'net use' over SSL fails unless port 443 is specified

Question

We are attempting to connect to a WebDAV server using net use over SSL. On some servers we're seeing an issue in which this connection only succeeds if we specify port 443 in the URL.

Does Map

net use * "https://example.com:443/folder"
net use * "\\example.com@SSL@443\folder"

and, bizarrely, so does this: net use * "\\example.com@SSLasdf\folder"

Does Not Map

net use * "https://example.com/folder"
net use * "\\example.com@SSL\folder"

In the non-working cases we consistently receive the following error:

System error 67 has occured.
The network name cannot be found.

We have noticed some things that might be useful information:

• We have a test server that's configured the same way as the prod server and it works as expected.
• In the non-working cases, no incoming requests are ever seen at the prod server from the failing host.
• All clients are based on the same image.
• The problem does not manifest uniformly on all clients -- some work, some don't.
• There is an existing, valid entry for example.com in the client DNS cache.
• Flushing the client DNS cache of the affected servers does not resolve the problem.
• Once the problem appears, it seems to stick. That is, if I execute one of the working mappings, delete it, and then immediately execute one of the non-working mappings, the problem persists.

We are utterly stumped. Any theories?

Answer 1

You are seeing different behaviors because you are connecting using different names. Once a name has been attempted and failed, the WebClient (this is the service that enables WebDAV) will cache the response for a period. To clear the cache, locate the WebClient service in the Services console and restart it. Or from an administrative command prompt execute the following command:

net.exe stop webclient && net.exe start webclient

Answer 2

We ultimately determined that we were mis-interpreting the System Error 67 that net use was returning. We discovered two interesting things:

1. In the event that the WebDAV returns a 404 or a 50x on the initial, root folder PROPFIND, net use will (rightly) interpret this as the root folder being unavailable. The fact that it says the network name could not be found let us to believe that the problem was with the name resolution, but it was really just saying, 'hey, I couldn't find anything at this path.'

2. If 'net use' fails due to a 404/50x, it appears that for a brief period of time it will automatically fail any additional mappings for that same host without issuing a request. For example, if net use http://me.com/foo returns a 404, then net use http://me.com/bar will instantly fail if made in rapid succession to that first call, and no request record will be seen in the WebDAV server logs.

My best guess is that appending the @443 port didn't make any real difference. What it perhaps did do was to trick net use into thinking it was talking to a different host, at least for the purposes of its 'auto-fail' feature. But that's just a guess.