Question Windows 11 networking stops working all of a sudden on some PCs (but not others) ?

[Minaz]

I have a home network with a number of Windows 11 PCs all using Windows Networking to share access to files stored locally to other PCs in the network.

Mysteriously, some of the PCs will stop sharing their folders. I have no idea why - previously, I could log on to the PC and access the files/folders remotely, and then suddenly I could not. So far this has happened to three PCs in my network. I am uncertain if this is due to any Windows update, but other PCs continue to share their folders just fine. When the PC stops allowing access, no other PC in the network can login, I don't even get the authentication prompt (asking for login and password).

I have followed the various steps from the sites online suggesting advanced sharing settings, making sure the permissions are set correctly, firewalls and VPNs, registry hacks, etc... nothing seems to fix it.

The really odd thing is that I changed nothing with the PC. It was allowing access, and then it didn't. The only thing that I could think of that might have changed anything is Windows updates which of course get pushed on a regular basis. But then its strange that other PCs in the network continue to share just fine.

Does anyone know any possible explanation for this?

 

[Ralston18]

How many devices in your network?

Are you using some mix of static and DHCP IP addressing?

Make and model: modem, router, or modem/router if combined?

The router's logs (if available and enabled) may provide some clue. Who has full admin rights to the router? You will need help from that person.

Sketch out a network diagram showing all network devices, their IP addressing, and MACs.

My thought is some IP address conflict or other configuration error of omission or commission may be involved.

Also: stay out of the registry. Registy edits are a last resort and only should be applied after fully backing up the host system and the registry itself.

Good chance that some preceding registry hack is now causing problems.

On one of the problem PCs are you able to run "ipconfig /all" (without quotes) via the Command Prompt?

If so, do so and post the results. (You should be able to copy and paste the results with no need to retype it all.)

 

[johnbl]

I would go to windows control panel, device manager find the network adapter and make sure windows is not putting it to sleep. IE right mouse click, bring up properties, find the power management tab and tell windows to not let the device sleep.

if it does not sleep. Then I would start debugging: start cmd.exe as an administrator
then run:
net.exe config srv
net.exe share
net.exe /sess

then ipconfig
and ping the machines own ipaddress to confirm network packets are working thru the loopback driver.


the net share command on the machine that can not be seen should show all of the shares and the hidden shares if the local server is still running.

hopefully, it is just something stupid like windows turning off the network driver to save power.
(easy fix, little debugging)

 

[Minaz]

How many devices in your network?

Let's see, I think in TOTAL probably around 50 devices, but most are not active especially not all at once. Only 5 computers are always on. Peak is 8-10 computers, depending who is at home, unless I am working on some project then there may be more or less. This doesn't count anything we don't normally call computers (Amazon Echo, Google Home, the always-on PS5, Xbox X, etc...).

Are you using some mix of static and DHCP IP addressing?
A mix - both the Raspberry Pis use static IP, AFAIK everything else uses DHCP.


Make and model: modem, router, or modem/router if combined?
I'm not 100% sure on the router/modem make and model, but they both were provided by Spectrum and say "Spectrum" on the cover.

The router's logs (if available and enabled) may provide some clue. Who has full admin rights to the router? You will need help from that person.

I know for a fact that I cannot access the router admin because Spectrum no longer allows it (found this out after some extensive troubleshooting when I was attempting to install pi-hole). Spectrum disabled access to the router from the web browser because it is only for Spectrum Technicians and they don't want lay-people messing with it. Incidentally, pi-hole is not currently installed, so it is not a factor.

Sketch out a network diagram showing all network devices, their IP addressing, and MACs.
UJm this would take a while, I'll have to get back to it.


My thought is some IP address conflict or other configuration error of omission or commission may be involved.
Hmmm this has happened before, but usually to the computer with the static address, because doesn't the DHCP server resolve conflicts?


Also: stay out of the registry. Registy edits are a last resort and only should be applied after fully backing up the host system and the registry itself.

Good chance that some preceding registry hack is now causing problems.

On one of the problem PCs are you able to run "ipconfig /all" (without quotes) via the Command Prompt?

If so, do so and post the results. (You should be able to copy and paste the results with no need to retype it all.)

From one of the problem PCs:
C:\Windows\System32>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : Marks-Origin-PC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : example.com

Ethernet adapter Ethernet Adapter:

Connection-specific DNS Suffix . : lan1
Description . . . . . . . . . . . : Intel(R) Ethernet Connection (2) I219-V
Physical Address. . . . . . . . . : 00-1F-BC-12-81-3F
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2600:6c50:667f:8bbd::6ea(Preferred)
Lease Obtained. . . . . . . . . . : Wednesday, January 4, 2023 13:11:07
Lease Expires . . . . . . . . . . : Sunday, January 8, 2023 14:19:19
IPv6 Address. . . . . . . . . . . : 2600:6c50:667f:8bbd:b48f:89e2:43de:4da0(Preferred)
Temporary IPv6 Address. . . . . . : 2600:6c50:667f:8bbd:8ae:f318:3199:7054(Preferred)
Link-local IPv6 Address . . . . . : fe80::8665:70c6:d942:6ee4%7(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.198(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Wednesday, January 4, 2023 13:11:03
Lease Expires . . . . . . . . . . : Wednesday, January 11, 2023 13:11:03
Default Gateway . . . . . . . . . : fe80::1eb0:44ff:fe5e:ee6c%7
192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DHCPv6 IAID . . . . . . . . . . . : 67116988
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-23-92-76-B5-00-1F-BC-12-81-3F
DNS Servers . . . . . . . . . . . : 2607:f428:ffff:ffff::1
2607:f428:ffff:ffff::2
fe80::1eb0:44ff:fe5e:ee6c%7
192.168.1.1
NetBIOS over Tcpip. . . . . . . . : Enabled
Connection-specific DNS Suffix Search List :
example.com

Ethernet adapter Nord VPN Tunnel:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-NordVPN Windows Adapter V9
Physical Address. . . . . . . . . : 00-FF-CF-55-98-B6
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Intel Dual Band WiFi Adapter:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : lan1
Description . . . . . . . . . . . : Intel(R) Dual Band Wireless-AC 8260
Physical Address. . . . . . . . . : 34-F6-4B-69-3F-48
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 1:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
Physical Address. . . . . . . . . : 34-F6-4B-69-3F-49
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter #2
Physical Address. . . . . . . . . : 36-F6-4B-69-3F-48
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Broadcom 5G WiFi Adapter:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : lan1
Description . . . . . . . . . . . : Broadcom 802.11ac Network Adapter
Physical Address. . . . . . . . . : 1C-87-2C-B8-A5-71
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Kaspersky VPN Tunnel 1:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Kaspersky Security Data Escort Adapter
Physical Address. . . . . . . . . : 00-FF-07-A2-2D-0C
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Kaspersky VPN Tunnel 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Kaspersky Security Data Escort Adapter #2
Physical Address. . . . . . . . . : 00-FF-A2-4E-18-82
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : 34-F6-4B-69-3F-4C
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

I should add the following:

The problem PCs are usually not visible on the network, even though the visibility is set to ON in both private and public networks. Sometimes though, you can see the PC name but not the shared resources. Attempting \\PCNAME or \\PCNAME\SHARENAME gives a not available error. From the problem PC, you may still not see the PC listed in the network, but you CAN access it using \\PCNAME or \\PCNAME\SHARENAME (just not from another PC). Actually throughout the network, some computers won't show up in the Network list for no apparent reason, but I can still access them directly using \\PCNAME\SHARENAME, so I don't consider these to be faulty (even though it would have been nice to actually see every resources in the network, not only some).

 

[Minaz]

I would go to windows control panel, device manager find the network adapter and make sure windows is not putting it to sleep. IE right mouse click, bring up properties, find the power management tab and tell windows to not let the device sleep.

Okay I turned off sleep for the Ethernet and Broadcom adapters.


if it does not sleep. Then I would start debugging: start cmd.exe as an administrator
then run:
net.exe config srv

C:\Windows\System32>net config srv
Server Name \\xxx-xx-x
Server Comment xxxxxxxxx

Software version Windows 10 Pro
Server is active on
NetbiosSmb (xxxx-xxxx-x)
NetBT_Tcpip_{22279194-E5F6-4B08-BCA0-6678B9554297} (xxxx-xxx-x)


Server hidden No
Maximum Logged On Users 20
Maximum open files per session 16384

Idle session time (min) 15
The command completed successfully.


net.exe share

C:\Windows\System32>net share

Share name Resource Remark

-------------------------------------------------------------------------------
print$ C:\WINDOWS\system32\spool\drivers
Printer Drivers
IPC$ Remote IPC
Origin Desktop
C:\Users\xxxx\Desktop
Origin Fast Apps (D)
D:\
Origin Photos
P:\
Origin Photos Backup
X:\
Origin Root C:\
Origin Slow Apps (W)
W:\
Origin Slow Apps (Y)
Y:\
Origin Videos
V:\
Origin Z Z:\
Users C:\Users
The command completed successfully.

net.exe /sess


C:\Windows\System32>net session
There are no entries in the list.


then ipconfig
and ping the machines own ipaddress to confirm network packets are working thru the loopback driver.

C:\Windows\System32>ping 192.168.1.198

Pinging 192.168.1.198 with 32 bytes of data:
Reply from 192.168.1.198: bytes=32 time<1ms TTL=128
Reply from 192.168.1.198: bytes=32 time<1ms TTL=128
Reply from 192.168.1.198: bytes=32 time<1ms TTL=128
Reply from 192.168.1.198: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.1.198:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms


the net share command on the machine that can not be seen should show all of the shares and the hidden shares if the local server is still running.

hopefully, it is just something stupid like windows turning off the network driver to save power.
(easy fix, little debugging)

So yeah, its a mystery. I am hoping someone can shed some light! 😛

 

[johnbl]

your net.exe share command did not show even the hidden shares even though the server is running. Have the default admin shares been removed?
here is what my default shares look like🙁 windows 10 laptop)

C:\WINDOWS\system32>net share

Share name Resource Remark

-------------------------------------------------------------------------------
C$ C:\ Default share
IPC$ Remote IPC
print$ C:\WINDOWS\system32\spool\drivers
Printer Drivers
ADMIN$ C:\WINDOWS Remote Admin
The command completed successfully.


all these shares with the $ are hidden admin shares.
I think your system need to connect to the IPC$ share to work correctly.
ipc= inter-process communication share
IPC$ share and null session behavior - Windows Server | Microsoft Learn
maybe they changed the defaults ???
or maybe related to this statement:
In Windows Server 2012 or a later version, there's a feature to determine whether anonymous sessions should be enabled on file servers. It's determined by checking if any pipes or shares are marked for remote access.

a clean install of windows 11 might have different results than a upgrade from windows 10 version.
if so then I would look at this to enable remote access.
Network access: Let Everyone permissions apply to anonymous users: Security Configuration Editor | Microsoft Learn
This doc indicates that the access is now disabled by default.
(pretty old doc)
-------------
you can also show the info about your shares:
like this


C:\WINDOWS\system32>net share c$
Share name C$
Path C:\
Remark Default share
Maximum users No limit
Users
Caching Manual caching of documents
Permission Everyone, FULL

The command completed successfully.

C:\WINDOWS\system32>net share ipc$
Share name IPC$
Path
Remark Remote IPC
Maximum users No limit
Users
Caching Manual caching of documents
Permission Everyone, FULL

The command completed successfully.


you can check who has access rights to the shares that can not be found.





I will check my windows 11 machine

 

[BFG-9000]

Let's see, I think in TOTAL probably around 50 devices, but most are not active especially not all at once. Only 5 computers are always on. Peak is 8-10 computers, depending who is at home, unless I am working on some project then there may be more or less. This doesn't count anything we don't normally call computers (Amazon Echo, Google Home, the always-on PS5, Xbox X, etc...).

Windows client OSes have a concurrent connection limit of 20, and as any computer can establish more than 1 connection, you aren't going to reach 20 computers simultaneously connected to a Windows share before seeing the not available error.

This is why people get Windows Server OS or share things on a NAS (as SAMBA doesn't have such a low limit)

 

[Ralston18]

Open Powershell as Admin.

Run the cmdlet "Get-SmbShare" (without quotes).

Reference:

https://learn.microsoft.com/en-us/powershell/module/smbshare/get-smbshare?view=windowsserver2022-ps

The Get-PSDrive cmdlet may prove even more helpful. Especially if run on or from different network computers.

The objective being to gather more information about which shares are appearing and which shares are not appearing. Or flipping between states.

For more information:

https://www.tutorialspoint.com/how-to-get-mapped-drives-using-powershell

Start with (from the link):

Get-WmiObject -ClassName Win32_MappedLogicalDisk | Select PSComputerName, Name,ProviderName

Overall, I would take a close look at the network's IP addressing (DHCP and Static). Could be some conflict between IP addresses, the allowed DHCP IP address range, a limit on the number of allowed network devices, possible duplicate IPs, etc..

Look at the router's admin windows: the router is likely to provide some listing of attached network devices and network information. If so, use that listing as a starting point or checklist.

Sketch out a network map showing all devices and connections between the devices: routers, switches, printers, storage, everything. Could be a network loop somewhere. Note the Name, IP address, and MAC of each device.

Include any device that is allowed to connect - even part time. Look for devices that you do not recognize..... MACs may help identify such devices.

https://macvendors.com/

You might discover for example that all is well unless some given device is in use. Could be a device with a default IP causing a conflict. IoT/"non-computer" device.

Not sure how many people are "related" to those 50 devices but very likely that some of those people are doing who knows what and thus contributing to the share related problems. Knowingly or unknowingly.

Seeing the big network picture could be very revealing.

 

[Minaz]

Open Powershell as Admin.

Run the cmdlet "Get-SmbShare" (without quotes).

Reference:

https://learn.microsoft.com/en-us/powershell/module/smbshare/get-smbshare?view=windowsserver2022-ps

The Get-PSDrive cmdlet may prove even more helpful. Especially if run on or from different network computers.

The objective being to gather more information about which shares are appearing and which shares are not appearing. Or flipping between states.

For more information:

https://www.tutorialspoint.com/how-to-get-mapped-drives-using-powershell

Start with (from the link):

Get-WmiObject -ClassName Win32_MappedLogicalDisk | Select PSComputerName, Name,ProviderName

Overall, I would take a close look at the network's IP addressing (DHCP and Static). Could be some conflict between IP addresses, the allowed DHCP IP address range, a limit on the number of allowed network devices, possible duplicate IPs, etc..

Look at the router's admin windows: the router is likely to provide some listing of attached network devices and network information. If so, use that listing as a starting point or checklist.

Sketch out a network map showing all devices and connections between the devices: routers, switches, printers, storage, everything. Could be a network loop somewhere. Note the Name, IP address, and MAC of each device.

Include any device that is allowed to connect - even part time. Look for devices that you do not recognize..... MACs may help identify such devices.

https://macvendors.com/

You might discover for example that all is well unless some given device is in use. Could be a device with a default IP causing a conflict. IoT/"non-computer" device.

Not sure how many people are "related" to those 50 devices but very likely that some of those people are doing who knows what and thus contributing to the share related problems. Knowingly or unknowingly.

Seeing the big network picture could be very revealing.

Thanks, I will try the above and see what it reveals.

This is going to be quite an involved process since it would mean grabbing (since it is my home after all) all the devices from everyone and seeing what each one is doing, and this is a peer to peer network so the resulting diagram is likely to be insane.

It is times like this I really miss centralized networks, or at least the option of a console where you can view the entire network setup. Anyhow fingers crossed on this...

P.S. is there a better solution than windows file sharing? I thought of using an sftp setup but its of course quite cluncky compared to windows file sharing, not sure if there is any other better solution.

 

[Ralston18]

Before "grabbing" devices first sketch out the network as you know or expect it to be.

Then do as much as you can on your own to discover those devices on the network and verify their network configuration.

Start with the router and document its configuration: IP, subnet masks, DHCP IP address range, reseverved/static IP addresses, limits on the number of allowed devices, what wireless frequencies are being used? Any parental controls established? Much to be learned by just working through the router's admin screens. My Linksys router provides a basic diagram of the devices that are connected or have been connected.

As you state - some devices appear and dissapear. Any specific devices that seem to be continually involved? Look for patterns, users, who is gaming, watching/streaming/downloading. Does anyone have their own router that has been "added in"? Or access to the network router that is, hopefully, solely under your admininistrative control? Maybe someone with a laptop having both the wired and wireless network adapters enabled. Or trying to spoof some other network device.

= = = =

There are quite a number of products available for viewing an entire network. Google "Network Discovery Software". Many choices and some offer trial periods that may or may not be limited in some manner.

For example:

https://www.softwaretestinghelp.com/network-discovery-tools/

Very likely that others here can and will post specific product suggestions - there are always trade-offs: Graphical representations versus user friendliness. Costs (if not free in some manner).

I will defer to others with regards to suggesting any particular product. Very much think that you will need to actually try and test a a few to get a sense of which discovery product meets your requirements.

Learn about the "net use" command. Powershell can also be very helpful. Stick to just finding information (Get cmdlets in Powershell).

https://www.lifewire.com/net-command-2618094

No need to immediately start trying to add, edit, or delete devices. Doing so may create more problems.....

Again: create a network diagram, fill in the details and then step back and consider it all. Then follow-up as warranted to resolve any questions or concerns with topology, devices, and even users.

As for file sharing - a NAS (Network Area Storage) box would be an option. FREENAS (or a imilar product) could be used if you have an extra, older, and working PC available.

For now, however, focus on the current network toplogy. Once the network is fully understood and stable then that would be the time to consider possible changes.