I have \\server\share that is accessed by help desk. This share has several shortcuts pointing to other \\x.x.x.x\share at remote sites. Note the IP. It needs to be an IP, it's a remote site that has no DNS, if site loses WAN the share needs to remain accessible longer than DNS cache.
At random help desk will get an access denied for a IP\Share. I know \\dns\share uses kerberos and \\x.x.x.x\share uses NTLM.
if help desk navigate tp \\server\share and then \\x.x.x.x\share and it works and sometimes does not, why? Using wireshark during the access denied I can see NTLM is not able to auth the user because there are "No Logon Servers" I do not understand the randomness of the issue.