A. Using the checked version of RDR.SYS its possible to create a log file of the browser elections so you can monitor exactly what is happening. To turn on the log perform the following:

  1. Back up the original file to replace after troubleshooting by renaming %Systemroot%\System32\Drivers\rdr.sys to %Systemroot%\System32\Drivers\rdr.bak
  2. Place the checked version of rdr.sys in the %systemroot%\system32\drivers directory (you may have to rename from .chk to .sys)
  3. After you replace the original file with the checked version, start the registry editor (regedit.exe)
  4. Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rdr\Parameters
  5. From the Edit menu select New - DWORD value and enter a name of BowserDebugLogLevel
  6. Double click the new value and set to ffffffff (in Hex)
  7. From the Edit menu select New - DWORD value and enter a name of BowserDebugTraceLevel
  8. Double click the new value and set to ffffffff (in Hex)
  9. Close the registry editor

Note Yes, its Bowser not Browser. Don't ask me :-)

A log file Bowser.log will be created in the %systemroot% folder. An example content would be:

<font color="#0000FF">Bowser::Find_Master: Master not found, forcing                              election. = Could not find the master browser, so force an election.<br><br>                              Bowser: Last election long enough ago, forcing election on \Device\NetBT_El90x1                              = Wait a little while to decrease the chance of a browser storm.<br><br>                              Send true election. = The need to force an election that we think we can win is                              seen.<br><br>                              Send dummy election. = Force an election that we are not hoping to win, for                              example, shutting down the browser or because we cannot find a backup browser.                              The criteria of the election is 0x0.<br><br>                              New server: TITANIC. Periodicity: 240 = A new server (</font>
<font color="#0000FF">TITANIC)                              was found in our domain that we need to remember.<br><br>                              #New domain: SAVILLTECH. Periodicity: 900 = A new domain (SAVILLTECH) was found                              to add to our list of domains.<br><br>                              Domain pass for \Device\NetBT_El90x1 = We are going to search for new domains on                              the transport \Device\NetBT_El90x1.<br><br>                              Received election packet on net \Device\NetBT_El90x1 from machine </font>
<font color="#0000FF">TITANIC.                              Version: 1; Criteria: 20010fa8; TimeUp: 8750 = A computer (named </font>
<font color="#0000FF">TITANIC)                              forced an election, on the network transport \Device\NetBT_El90x1, it is running                              Browser version 1, its criteria is 20010fa8, and it has been up for 8750                              seconds.<br><br>                              We lost the election = There was an election and we lost it.<br><br>                              Dummy election request ignored during election. = There is an election in                              process so we can discard the election packets with the criteria of 0x0.</font>