Tag Archives: Network

TCP XMAS Scan Probable – KB1039790


Description:  This alert comes from the Sonicwall device, basically it comes up when an outside source scans the ports to see what ports are open and closed. This could mean a possible attack on the customer’s network.

Common customer description: Customer usually doesn’t call for this. unless the customer checks their Event logs and see unusual activity, they could potentially call or if we bring it up to their attention by calling them after we get all the pieces put together.

Probing questions: Was there a disgruntled employee that might have access still?

Was there recent install of software or applications?

When did you notice this happening?

Steps to isolate: Check Event Viewer, try to pinpoint when this started and see if how frequent this is. Check the Sonicwall with a Tier 2 tech

Steps to resolve: The biggest thing is to check their Sonicwall with a Tier 2 tech, they will check to see if everything is “locked down” and there isn’t any open ports or if the wrong applications are using the wrong ports. This is extremely important since the Tier 2 tech can help decide how severe this is and what the next steps should be.

Additional considerations: This can be a serious alert since it’s a potential attack on their system. This should not be taken lightly and be looked at with a Tier 2 tech or Tier 3 to make sure that everything is okay on the customer’s side.

Mapped network drive missing KB103967


Description:  Mapped network drive is missing.

Common customer description:  “I cannot access the server.”

“I cannot access the Z: drive.”

“I cannot access my files.”

Probing questions:  Where are the files located?

Does another user have access to it that we can check? (this will get the file path in case the customer doesn’t know it)

Is this a new computer?

Has it worked in the past?

Is the computer in the office?

How are you connecting? (VPN, RDP, onsite, etc)

Is the drive attached to your computer?

What is the name of a folder on the drive so we can search for it?

What server is the share on?

Steps to isolate:  Connect to computer.

Verify drive is missing.

Steps to resolve:  For Windows 7:

Go to Computer -> Map Network Drive.

Choose drive letter (typically customer already has a letter in mind).

Enter the location of the folder, or browse to the location (dc01userstest user account).

Choose if they need to connect using different credentials. Check Reconnect at Logon. You can use the Command Line command “net shre” to list all shares on the server

Additional considerations:  Check for offline files

If you cannot find the path they are looking for, check login script to find if the Z: drive has a path you can use

Adding a network printer KB103938


Issue: Adding a New Network Printer

Common Description:

“I need a printer added.”

“I am trying to print to a printer but it will not let me.”

Probing Questions: Do you know the name of the printer? Is this printer currently working for others? Are you able to provide the make or model of the printer?

Isolation: Isolation is a matter of determining which printer the client will need added. If the client is unable to provide the name, there are a few alternative methods that can be used. Checking another user’s printers or having the client ask another user in the office which ones are needed is usually the most efficient. Checking a print server is also an option.

Try printing a different document, to determine if it is the doc or the printer at fault.

Once the name or IP address of the printer is determined move on to the resolution.


For Windows 7:

Navigate to Start > Devices and Printers

Click on Add a Printer

Click Add a network, wireless or Bluetooth Printer

At this point the printer may automatically appear. If not, click on “The printer that I want isn’t listed”

At this point you can either add the printer manually by IP address or by share location in the form of computerprinter_name 

For Windows XP:

1. Open Printers and Faxes
2. Under Printer Tasks, click Add a printer to open the Add Printer Wizard, and then click Next.
3. Click A network printer, or a printer attached to another computer, and then click Next.
4. Connect to the desired printer using one of the following three methods. Click a method for instructions.Search for it in Active Directory.

This method is available if you are logged on to a Windows domain running Active Directory.
1. Click Find a printer in the directory, and then click Next.
2. Click the Browse button to the right of Location, click the printer location, and then click OK.
3. Click Find Now.
4. Click the printer you want to connect to, and then click OK.

Type the printer name or browse for it.
1. Click Connect to this printer.
2. Do one of the following:
•Type the printer name using the following format:printserver_nameshare_name
•Browse for it on the network. Click Next, click the printer in Shared printers.
3. Click Next.
Connect to an Internet or intranet printer.

Using a printers URL allows you to connect to a printer across the Internet, provided you have permission to use that printer. If you cannot connect to the printer using the general URL format below, please see your printer’s documentation or contact your network administrator.

1. Click Connect to a printer on the Internet or on your intranet.
2. Type the URL to the printer using the following format:http://printserver_name/Printers/share_name/printer
3. Follow the instructions on the screen to finish connecting to the network printer.


Considerations: It is important to ensure that the client is indeed sending jobs to the printer, please ask the client to verify that the document has come out of the device.