Customer says domain computers can't connect to the network, printers etc.

[computertechguy]

Most domain computers can't get to the internet, period; a couple can. Changed the DNS to google and they still can't connect. They can ping google.com and any ip address we choose. But web browsing will not work, "Err connection aborted." If they log on with a hotspot they get internet websites. Stopped and restarted DNS.

We turned of the Domain controllers, and set static ip's on the workstations by passing dns internally and still can't get internet. Firewall is off.

 

[mmerry]

I would start with looking at what DHCP is giving out for DNS (Internal should be pointing to local DNS server) and that the what the router has as DNS settings.

 

[computertechguy]

I would start with looking at what DHCP is giving out for DNS (Internal should be pointing to local DNS server) and that the what the router has as DNS settings.

View attachment 18151

Yep got that...

 

[computertechguy]

We turned off domain servers/ad connected a new firewall and still no internet on workstations. We flushed the dns.

 

[computertechguy]

Looks like network activity is disabled on many machines, checked host files

 

[computertechguy]

Took a workstation offline and ran from the local profile still no Web, the computer says internet.
No internet / web from a cellular hotspot.

 

[computertechguy]

Booted in Safe mode with networking and everything works! So I need to figure out what is broken, or is it a virus. Netsh winsock reset performed.

 

[mmerry]

Check whats running with process explorer. Was about to suggest winsock reset as you posted.

Sounds like some process or software is starting up at runtime.

 

[computertechguy]

Check whats running with process explorer. Was about to suggest winsock reset as you posted.

Sounds like some process or software is starting up at runtime.

We are now trying to disable all non-Microsoft services in normal mode.

 

[computertechguy]

Found it, it was a rocketcyber service (Kaseya SOC)... Removed that everything is fine now. Thanks for the suggestions.

 

[Markverhyden]

Found it, it was a rocketcyber service (Kaseya SOC)... Removed that everything is fine now. Thanks for the suggestions.

I'm guessing it should be renamed to brickwallcyber service.....

 

[nlinecomputers]

They didn’t pay the previous MSP and got locked out or there was malicious activity on the network and they were locked out. Needs to find out why this was locked.

 

[NETWizz]

I'm guessing it should be renamed to brickwallcyber service.....

I would imagine someone flagged the device in a console and that disabled it. We have a tool called Fireeye by Trellix and also Absolute Resilience... I think both can do the same