OK. Any or suggestions here would be good. Thanks in advance.

Intermittently, XP PCs take a couple of mins logging in, then a couple
logging off.

"Applying computer settings" at logon
"Running logoff scripts" at logoff

Searching forums suggest DNS issues, but what? I've switched logging
on for all areas on DNS servers, then searched the log for the IP
address of the affected PC.

This is one area that I have no idea what's going on. 10.1.1.31 is the
affected PC. What is the I.P address by "DATA" there for? It's a PC
across the WAN in a different country, which isn't even switched on.

Snd 10.1.1.31 247d R Q [8085 A DR NOERROR]
(11)company(20)company(3)com(0)
UDP response info at 013FB01C
Socket = 368
Remote addr 10.1.1.31, port 1026
Time Query=2615443, Queued=0, Expire=0
Buf length = 0x0200 (512)
Msg length = 0x0046 (70)
Message:
XID 0x247d
Flags 0x8580
QR 1 (response)
OPCODE 0 (QUERY)
AA 1
TC 0
RD 1
RA 1
Z 0
RCODE 0 (NOERROR)
QCOUNT 0x1
ACOUNT 0x1
NSCOUNT 0x0
ARCOUNT 0x0
Offset = 0x000c, RR count = 0
Name "(11)company(20)company(3)com(0)"
QTYPE A (1)
QCLASS 1
ANSWER SECTION:
Offset = 0x0036, RR count = 0
Name "[C00C](11)company(20)company(3)com(0)"
TYPE A (1)
CLASS 1
TTL 1200
DLEN 4
DATA 10.85.0.203
AUTHORITY SECTION:
ADDITIONAL SECTION:

"andymarbles" <andymarbles@googlemail.com> wrote in message
news:1168288168.752949.181820@q40g2000cwq.googlegr oups.com...
> OK. Any or suggestions here would be good. Thanks in advance.
>
> Intermittently, XP PCs take a couple of mins logging in, then a couple
> logging off.
>
> "Applying computer settings" at logon
> "Running logoff scripts" at logoff
>
> Searching forums suggest DNS issues, but what? I've switched logging
> on for all areas on DNS servers, then searched the log for the IP
> address of the affected PC.

DNS is commonly the cause of slow logon. (Less commonly
causes slow loggoff.)

Check that the (affected) client(s) are using STRICTLY your
INTERNAL DNS server (set) which can resolve your zone that
supports your AD. (i.e., Do NOT mix the ISP DNS server in
there on the NIC->IP properties which is a very common mistake.)

> This is one area that I have no idea what's going on. 10.1.1.31 is the
> affected PC. What is the I.P address by "DATA" there for? It's a PC
> across the WAN in a different country, which isn't even switched on.
>
> Snd 10.1.1.31 247d R Q [8085 A DR NOERROR]
....
> DATA 10.85.0.203

I don't know.

"andymarbles" <andymarbles@googlemail.com> wrote in message
news:1168292044.150448.49820@38g2000cwa.googlegrou ps.com...
>
> Herb Martin wrote:
>
> > Check that the (affected) client(s) are using STRICTLY your
> > INTERNAL DNS server (set) which can resolve your zone that
> > supports your AD. (i.e., Do NOT mix the ISP DNS server in
> > there on the NIC->IP properties which is a very common mistake.)
>
> Definitely two local internal DNS servers there.

Are they fully replicated?

Can all your DCs pass a full DCDiag with no WARN or FAIL
messages? (This is usually one of my first checks when I suspect
AD or DNS problems -- and periodically to catch problems before
they get noticed otherwise.)


--
Herb Martin, MCSE MVP
www.LearnQuick.Com

Herb Martin wrote:

> Check that the (affected) client(s) are using STRICTLY your
> INTERNAL DNS server (set) which can resolve your zone that
> supports your AD. (i.e., Do NOT mix the ISP DNS server in
> there on the NIC->IP properties which is a very common mistake.)

Definitely two local internal DNS servers there.

> I don't know.

Damn.

Manually removing a couple of DCs which weren't properly demoted and
decomissioned sorted it, we think. All seems to be improved anyway.


Thanks for the !