Strange Win7 Networking Problem - No Internet but no Indications (wired ethernet)

geobrick

Distinguished
Feb 5, 2006
18
0
18,510
I have multiple computers and other internet enabled devices (Logitech radios, irrigation controllers) on a wired Ethernet network at home using the Actiontec mi424 rev c router provided by Verizon. It's been working fine this way for years. All the computers are running Win7 Ult x64. Recently, two of the computers that typically run 24/7 (one used as a Media Center PC and the other used for general use) would lose internet access every 4-5 days without any indication on the PC. No networking problems indicated in the task bar. All the IP configurations looked good. Rebooting corrects the problem for another 4 to 5 days. It doesn't happen to both computers at the same time.

Here's where it gets strange:
I can see and access the problem PCs from other computers on the network through windows explorer. I can also ping the problem PCs from the other computers on the network. I cannot however see the other network computers using windows explorer on the problem PCs but I can ping them from a cmd prompt. No critical errors or warnings seem to point to any problem. The network and sharing center show everything is connected properly (home network). The network mapping shows the connection through switches to the router and through to the internet without any indication of a problem.

Other inconsistencies: I cannot access the router (192.168.1.1) from the problem PCs but when I access the router from other PCs, I can see the settings for the problem PCs and they seem fine (correct IP etc). I can also ping the problem PCs from the router's built in ping test without any problems.

When this condition occurs, the problem PCs can't access any outside websites (using Chrome or IE) but I can ping various sites (www.google.com and 8.8.8.8 and www.verizon.net) from a cmd prompt so it seems to be resolving the ip addresses. The only thing that seems to correct the problem temporarily (for another 4 to 5 days) is a reboot. I've tried all types of network resets but I'm open to any suggestions. It’s almost as if some required service has stopped running.

I've been living with the problem for about 4 months. Any help would be appreciated. Without a solution my options are to 1) set up an auto reboot every 4 days or maybe try reinstalling Windows.

I can provide the individual PC specs but I don't think there's any information to gain from that. They're both home built PCs using ASUS or Gigabyte motherboards with Intel chipsets and processors. I've tried both the built in LAN ports and an add on card (an Intel EXPI9301CT). I've tried virus scans (MS Security Essentials), Malwarebytes, adwcleaner and everything seems clean. The built in windows firewall is off. I can provide the details of the PCs if anyone thinks it would help.
 
Geobrick,

Interesting....

Are both PCs (24/7) on the same switch? Just for the record.

Windows 7 Ult update issue maybe...especially one targeted to networking.

The 4 to 5 day reoccurence is the key symptom - just need to see if that time frame can be made more specific.

What happens if you leave another one of the Win7 Ult 64 PC's on line (24/7) for 4 to 5 days - same problem? Could verify something in a Windows7 Ult 64 update. Could be messy going back 4 months to see what updates were applied and what they supposedly fixed or otherwise did.

Can you monitor the bytes sent and received on those two systems via the Resource Monitor and "View status of this connection" via "Network Connections". See if there is some unusual amount of traffic specific to those two systems.

What about a registry cleaner such as CCcleaner? Try it on one affected PC (after the appropriate registry backup of course) and see if the problem ends.

It seems that, although annoying, you have the "leisure" so to speak to spend some time looking into a solution.

Reinstall could be a solution but I suggest that as a last resort and (initially) only on one of the affected systems to be sure that a reinstall will really permanently solve the problem.




 


Ralston18,
The two problem PCs aren’t on the same switch, but all PCs eventually lead to the same switch before connecting to the router. The problem PCs are connected to switches with other devices that don't lose their connection. On the switch with the media center PC there's a TV, ReplayTV, BluRay player, and a Roku 3. On the other switch, there's an HP Network Connected Printer, a Silicon Dust HD Home Run Prime, a Wi-Fi access point and another PC). The 2nd PC on that switch (which has not shown these symptoms) is also on 24/7 running Logitech's Media Server. That machine was recently upgraded about 3 weeks ago and now also runs Win7 Ult x64 (but the problem I'm describing started back in December well before that change was made). That new PC may be able to be used to compare what's going on with the others since it’s also running 24/7 but I haven’t seen this problem affect that PC yet.

The PC used as a Media Center has a relatively large amount of traffic on it because it's used as a DVR to record HD TV from the Silicon Dust HD Home Run Prime tuner over Ethernet and it then serves that data over ethernet to an xbox 360 used as a media center extender. So there is a lot of traffic on that PC but the other PC with the problem is just used for day to day things and the only reason it’s on 24/7 is my wife never shuts it down (until the problem arises and she reboots to correct it).

A few things I have tried over the last few months without success are ‘netsh winsock reset catalog’, ‘netsh int ip reset’, setting up static IPs for the problem PCs, disable and re-enable the network card, disconnect then reconnect the Ethernet cable, and bypassing the switch (not sure if I tried resetting the router to see if the connection gets re-established). I did reset the router a few times to see if it would prevent the problem but that didn’t help. I once suspected the router but I can’t see how the router would prevent the problem PCs from accessing other PCs shared folders. The home network should be self-contained once the IPs are set up.

I'll look at the task scheduler to see what if anything is scheduled at that interval. I've looked at the event log but it's hard to correlate any of the log entries with the problem. It seems a lot of the warnings and errors are because the problem occurred and are not the cause of the problem itself.
 
Geobrick,

Thanks.

Please take a look at the following two postings within this forum:

1)

http://www.tomshardware.com/answers/id-2648781/connected-internet-browsers-work-router-problem.html

2)

http://www.tomshardware.com/answers/id-1735863/ping-browse.html

The first link is new and just posted yesterday (5/17) - similiar situation so you might wish to follow that thread.

The second link is over a year old and again addresses a similiar situation. It is a lengthy thread but there are a variety of solutions presented. Some worked for some people and but not for others.

Your efforts have been pretty thorough but maybe there will be something else within that 2nd thread that will directly solve the problem or identify another path to a solution. You might notice something and have an "Ah ha!" moment. Hope so....

The log entries could still provide some insight. Look for entries prior to all of the resulting warnings and errors. Sort the log entries by event and look for a group of identical events appearing about 4 to 5 days apart.

Compare the logs from both affected systems to see if some comon service is starting or stopping. And the router's log might help by noting failed attempts to connect. Did those failures occur at a corresponding time?

Please post any new findings. Someone could well spot a key clue and provide the applicable solution. Thanks.




 


Thanks, I'll take a look at those threads. The problem I’ve had with some solutions is they require a reboot but rebooting always fixes the problem (temporarily) so it could be days before I would know if it worked.

It happened again today on the media center PC. The only thing I suspect in the event log is:
Event ID: 10010 DistributedCOM

Here are details.
*****************
Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 5/19/2015 12:03:02 AM
Event ID: 10010
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Media-Server
Description:
The server {AAC1009F-AB33-48F9-9A21-7F5B88426A2E} did not register with DCOM within the required timeout.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="49152">10010</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-05-19T07:03:02.000000000Z" />
<EventRecordID>215367</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>Media-Server</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">{AAC1009F-AB33-48F9-9A21-7F5B88426A2E}</Data>
</EventData>
</Event>
************************
 
Hello Geobrick,

Seems to be a good suspect.

In the interest of "full disclosure" I certainly do not have an answer per se. However, doing some research (as I expect you are also doing) has revealed that DCOM 10010 errors are not all unknown and have been around for quite awhile. Nothing new there and not helpful in itself.

However here is a link that goes into quite a bit of detail about the error and a possible solution:

https://windoh.wordpress.com/2012/05/30/dcom-timeout-error-tstheme/

The link offers two things that I personally like to see: 1) some explanation, albeit overwhelming in this case, and 2) a "possible" fix. (My quotes. There may be some other detail or circumstance that ultimately makes the solution moot. No way to tell from here.)

Within the explanation and just after Figure 14 are some comments about user logons causing the error but not always! Media Server certainly would be subject to various user logins as I understand your environment.

Not sure how comfortable you are with registry editing. If you do try a registry edit then be sure to back up the registry beforehand. Maybe a full system backup if you can.

Probably would not hurt to continue watching the event log and do some additonal tracking of the error's occurrence and reoccurence. Watch the date/time stamps and see if they correspond to activity by any particular user(s) or other system/network activities. I see no rush to attempt a permanent fix despite the annoyance of it all. Further monitoring will help establish both the true nature of the problem and a viable fix. Especially if a registry edit is needed. Or maybe some other less intrusive configuration "tweak".

What do you think?

 
Ralston18, Seems like a good approach overall. The links in your previous post seem very similar to what is happening. I plan to try some of those things.

It happened again yesterday and we can rule out the DCOM 10010 error. It didn't occur in the last 24 hours but this did...

Log Name: System
Source: BROWSER
Date: 5/20/2015 4:37:52 AM
Event ID: 8032
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Media-Server
Description:
The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{BCA71AE3-8F5C-441A-97C3-48642C07D974}. The backup browser is stopping.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="BROWSER" />
<EventID Qualifiers="49152">8032</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-05-20T11:37:52.000000000Z" />
<EventRecordID>215729</EventRecordID>
<Channel>System</Channel>
<Computer>Media-Server</Computer>
<Security />
</System>
<EventData>
<Data>\Device\NetBT_Tcpip_{BCA71AE3-8F5C-441A-97C3-48642C07D974}</Data>
<Binary>40000000</Binary>
</EventData>
</Event>
 
Geobrick,

Does the other problem PC show any similiar errors? Could be a back and forth issue. A fix works for awhile and then finds a conflict with the other device(s). Fix that and then a new conflict pops up.

I googled "transport \Device\NetBT_Tcpip" and found the following link to Microsoft.

https://support.microsoft.com/en-us/kb/135404

Seems to be a fairly good match with respect to problem and solutions. Just not sure which resolution would be specifically applicable to your home setup and network configuration (i.e. subnets etc.). Windows 64 is not mentioned per se ("other operating systems") but you should be able to at least run through the various cmd line methods and see if something obvious pops up. Or at least be led to another more targeted KB link.

Narrowing it all down I think. Keep posting. Thanks.

















 
The same event log errors are on the other problem PC as well but I haven't been as concerned about that one so I haven't been able to verify if the event is correlated to the problem.

I did stumble on this error as a possibility about a month ago but I really don't understand the descriptions and causes mentioned in the link you provided.

What does the following mean?
This problem may occur when the following conditions are true:
•Your computer is a multihomed computer.
A multihomed computer links at the same time to two or more subnets by using multiple network cards.
•Your computer is a master browser.
•Your computer is running the TCP/IP protocol.

What is a multihomed computer?
What is a "Master Browser?

I'll read more in the meantime.
 
Geobrick,

A bit pressed for time today but did want to give you at least some partial response.

From Wikipedia: "Multihoming refers to a computer or device connected to more than one computer network. It can be used, for example, to increase the reliability of an Internet Protocol network, such as a user served by more than one Internet service provider."

There are some good examples and diagrams on the internet if you search "multihoming". I think that if you had intentionally set up multihoming you would have mentioned that somewhere along this thread.

Wikipedia also has a good definition of Master Browser. Will not cut and paste the defiinition into this answer mainly in the interest of immediate brevity. There are other sites with definitions/explanations that will show up via your search engine.

I have started to wonder about home entertainment systems/networks such as you have - seems that this intermittent loss of internet crops up a bit more often in those environments.

In a complex multi-user, multi-device, wired and wireless environment a lot of things have to happen for it all to play nice. Some devices, it seems to me, always want to be the "one ring", at least by default initially. Also always wonder about those entertainment boxes "phoning home"....

Also have a side question for you: you mentioned having a switch and irrigation controllers. I had brief series of exchanges sometime back with someone having problems with switches and irrigation controls. Would not work when one of the switches was physically connected elsewhere in the network - never resolved to my knowledge. Do not know where you live but does the error timing correspond with the water cycling to any extent? Have a feeling that you would have noticed that but have to ask. What make and model switches are you using? Managed (i.e., you configure them) or unmanaged (you just plug them in)? Older switches can bottleneck traffic.

If, during times of high traffic, some device bottlenecks the data flows and then device X cannot find/see/communicate with device Y then device X can lose its connectivity. A DHCP client, not finding the router, will reconfigure itself to a IP address range reserved for Microsoft. [APIPA, Automatic Private IP Addressing) is a Windows OS feature. When a router (or some other device issuing IP addresses) is found, then the device gets a DHCP address and is back in the network again but maybe just not to the intended network or subnet. Then the path to the internet is lost.

Anyway will push on and add more later. Need to go back and look over a couple of other things. Attempting to be brief but the nature of the beast is not in our favor.


 




With regards to the last 2 questions above, the irrigation controllers have been on the network for over 3 years so I don't really suspect them as being the issue.

The switches used around the house are all unmanaged 4 and 8 port netgear gigabit switches used when several devices are in one area. Then I have one 16 port cisco unmanaged gigabit switch where everything comes together before going to the Verizon Actiontec router.

This info could be helpful. The problem started when my media center PC motherboard died and I replaced it with a very similar MB and windows booted without any issues (other then discovering this network problem weeks later).
 


I did some reading about the Master Browser but I don't see how it applies to my network set up. I don't have a domain or windows server on the network. All computers are set up in the same workgroup called 'home' and are all on the same subnet. I have the homegroup set up on each computer as well but that's not something I did recently.
 
Geobrick,

Good - simplifies things.

What I am finding is that you may have two machines squabling over who is the browse master and specifically name resolutions. Have a bunch of questions but working towards keeping this thread as concise as possible and not a wide-ranging "shotgun" approach....

1) Can you verify that none of your computers have established themselves as a member of "Homegroup"?

2) In Event Viewer > Windows Logs > System

do you seen any errors reading something like "The browser has forced election on network......"? Especially on a wireless computer if you have any.

There are two CMDs to help identify what machine is the master. 1) nbstat and 2)browstat.exe. [MS utiliity] They may or may not be on your servers. The latter is apparently downloadable; however, I am not sure that its use is applicable in Windows 7. Either one may prove very helpful.

Mostly interested in the Event Logs right now. The errors will provide further direction. Thanks.
 
Update: 1st CMD is actually "nbtstat" - picked up a typo from another document.

If you go into CMD mode as administrator and type "net view" you should get a list of the devices on your network.

Then if you use "nbtstat -a DEVICENAME where DEVICENAME is the name of one of the listed devices you should be able to go through the list and find which device is the Master Browser. You will see _MSBROWSE_ along with the MAC for that machine.
 
Re: Master Browser....

Here is the link to one of the articles I have been using as a reference:

http://scottiestech.info/2009/02/14/how-to-determine-the-master-browser-in-a-windows-workgroup/

Original date is some years back but there have been some updates.

As I read I keep going back to your sentence " I cannot however see the other network computers using windows explorer on the problem PCs but I can ping them from a cmd prompt."

Pinging shows connectivity - not seeing the other network computers make me think that they are not able to communicate with each other. Your reboots force "an election" per the linked article and all is well again for 4 to5 days.

Having only one workgroup and no subnetting makes it all more straightforward.

Using net view and nbtstat to look into your network a bit deeper is just to verify that all devices are really as you expect (E.g, workgroup "home" membership). If some device is not as expected then look at its' event logs for errors or possible notice that some service (as you originally mentioned) may have stopped.

Please let me know if I may be going off track - just following things into the swamp....




 
Ralston18, Your last 3 posts are exactly what I was doing (based on the links you provided earlier). I started down the path of looking for the master browser on my network using nbtstat -a <PC Name> and found it to be the PC called "Zone". It's the one my (teenage) kids share and is almost always running 24/7. They've setup multiplayer games in the past so I'm pretty sure it's running services that none of the other PCs in the house are running. And because the kids use it for 'who knows what', it's the PC most likely to download malware etc so I have the firewall and active MS Security essentials running and we still have to clean it up every once in a while (MSSE scans, malwarebytes, adwcleaner). I'm also pretty sure that's the PC that's considered the Homegroup lead if there is such a thing (I remember setting up the homegroup on other PCs and it would say "go to "zone" to find the homegroup password).

I'll look at the event viewer as you suggest to see if any PC shows "The browser has forced election on network". I was also considering setting the media-center PC as the master browser by adjusting something in the registry based on something I read. Before I do that. I'll look more closely at the zone PC.

Could the 8032 error I see in the log when the PCs exhibit the connection problem be a symptom of the problem and not the cause? For example, if the computer lost its connection, it would also lose its access to the master browser. Would losing access to the master browser result in the PC not being able to see the other PCs or prevent IE or Chrome from loading web pages?
 
Hello Geobrick,

More and more interesting: do any of the multi-player games use VPN? That can set up multi-homing if I read something correctly.

If file and printer sharing is getting turned off somewhere that can cause problems as well. I have run into problems on my network when some computer somehow joins homegroup. (Not using homegroup at all just for the record.)

Also saw something about forcing a master browser but there was some caution about doing that.

When I ran nbtstat -a "myroutersname" it came up as _MSBROWSE_ Does that happen on your network?

The 8032 error is a consequence of the problem with the problem being (I think) internal "confusion" between network devices about who, if anyone, is keeping the list of who is who respect to device names and assigned IP addresses.

If anything I have found that your situation is quite common in many ways and there are always different fixes because there are so many possible configurations/mis-configurations, changes within the OS, how NetBIOS is used, typos in subnet masks. Endless.... Name resolution is a complex process.

In the error message regarding Event ID 8032 (on Media Server) there is a long string of letters and numbers following "\Device\NetBT_tcpip". I was curious about that string and found that it represents the GUID (Globally Unique Identifier) of a network adapter.

Do not know if that is the adapter GUID for Media-Server, Zone, or some other computer. Anyway that adapter is somehow involved with the 8032 error and my question is: is that the adapter trying to get the backup list or is that the adapter where the list is supposed to be, i.e., another computer? If the latter - what computer? Felt that knowing the answer could be useful.

After some digging around (not fun in a swamp) I found you can get a computer's network adapter GUID by going to CMD and entering

"netsh lan show interfaces".

However you must first go into services.msc and start Wired Auto Config if it is not running. Tested it all here and worked okay on my computer.

Are you familiar with nmap? It has some --traceroute options that might interesting to run on your network. See specifically who and who not can be found. You mentioned network mapping showing connections through switches, etc. Does the mapping show the assigned IP's?

Will keep exploring on this end as circumstances permit. Will respond likewise. Take care.
 
I'm in the process of running down some of the suggestions you made. I tried running "netsh lan show interfaces" on another computer (with Wired Auto Config running) and it came up with a number different than the number from the problem PC above. I'll try doing the same on the media-center pc soon.

I tried to see if my router thinks it's the master browser by typing "nbtstat -a myroutersname" (my router's name seems to be "Wireless_Broadband_Router" according to the systems settings router status page) and it came up with "Host Not Found". One thing of interest is the router status page showed "Local Domain: Home". I don't remember making that setting. It could be a default actiontec or Verizon setting. Could it be a problem for the router's local domain name to be the same as my home workgroup name. I'll keep digging.
 
I looked at the actiontec router (nice!) manual:

"Wireless_Broadband_Router" appears to be the default name. Local Domain "home" also seems to be the default. Probably not an issue with respect to being identical to your network name. Otherwise I would expect some initial warning or error. Plus reboots would not resolve the conflict for even a few days.

Since things do work for the most part, aside from the 4 - 5 day loss of internet I would suggest leave well enough alone with respect to the router until otherwise warranted. That is a very configurable router and you want to keep the configuration well-managed.

(Note: Did you change the router's default user name and password so no one else has access? I.e., "kids and who knows what...".)

If I do "ipconfig /all" my DNS Servers IP is the native IP address of my router. (Same default as yours 192.168.1.1)

Then if I do "nbtstat -a 192.168.1.1 my router shows up by name and with _MSBROWSER_ . Same results if I type in the router name.

If the router's name does not work try the IP.

Your router appears to have the ability to list all network devices and addresses via "My Network". Does what you see there match what you expect to see with respect to your network? Any devices not showing up? Is the router where you are getting your network mapping or the Win 7 Network and Internet screens?

Will be looking for your next update. In the meantime I am going to dig a bit deeper into something I need to understand better.


 
Thanks for your help. I haven't been able to troubleshoot much this week. Maybe I can get to it more tomorrow.

I've been using the Windows 7 network mapping. It's not very consistent and it's not always accurate. I do recognize the devices on the network when I look at the list using the router's web interface. Running 'nbtstat -a 192.168.1.1' also resulted in "Host not found". I did set up a custom user name and PW for the router. I'll need to get a block of time on the kid's PC to see what's running.

 
Thanks. May be out of the loop for a few days. Not sure about how much internet access I will have; much less the time to send any responses.

While checking on what is running keep an eye out for "Samba", "CIFS", and a system error log number 31004. Curious if anything related shows up.

You may find that something like Advanced IP Scanner will provide greater insight into your network. Zenmap is very useful also.
 
Just had a little time on the kid's pc today and found the master browser has moved to the media center pc. Let's see if that changes anything about the problem. Last week the problem was occurring more often (every other day). I'm not sure when the master browser changed so I can't say that was the cause. I'll monitor it from this day forward.
 
Thanks. Will be watching for your next posting. As I understand the election "rules" the master browser should not be moving around too much especially where you have some systems on 24/7. That (time) is used to help determine which device is going to be the master browser if the previous assignee is not available. There are other factors and priorities used. I was thinking "on" in the sense of just being powered up. However, they can have power but be off the network for some reason.... then the master browser moves and someone else does not get the message. And the name resolutions etc. start failing.

Should be fully back in the loop within a few more days.
 
Here's a new development. I noticed the problem again on Friday (5 June) and there was no Event ID 8032 browser error in the event viewer. The only other suspicious error was:

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin
Source: Microsoft-Windows-Kernel-EventTracing
Date: 6/4/2015 10:20:05 PM
Event ID: 3
Task Category: Session
Level: Error
Keywords: Session
User: SYSTEM
Computer: Media-Server
Description:
Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
<EventID>3</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>2</Task>
<Opcode>14</Opcode>
<Keywords>0x8000000000000010</Keywords>
<TimeCreated SystemTime="2015-06-05T05:20:05.172017000Z" />
<EventRecordID>2925</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="156" />
<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
<Computer>Media-Server</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="SessionName">Microsoft Security Client OOBE</Data>
<Data Name="FileName">C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl</Data>
<Data Name="ErrorCode">3221225485</Data>
<Data Name="LoggingMode">5</Data>
</EventData>
</Event>

I think this proves that Event ID 8032 was a symptom and not the cause and since the master browser is still on that PC, that specific error didn't occur.
 
Hello Geobrick,

Thanks.

The error (0xC000000D) seems to have been around for quite awhile. Found multiple Google "hits" including this forum. Some suggest removing/deleting one particular file but the actual correct fix seems to be a bit more involved.

Figure that you have probably already taken that path but I can PM you two links that may be helpful. May solve the error per se but maybe not the connectivity issues.

However what I found interesting was the XML link to http://schemas.microsoft.com etc...

When I clicked it directly "page could not be found". Same for entering the link into my browser. No idea what and why there is an attempt being made somewhere to go to that page. More research ahead. Point being that the failure generates an error that stops the security client and there may be some other unknown (to me) dependencies/domino effect. Plus there is that "Guid=" which I think is one of the network adapters. On Media Server maybe?

Also does your ISP provide IPv6? Looking at whether IPv6 should be enabled or not (across the board) on network devices if IPv6 is not provided.

Trying not to go in circles... but the problem's lack of consistency makes my head spin a bit. Hopefully continued monitoring will turn up something. Unfortunately that is all I can suggest right now.