Member Avatar for kevin_zhao

We have a few PC running XP sp3 have some network problem, if the pc has not been use for some times, it will locked, when user unlocked it, all the network loset, IE FF, outlook, thunderbird, all the windows base program lost the network, but I can ping and trace route from command prompt, to fix it, user just log off and log back in everything would be fine, I try to reset the network card, renew the ip, disable and reenable the network card, nothing worked if I dont log off. any idea what may cause this? your help will be very much appreciated.

  • 2 Contributors
  • 2 Replies
  • 128 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by kevin_zhao

Dani AI

Generated

Short summary tied to the posts: clarified this happens after the workstation is unlocked (screen saver), and correctly narrowed it to a user-mode/network-layer problem rather than a full NIC power loss since ping/traceroute still work. That pattern (machine-level IP working but user apps failing until logoff/logon) strongly points at per-user networking components: Winsock/LSPs, per-user proxy/auth tokens, or third-party AV/firewall hooks — not the basic IP stack.

Quick reproducible checks to run immediately after unlocking (copy the outputs for comparison before and after a logoff):

ipconfig /all
ping -n 4 8.8.8.8
ping -n 4 www.google.com
nslookup www.google.com
netstat -an
netsh winsock show catalog

What to look for: if IP pings work but name pings fail, DNS is suspect; if DNS works but TCP attempts to common ports fail, Winsock/LSP or firewall hooks are suspect. netsh winsock show catalog will list LSPs; any third-party entries (VPN, AV) are candidates.

Practical next steps

  • Test with third-party AV/firewall temporarily disabled (or in a clean-boot) to see if connection is restored without logging off.
  • Update NIC drivers and disable offload features in the adapter advanced settings (older XP drivers are often buggy on resume/unlock).
  • If LSPs look suspicious, try netsh winsock reset (requires reboot; warn users and backup any VPN client settings first).
  • Collect evidence with Event Viewer and, if needed, a short Wireshark capture across the unlock to see whether TCP SYNs are sent and replied to.

Caution: netsh winsock reset and removing LSPs can break VPN/managed clients; test on one machine first. If the problem persists after these steps, capture logs (ipconfig, netstat, winsock catalog, Event Viewer) and compare before/after a logoff to pinpoint what state is being restored by logon.

Recommended Answers

All 2 Replies

Member Avatar for CimmerianX

So if the PC comes out of the 'locked' mode, and you can ping other hosts, then you know that everything up to layer 3 is working just fine.

Here's the question: When the machine is locked, do you mean screen saver, or do you mean standby/hibernate?

With standby or hibernate, many times, the pc will shut off power to the NIC which can interrupt the windows services. Especially if you leave it off for a long time. The authentication token (access token) can become invalid for a number of reasons especially of you are inactive for an extended period, change networks during the same session.... etc. OF course logging out and in would fix it since the token is created at logon time.

Member Avatar for kevin_zhao

The lock mode is screen saver, we set it up on the domain GP so the PC enter the screen saver mode every 30 mins, and require password on resume, also the NIC setting does not allow windows the turn off its power, because user needs to remote login when pc in standby or hibernate

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.