82567LM keeps showing disconnect in event log

[idata]

I just purchased 4 Dell Optiplex 960 computers with WIndows 7 x64. I am having this issue on all 4 machines. Intermittently the computer disconnects from the network and also at times it will show that it is a 10mb connection. I updated the drivers to 11.5.10 dated 12/10/2009. The error in the event log is source: e1kexpress Event ID 27 "Network link has been disconnected." The workstations all connect to a Dell switch.

I spoke to Dell and they have no clue.

Help is appreciated.

[idata]

I have tried all of the suggestions in this post and none of them work. We are having the issue with Windows XP 32-bit and Windows 7 64-bit, with different driver versions, on various Dell/HP machines. All of the machines that have the Intel 82567 have the same issue. We are using the version 15.2 download from Intel, but the driver version on for example on a Dell e4300 is 10.1.9.0. Still the same issue. Basically, as the OP said, the event log shows that the card has been disconnected at random intervals (when PC is NOT going to sleep), and also problems at boot when the PC boots it says it can't find the domain controller.

Anybody have any luck getting the problem to go away permanently?

[mcbsys]

szilagyic: Seems odd that the 15.2 package would only install 10.1.9.0 for you, whereas on my 32-bit Win7 it installed 11.6.92.0 (Driver Date 4/12/2010). Different versions for 32-bit vs. 64-bit? Dunno. Have you tried rolling back to the original Windows 7 driver? I had decent luck with the original 10.5.1.0 from Microsoft. The latest 11.6.92.0 from Intel is so far working without a hitch.

http://www.mcbsys.com/techblog/2010/01/optiplex-960-network-card-dropouts-and-slow-speed/

Mark Berry

MCB Systems

[idata]

Ahhh good testing! 10.5.1.0 is working for me as well. Tried the HP sips utility hack, still didnt work, the MAC address issue that Dell recommended might be a patch fix, but spoofing a MAC doesnt appeal to me if a driver fix is the proper way to go about the issue.

Glad to see everyone working together on this one. I'll keep you guys posted if I hear back from Dell with a fix.

Regards,

QuA

[idata]

Strange, the driver for XP 32-bit is also version 10.1.9.0. So your 32-bit Win 7 driver must be the only one that's newer. When I try to roll back the driver to the Microsoft one in Windows 7 (version 10.0.2.2) we are still having the same issue. It doesn't roll back to 10.5.1.0 as you saw. So we are back with the same problem right now, but using the Microsoft driver this time. Anybody else find a similar solution?

[idata]

I believe on Dell's site they released an urgent release of their NIC driver to 11.6.92.0 of their NIC driver.

[idata]

Just checked. The most current version they have is 10.0.6.0... for our e4300. What system do you query, in order to get the newer version?

[idata]

We have the same issue with Dell Optiplex 960s (1600 of them). On the 980, it went away with bios updated to A02. There are a few 780's at another campus that exhibit the same, but not 100% of the time (about 90%). We've been working on this for 10 weeks and have had a case open with Dell for 3 weeks. I believe we have tried everything listed in this thread and others. The 11.6.92.0 driver helps a bit in that there is one link down after link up after resume from sleep, rather than 2 or 3 with older drivers (in most locations, that is -- we have one lab where there are usually two links down/up after up after resume from sleep. Our MAC addresses start with 00.

Things tried:

- Disabled SIPS

- Force link speed on both client and switch (10, 100, 1000).

- WOL off

- Uncheck "Allow the computer to turn off this device to save power"

- BIOS standby setting S1 instead of S3 (fixes it, but S1 saves no power)

- 5 or 6 kinds of switches; STP off or Port Fast on

- DHCP or assigned IP address.

It's a pretty big issue for us. We are required to save power with frequent S3 sleep. When users log on and the network goes down after authentication, all kinds of problems ensue, including complete lock-out of the computer until reboot, missing desktop, load a temporary profile, and missing printer and share connections. Our XP systems log the same up/down/up, but aren't as sensitive to the dropped link during logon. We also have a case open with Microsoft for a Kerberos bug this triggers.

Since this problem is across platforms and the driver is provided by Intel, couldn't someone from Intel get involved?

[idata]

We have the same issue here in our network with our six new HP workstations.

- HP Compaq 6000 Pro SFF

- MS Windows XP Pro 32 bit

- Intel(R) 82567LM-3 Gigabit Network Connection

- NIC driver: Intel | 12.04.2010 | 11.6.92.0

All of that workstations show that events (s. below) in the event log. But only one user experiences issuses so far. That one user causes much more load on the machine itself and on the network (demanding programs / network shares / a lot of e-mail traffic) than the other users with the 6000Pro machines.

The problems that occour are:

- Outlook is losing the connection to the server and the user has to authenticate again

- the network-connection is breaking down until the user reboots the machine (re-logon does not help)

When I use the machine with "normal" use like opening some websites, sending/receiving test e-mails starting/closing programs, I do not have the least issue and the number of event log entries are much less over time than when the user does his daily work.

So, after I read this discussion, I cannot comprehend the conclusion that this error is caused by NIC-inactivity. It looks rather the other way round that when more load is on the NIC then the connections is running into trouble.

After I checked the Windows-services and updated the NIC-driver to the latest, I made a BIOS-Update. But none of them fixed this issue.

The following event-entries occour typically:

system:

Source: "Userenv" Event-ID: "1053"

"Windows cannot determine the user or computer name. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted."

Source: "Dhcp" Event-ID: "1003"

Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address . The following error occurred:

. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

and, what led me to the conlusion that it could be a memory??-thing (of the NIC-Dirver??):

application:

Source: "Userenv" Event-ID: "1053"

Windows cannot determine the user or computer name. (Not enough storage is

available to complete this operation. ). Group Policy processing aborted.

Hope to have made everthing clear :-)

Edit:

One of the machines is now running since more than two days - without one more link-loss-event-entry. That machine is lost in reverie - does nothing except handling my rdp-connections from time to time. But one thing: about each two hours I have an entry: Source: "LsaSrv" Event ID: "40961" The Security System could not establish a secured connection with the server . No authentication protocol was available. It's pretty strange for me...

[mcbsys]

cjs@psu: you don't mention if you also tried rolling back to the base Microsoft driver included with Windows 7, version 10.5.1.0?

I seem to remember that there is a registry setting that will delay group policy processing for a few seconds, which might allow the network to (re-)connect. Can't find the reference now. Maybe it was the group policy "Always wait for the network at computer startup and logon to the computer" (http://technet.microsoft.com/en-us/library/cc787386%28WS.10%29.aspx Technet) . Might be worth opening a Microsoft incident to get help with some workarounds.

Mark Berry

MCB Systems

[idata]

Yes, we had 10.5.1.0 on originally and tried going back; it usually makes the problem worse.

We do have "Always wait for the network at computer startup and logon" enabled (in Computer Configuration/Policies/Administrative Templates/System/Net Logon). The problem is the network is up (we have cached credentials disabled) when the user logs on, then it goes down for 3-4 seconds, which is when the problems occur.

Good ideas though, thanks.

[idata]

I have also done all of the above. Tried the latest and greatest driver from Intel and Dell, neither work. Tried rolling back to the Microsoft driver, same problem there too. Tried the GPO setting for "Always wait for the network at computer startup...", no go. Tried disabling SIPS, no go.

We ended up swapping out the laptop with the issue with a Dell E4310 and no more disconnects. We are having a problem with mapped drives not showing up but I think that's a separate Windows problem.

There is obviously a serious problem here with the driver, considering there are so many replies to this thread with the same exact problem. Microsoft and/or Intel need to step up and get their software fixed.

[idata]

OK, I am going to jump into this dicussion because this problem is also affecting us big time.

Here is our background: we are in an university enviroment, just refreshed all our computers (around 200 computers) from Dell GX620 USFF to Dell 780 USFF, and we are running Windows 7 Entreprise 64 bit. The integrated NIC in these 780s are Intel 82567LM-3, we have tried all kind of drivers, latest one from Dell support, latest one from Intel download site, native Microsft driver 10.5.1.0, updated bios to ver. A04, turn off all power saving features and sleep mode in Windows 7, none of these address our problem.

We are in a Windows 2003 server Active Directory enviroment, users here are authenticated using Kerberos, the problem we see here is randomly when someone tries to log on, he/she gets stuck or "frozen" at the Welcome screen with a spinning circle that just hang the machine until you hard boot it. Sometimes users gets this error message saying "There are currently no log on servers available to service the logon request". This error is logged in the Event log systems log section, occasionally there is log that says the ethernet card has been disconnected, or saying the NIC is running at 10Mbit instead of 100Mbit. Although this might have been fixed by using the 10.5.1.0 version but I'm not convinced.

Very very frustrated at this point because we have spent a lot of time troubleshooting this problem already... we have open a ticket with Dell and it has been escalated up to their engineer support, don't know what will happen there... now is Intel looking at resolving this problem seriously???

[idata]

We have to do some more testing but on Friday it looked like turning off AMT (aka ME State Control in MEBx) clears up the problem on our Optiplex 780 and 960s. I put some instructions on doing that in http://clc.its.psu.edu/UnivServices/CLM/Win7ResumeLogon.aspx http://clc.its.psu.edu/UnivServices/CLM/Win7ResumeLogon.aspx (Probelm # 2, Circumvention # 6).

We haven't found a way to do that remotely, so it looks like we will be visiting some 1600 systems.

[mcbsys]

The main reason I bought a 960 was for AMT. The remote power off/on is very helpful when you need access to a machine. I've even tested remote access to the BIOS.

There is a whole infrastructure around provisioning AMT but you'll have to dive deep into Intel docs. Here's a link I found quickly re. USB provisioning: http://communities.intel.com/docs/DOC-1247# USB_provisioning.

It also depends which "kind" of AMT you got on the Dell systems. Check the sticker inside the case. There's some more info in my post here:

http://www.mcbsys.com/techblog/2008/12/buying-an-optiplex-with-vpro-from-dell-outlet/

Mark Berry

MCB Systems

[idata]

Hello cjs@psu.edu, thank you for that link, I will give that a try. I thought going to 200 was bad... but 1600?! I hope you have some help!

It looks like your enviroment is very similar to ours, Active Directory, Kerberos authentication, OptiPlex 780, 960, 980, & Windows 7 (which version of windows do you use? is it 32 or 64 bit?)

[idata]

I can confirmed that your problem # 2 and # 3 also happens in our labs. We have almost the identical complaints coming to the helpdesk about can't login username / password not correct and hang at "Wecome forever". I'm not sure which one happens more, but to me I see more machine frozen at welcome screen maybe because some users just did not report the password problem because they eventually will be able to login or find another computer.

Do you think problem # 3 is RELATED to # 2? because I've noticed that sometimes if Windows keeps returning the message saying that you have entered an invalid user/password many times, it will freeze up on you with the spinning circle going forever. But again, I have also seen user stuck at welcome on their first attempt to login. *shrugs.... very weird.

[mcbsys]

I wonder if AMT and/or vPro are present but not configured if it could cause these issues. Lke it stops the login to see if the AMT hook is avialable, or maybe it can't get access to its registry key (http://communities.intel.com/docs/DOC-1247# Automatically_disabling_the_Intel_AMT_Privacy_Notification_window).

Mark Berry

MCB Systems

[idata]

Thanks, Mark. We'll look into USB provisioning. Might be just as fast to disable ME State Control with reboot/ctrl-p/set pw/etc.

As to your idea what it is doing on resume makes sense; it is certainly not set up on our systems. I think I mentioned all our 980's did this too until BIOS A02, which maybe contained some AMT code. A BIOS update to 755's (A17?) made them so keyboard and mouse would not wake them up, and it was AMT (and could not be backed out).

Edu.DesktopSupport: I don't think our Problem # 2 is related to the # 3 "Wecome forever", because we've seen it on all kinds of Win7 builds; laptops, workstations, 64-bit. We are getting more reports of # 3 as we complete building all our managed systems (up to 4800 of 6000), so I hope to find some clues. These are all Pro 32-bit.

Thanks everyone for your interest.

[idata]

I am going to jump in to this discussion too, we have several Dell e4200 and e4300 laptops with the Intel 82567LM NICs that are displaying similar symptons (i.e. entris in the application log showing media disconnects, loss of connection to the network, machine locking on reboot). We have loaded the latest intel and dell drivers, updated the BIOS (to A16 on the e4200's), disbaled SIPS and all power management settings, etc.. and all to no avail! (oddly we also now have a Dell Vostro V13 that has a RealTek NIC that is also showing the same symptons). This is very frustrating to our users, and us, and has been ongoing for months, there must be something we are missing.

[idata]

I think, not 100% sure at as we haven't finished testing just yet, that we have found a resolution to this problem, we have installed the 64-bit version of windows 7 instead of the 32-bt version and this seems to have totally cleared up the issue!

[idata]

Whilst v11.6 from the Dell site for our rooms of Optiplex 960 seems to have fixed most of the issues for us on Windows 7 (32bit) I think I have found a new bug... If anyone else can verify the scenario it would be helpful as its going to be a few days before I can test this again.

Dell just replaced a broken motherboard in one of the 960s. All MAC addresses begin 00:24... on the ones we have so far, but this new board begins 00:26... Some machines use a reserved DHCP IP (2003R2 64 bit server), but when I set up this new 00:26 machine it gets an IP fine, including default gateway address - but then cannot ping the default gateway or get on the internet! (can ping anything else on the local subnet fine!). If I set it to use any DHCP IP (not a reservation) it works fine. Tried this from scratch on the DHCP scope and re-imaged the machine and got the same result. To me it looks like a driver bug - I have no other explanation right now.

Update: I have an explanation! A router on the same network was previously doing DHCP and had the MAC address in its BIND-TO-MAC list, even though it wasnt doing DHCP it made everything go a bit funky! It would appear though it didnt do this until the firmware was updated on the router though! Pesky software bugs everywhere!

Message was edited by: develop