File server access denied (0x80070035)

Record a heartbreak.

Time: December 25, 2018 16:00

Phenomenon: All users cannot access the file server, mapping disks and UNC paths are inaccessible, but the server IP address can be pinged.

Process of investigation:

Network configuration normal:

!

Check firewalls, all firewalls are down;

Related services are turned on: dnscache, fdspub, SSDP Discovery, UPnP Device Host, Computer Browser, Server, DNS Client, TCP/IP NetBIOS Helper.

After the above investigation, it was found that it was still not good

Then I found a very strange phenomenon: using\ip or\computer name on the file server local machine can not access their own shares.

Think of the file server before hanging up there are crazy virus records: 1 hour more than 10,000 records (under the trend), think it should be related to the system configuration, and anxious to restore the service, start to reinstall the system (before again spit out IT, file server and main domain control and another host), more than 4:00 in the morning to complete the server reinstallation and main domain control migration, test everything is normal, go home. At noon the next day, tragedy occurred again. I found that the above state appeared again, and my heart collapsed infinitely ~~~

Start the process of searching for information on the Internet, read through countless materials: finally found an article with reference value

Local security policy-Local security-IP security policy, on the local computer, inexplicably added a policy qianye: Deny access to all IPs

Decisively disable this policy and the file server returns to normal.

In hindsight, it should be caused by server poisoning, but no relevant records can be found in the logs. Operation and maintenance still need to strengthen internal anti-virus (again complaining trend)