . . . . . . . . . . : 192.168.1.5
 NetBIOS over Tcpip. . . . . . . . : Enabled
Ping to DFG returns (192.168.1.1)
NSLOOKUP times out

Do you guys have a set of external IPs that you ping in cases like this? I always use 8.8.8.8, which is one of Google's public DNS servers.

So far so good. We are starting to get to the issue.

If we change the DNS server on our local PC to 8.8.8.8 are we able to successfully ping google.com now?

(After seeing the name resolution error from the first ping command I would already be Pinging and/or RDPing into my DNS Server verifying the server is up and service is running)

Can I successfully RDP into my DNS server?
If no can I ping it successfully?
If yes is the DNS Service running?

(Maybe another rule should be added limiting the amount of questions a person can ask?)

RobertKaucher

SteveO86 wrote: »

If we change the DNS server on our local PC to 8.8.8.8 are we able to successfully ping google.com now?
...
Can I successfully RDP into my DNS server?
If no can I ping it successfully?
If yes is the DNS Service running?

(Maybe another rule should be added limiting the amount of questions a person can ask?)

Yes.
No.
No.
N/A

Let's see how it goes.

Anyone got a situation to share? PM me and we can start on that. This should be done soon.

Jack2

RobertKaucher wrote: »

Yes.
No.
No.
N/A

Let's see how it goes.

Anyone got a situation to share? PM me and we can start on that. This should be done soon.

Can you get to Google by an IP address?

If you can ..

Internal DNS services are DOWN! Is there a secondary internal DNS server on the network? Why not. Or even an external?

SteveO86

Just for the sake of learning I attached 2 screen shots..

The first one is a ping to google.com with the pings timing out.. However it does resolve the name to an IP address.

The second screen shot is a ping to google.com with a bad DNS server entry, notice the results are different, and it does not resolve the name to the IP address and also advises you to check the name your are trying to ping. At that point you could probably skip using NSLookup and jump right into DNS. (If a ping did not resolve the name then DNS Server can not find the name, or the server is unavailable).

So ping can give you a bit more information then just normal connectivity tests.

PingTimeOut.JPG

PingDNSError.JPG

Bl8ckr0uter

SteveO86 wrote: »

Just for the sake of learning I attached 2 screen shots..

The first one is a ping to google.com with the pings timing out.. However it does resolve the name to an IP address.

The second screen shot is a ping to google.com with a bad DNS server entry, notice the results are different, and it does not resolve the name to the IP address and also advises you to check the name your are trying to ping. At that point you could probably skip using NSLookup and jump right into DNS. (If a ping did not resolve the name then DNS Server can not find the name, or the server is unavailable).

So ping can give you a bit more information then just normal connectivity tests.

The screenshot for a bad entry produces the same result as a host without an ip address. Interesting.

Also today I found out that even if you have no ip address and all adapters are disabled, you can still ping 127.0.0.1. I just thought that was interesting.

michaelcox

I'd most likely have them reboot their computer first and then call me back if its still not working.

Assuming its not:

first, have them do an IPConfig /all

from there, have them ping the default gateway.

then, ping 8.8.8.8

then, ping (the companies website)

if all are fine and its still not working, check Proxy server settings in web browser.

RobertKaucher

Jack2 wrote: »

Can you get to Google by an IP address?

If you can ..

Internal DNS services are DOWN! Is there a secondary internal DNS server on the network? Why not. Or even an external?

Partial answer - not accepted.

What does internal DNS is down mean?

If clients began to use an external DNS server, how would they resolve locally based names? Having the secondary DNS server set to an external DNS system is not a good practice. Some clients can actually begin to prefer the configured secondary server if it begins to respond to queries faster than the primary. And if the client receives a negative answer (domain does not exist -for example) it will not check with another DNS server just to be sure.

RobertKaucher

michaelcox wrote: »

I'd most likely have them reboot their computer first and then call me back if its still not working.

Assuming its not:

first, have them do an IPConfig /all

from there, have them ping the default gateway.

then, ping 8.8.8.8

then, ping (the companies website)

if all are fine and its still not working, check Proxy server settings in web browser.

Before you pass something off on your customer ensure that you understand what they are reporting. It takes two seconds for you to ping an external host. If you can get online, that's one thing. If your ping has issues then you can move on. Assuming the customer is the issue and not gather informatioon will never win you stars.

willhi1979

RobertKaucher wrote: »

On which PC?

The User's PC who is experiencing the problem.

SteveO86

Bl8ckr0uter wrote: »

Also today I found out that even if you have no ip address and all adapters are disabled, you can still ping 127.0.0.1. I just thought that was interesting.

I've always heard the loopback address 127.0.0.1 will always respond as long as the TCP/IP suite/protocol is installed (and not corrupt) on a windows device. A small way a testing TCP/IP.

To continue the discussion.. We have verified I can not RDP or even ping the primary DNS server the next step in my opinion is look physically at the box. (Unless I have proper network documentation and I know what switch/port the DNS is plugged into and verify the port it up.)

So my next set of questions:

Is the switchport the DNS Server is connected to up? (what state is the port in - Down/Err-Disabled/Up/AdminDown)
Moving physically to the DNS Server is it powered on?
If yes check the ethernet cable.
Do we have a link light?
Is it plugged in?
If not power it on. Verifying it is plugged into the wall or a properly working battery backup/UPS.

RobertKaucher

SteveO86 wrote: »

I've always heard the loopback address 127.0.0.1 will always respond as long as the TCP/IP suite/protocol is installed (and not corrupt) on a windows device. A small way a testing TCP/IP.

That is true. All it tells you is that TCP/IP is functioning. The ping does not even exit onto the wire.

We have found the greater issue. DNS server is not responding to pings, not responding to NS queries.

What's next?

Asif Dasl

Facebook is blocked on the firewall? No?

RobertKaucher

SteveO86 wrote: »

I've always heard the loopback address 127.0.0.1 will always respond as long as the TCP/IP suite/protocol is installed (and not corrupt) on a windows device. A small way a testing TCP/IP.

To continue the discussion.. We have verified I can not RDP or even ping the primary DNS server the next step in my opinion is look physically at the box. (Unless I have proper network documentation and I know what switch/port the DNS is plugged into and verify the port it up.)

So my next set of questions:

Is the switchport the DNS Server is connected to up? (what state is the port in - Down/Err-Disabled/Up/AdminDown)
Moving physically to the DNS Server is it powered on?
If yes check the ethernet cable.
Do we have a link light?
Is it plugged in?
If not power it on. Verifying it is plugged into the wall or a properly working battery backup/UPS.

OK, new rule. One question at a time.

I'm going to give a little more time before I answer these.

SteveO86

No rush.. I was going to exclude myself after my last set of questions.

Bl8ckr0uter

SteveO86 wrote: »

I've always heard the loopback address 127.0.0.1 will always respond as long as the TCP/IP suite/protocol is installed (and not corrupt) on a windows device. A small way a testing TCP/IP.

As have I. I guess when I heard "TCP/IP stack" I also assumed it did some sort of "hardware ping" of the actual devices as well (ethernet port, driver, etc). So basically 127.0.0.1 doesn't care about the physical device as well, which means it could be totally missing from the machine and it could come back just fine.

RobertKaucher

I believe you need some sort of adapter - either physical or virtual.

Bl8ckr0uter

RobertKaucher wrote: »

I believe you need some sort of adapter - either physical or virtual.

Sounds like something to test out tonight.

rsutton

RobertKaucher wrote: »

We have found the greater issue. DNS server is not responding to pings, not responding to NS queries.

Is the server powered on?