Port Exhaustion Unable to login

Issue: 

You Can't login to server using your domain account. Only local account can login to the server and if you login you can see on the event viewer TCPIP 4231 and 4227.


Reboot will resolve the issue but it will return since you didn't know what application or port cause the port exhaustion.


Solution:

To know what cause the port exhaustion you need to run the below commands. before rebooting. from that result you can see the highest Count and the service name port. 

Try stop and disable that service and test login using your domain account.

Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Select -Property Count, Name, @{Name="ProcessName";Expression={(Get-Process -PID ($_.Name.Split(',')[-1].Trim(' '))).Name}}, Group | Sort Count -Descending

Below also helps to remotely stop and disabled that service name without logging in on the server

get-Service -Computername ServerName -Name ServiceName

Get-Service -ComputerName ServerName -Name ServiceName | Stop-Service -Verbose

Set-Service -ComputerName ServerName ServiceName -StartupType Disabled

get-Service -Computername ServerName -Name ServiceName

references:

https://docs.microsoft.com/en-us/windows/client-management/troubleshoot-tcpip-port-exhaust


Comments

Post a Comment

Popular posts from this blog

Email Source

Image
Scenario: There is this Email (a script email or a task schedule email) and you don't know where it is coming from or who is generating it. So you need to find out where it is coming from. What Server. Steps: 1. Open that email and go to File > Properties and look for Internet headers.  2. Then copy all that Internet Headers information and Paste it on this site           Email Header Analyzer, RFC822 Parser - MxToolbox 3. Click on Analyze Header. 4. Then the 1st HOP is the Server that has that script generating it.
Read more

Unable to RDP - Can't Connect to Remote Computer

Image
 Issue:   -Unable to RDP even port 3389 are open on both end to end Servers. You can Console the Server using domain/local account with no issue. But when you RDP you get this message. and on the Server itself since you can console it when you rdp inside it you get this error message. Action Done to Solve the issue: Enable > ‘Require use of specific security layer for remote (RDP) connections’  Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > SecurityOn the right-hand side, locate the ‘Require use of specific security layer for remote (RDP) connections’ and double-click it to edit it.If it is set to ‘Not configured’, select Enabled and then in front of Security Layer, choose RDP.Click Apply and then hit OK. then restart service Note: My Server is a 2016 and possible Cause of it was because of update/patch. Ref:  https://docs.microsoft.com/en-us/answers/questions/300054/r...
Read more

Domain Controller Authentication

Image
ISSUE: You want to authenticate a machine or Server to a different Domain Controller on a different SiteName. Meaning you don't want a particular machine/Server to authenticate to its default Domain Controller that has been Set up on Sites and Services. One possible purpose of this is version of DC and the patching of DC. SOLUTION: You need to run this command first to see what is its DC and DC Site. nltest /dsgetdc:<DomainName> and since you don't want the DC to authenticate to that DC Server, what you need to do is to run this command: nltest /SC_RESET:<DomainName\DCComputerName> But take note that this is Temporary once you logoff or login it will comeback to its Original DC. So to permanently authenticate to a desired Sitename you need to follow the below  HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Services Netlogon Parameters Create a String value called “SiteName“, and set the sitename of the DC where it is located. Then login and logoff. Then re run this - ...
Read more