Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

EDIT: I was using WI-FI to connect. Changing the connection to a cabled one made the Win 7 to join the domain successfully. (Have no clue as to why though).

I have a windows 7 professional (spanish, 32-bits) laptop trying to join a Windows Server 2003 (english, 64-bits) domain. The Win7 correctly detects the SRV record, finding the proper domain controller, but then the join fails with the error message (snippet, because the error is in spanish)

An Active Directory Domain Controller for This Domain Could Not be Contacted

The DNS is correctly set, and client can ping by name and IP the server, the server can ping the client by IP. I've tested with the FW down to no avail. A host of other XP Pro clients are connected to the domain. I've restarted Net Logon and checked that Windows Time is up. Also the times are in sync between the server and the client. I'll put below diagnostics output.

The actual question is:

Is there anything special to be done on either the server or the client to have a Win 7 Pro join a 2k3 R2 domain, or it should work right out of the box?.

Of course if you can point out a mistake or some alternatives they'd be welcome.

The following diagnostic information follows:

  • netdiag /q for the DC
  • dcdiag on the DC
  • ipconfig /all on the Win 7 client

netdiag /q on the DC:

..................................

    Computer Name: HI-X2
    DNS Host Name: hi-x2.hi.local
    System info : Microsoft Windows Server 2003 R2 (Build 3790)
    Processor : EM64T Family 6 Model 23 Stepping 10, GenuineIntel
    List of installed hotfixes : 
        KB923561
        KB924667-v2
        KB925398_WMP64
        KB925902
        KB926122
        KB927891
        KB929123
        KB930178
        KB932168
        KB936357
        KB938127
        KB941569
        KB942830
        KB942831
        KB943055
        KB943460
        KB944338-v2
        KB944653
        KB945553
        KB946026
        KB948496
        KB950760
        KB950762
        KB950974
        KB951066
        KB951748
        KB952004
        KB952069
        KB952954
        KB954155
        KB954550-v7
        KB955069
        KB955759
        KB956572
        KB956802
        KB956803
        KB956844
        KB958469
        KB958644
        KB958869
        KB959426
        KB960225
        KB960803
        KB960859
        KB961063
        KB961118
        KB961501
        KB967715
        KB967723
        KB968389
        KB968816
        KB969059
        KB969947
        KB970238
        KB970430
        KB970483
        KB971032
        KB971468
        KB971657
        KB971737
        KB971961
        KB971961-IE8
        KB972270
        KB973037
        KB973354
        KB973507
        KB973540
        KB973687
        KB973815
        KB973825
        KB973869
        KB973904
        KB973917-v2
        KB974112
        KB974318
        KB974392
        KB974571
        KB975025
        KB975467
        KB975560
        KB975713
        KB976662-IE8
        KB977290
        KB977816
        KB977914
        KB978037
        KB978262
        KB978338
        KB978542
        KB978601
        KB978706
        KB979306
        KB979309
        KB979683
        KB980182
        KB980182-IE8
        KB980232
        KB980302-IE8
        KB981332-IE8
        KB981350
        Q147222



Per interface results:

    Adapter : Local Area Connection

        Host Name. . . . . . . . . : hi-x2.hi.local
        IP Address . . . . . . . . : 10.0.1.199
        Subnet Mask. . . . . . . . : 255.0.0.0
        Default Gateway. . . . . . : 10.0.1.1
        Dns Servers. . . . . . . . : 10.0.1.199



        WINS service test. . . . . : Skipped


Global results:
    [WARNING] You don't have a single interface with the  'WorkStation Service',  'Messenger Service',  'WINS' names defined.


DNS test . . . . . . . . . . . . . : Passed
    PASS - All the DNS entries for DC are registered on DNS server '10.0.1.199'.

IP Security test . . . . . . . . . : Skipped


The command completed successfully

dcdiag on the DC:


Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\HI-X2
      Starting test: Connectivity
         ......................... HI-X2 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\HI-X2
      Starting test: Replications
         ......................... HI-X2 passed test Replications
      Starting test: NCSecDesc
         ......................... HI-X2 passed test NCSecDesc
      Starting test: NetLogons
         ......................... HI-X2 passed test NetLogons
      Starting test: Advertising
         ......................... HI-X2 passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... HI-X2 passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... HI-X2 passed test RidManager
      Starting test: MachineAccount
         ......................... HI-X2 passed test MachineAccount
      Starting test: Services
         ......................... HI-X2 passed test Services
      Starting test: ObjectsReplicated
         ......................... HI-X2 passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... HI-X2 passed test frssysvol
      Starting test: frsevent
         ......................... HI-X2 passed test frsevent
      Starting test: kccevent
         ......................... HI-X2 passed test kccevent
      Starting test: systemlog
         ......................... HI-X2 passed test systemlog
      Starting test: VerifyReferences
         ......................... HI-X2 passed test VerifyReferences

   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom

   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : hi
      Starting test: CrossRefValidation
         ......................... hi passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... hi passed test CheckSDRefDom

   Running enterprise tests on : hi.local
      Starting test: Intersite
         ......................... hi.local passed test Intersite
      Starting test: FsmoCheck
         ......................... hi.local passed test FsmoCheck

ipconfig /all on the Windows 7 client:


Configuraci¢n IP de Windows

   Nombre de host. . . . . . . . . : hi-p6
   Sufijo DNS principal  . . . . . : 
   Tipo de nodo. . . . . . . . . . : h¡brido
   Enrutamiento IP habilitado. . . : no
   Proxy WINS habilitado . . . . . : no

Adaptador de LAN inal mbrica Conexi¢n de red inal mbrica:

   Sufijo DNS espec¡fico para la conexi¢n. . : 
   Descripci¢n . . . . . . . . . . . . . . . : Intel(R) WiFi Link 5100 AGN
   Direcci¢n f¡sica. . . . . . . . . . . . . : 00-22-FB-63-47-A0
   DHCP habilitado . . . . . . . . . . . . . : no
   Configuraci¢n autom tica habilitada . . . : s¡
   Direcci¢n IPv4. . . . . . . . . . . . . . : 10.0.1.42(Preferido) 
   M scara de subred . . . . . . . . . . . . : 255.255.255.0
   Puerta de enlace predeterminada . . . . . : 10.0.1.1
   Servidores DNS. . . . . . . . . . . . . . : 10.0.1.199
   NetBIOS sobre TCP/IP. . . . . . . . . . . : habilitado

Adaptador de Ethernet Conexi¢n de  rea local:

   Estado de los medios. . . . . . . . . . . : medios desconectados
   Sufijo DNS espec¡fico para la conexi¢n. . : 
   Descripci¢n . . . . . . . . . . . . . . . : Realtek PCIe GBE Family Controller
   Direcci¢n f¡sica. . . . . . . . . . . . . : 00-1E-33-1F-35-B1
   DHCP habilitado . . . . . . . . . . . . . : s¡
   Configuraci¢n autom tica habilitada . . . : s¡

Adaptador de t£nel isatap.{8926581E-09AC-4123-906B-DA6386AD2D60}:

   Estado de los medios. . . . . . . . . . . : medios desconectados
   Sufijo DNS espec¡fico para la conexi¢n. . : 
   Descripci¢n . . . . . . . . . . . . . . . : Adaptador ISATAP de Microsoft
   Direcci¢n f¡sica. . . . . . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP habilitado . . . . . . . . . . . . . : no
   Configuraci¢n autom tica habilitada . . . : s¡

Adaptador de t£nel Teredo Tunneling Pseudo-Interface:

   Sufijo DNS espec¡fico para la conexi¢n. . : 
   Descripci¢n . . . . . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Direcci¢n f¡sica. . . . . . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP habilitado . . . . . . . . . . . . . : no
   Configuraci¢n autom tica habilitada . . . : s¡
   Direcci¢n IPv6 . . . . . . . . . . : 2001:0:5ef5:73ba:1cec:3883:f5ff:fed5(Preferido) 
   V¡nculo: direcci¢n IPv6 local. . . : fe80::1cec:3883:f5ff:fed5%13(Preferido) 
   Puerta de enlace predeterminada . . . . . : ::
   NetBIOS sobre TCP/IP. . . . . . . . . . . : deshabilitado

share|improve this question
    
Looks like you're using wireless, have you tried plugging it into the wired network, then doing the join? –  Chris S May 26 '10 at 13:17
    
Spot on, @Chris. Bart had already suggested it though. Got any idea as to why could this be so? –  Vinko Vrsalovic May 26 '10 at 13:21
    
What kind of WAPs are you using? Some of the fancier ones block broadcast traffic when they shouldn't. –  Chris S May 26 '10 at 13:28
    
depends on how you're doing wireless. We have weird things too but it's a combination of our AD policies and wireless implementation; we have WPA over managed Cisco AP's and we need to have users allowed to log in via dialin policy, plus the machines need a policy that sets the correct login credentials (so wireless systems need to be in the right OU), and that's making sure the systems are near enough to an AP for proper signal. We also need to sometimes put them on a wired link so they get the policies updated properly first (sometimes with a forced gpupdate). –  Bart Silverstrim May 26 '10 at 13:30
    
@Chris: It's a crappy Comtrend one. I had to upgrade its firmware to be able to access Cisco VPNs though. It certainly could be the culprit. –  Vinko Vrsalovic May 26 '10 at 13:32

3 Answers 3

up vote 5 down vote accepted

Are you attempting to join by the FQDN of the domain server? I have had instances where the client wouldn't bind to the domain when using "domainserver" but did see it if I used "domainserver.mydomain.com". I always wrote it off as a quirk in Windows.

Have you tried connecting the cable to connect it to the domain rather than the wireless link alone?

share|improve this answer
2  
netbios twitch twitch i refuse to use anything but FQDN's on principal. –  Zypher May 26 '10 at 12:03
    
Seen the same behavior here as well, specifically with Win 7 clients. –  Chris Thorpe May 26 '10 at 12:21
1  
I may be missing sonething here. I don't put the FQDN of the domain server, I put the FQDN of the domain (instead of hi-x2.hi.local, hi.local). Still doesn't work, not using hi-x2.hi.local nor hi.local, nor hi-x2). How/where do you put the whole name? –  Vinko Vrsalovic May 26 '10 at 12:39
1  
Weird, but nothing really to lose...what happens if you boot it up while on the wired network, not the wireless, and try joining it? –  Bart Silverstrim May 26 '10 at 13:00
1  
I can't believe it. Cable worked! :-/ Thanks, man. Add that to the answer so it's more visible, please. –  Vinko Vrsalovic May 26 '10 at 13:16

Nope nothing special you need to do to join windows 7 to a 2003 domain.

The only thing that stands out is your workstation subnet is a /24 but your server subnet is a /8

Are there any error logs on the windows box when you try to join to the domain?

share|improve this answer
    
I've changed the server's netmask because I realized that problem while writing the question. After the netmask change the client still cannot join the domain. I'll check logs. –  Vinko Vrsalovic May 26 '10 at 11:53
    
Only error on the server is related to permissions: "The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {BA126AD1-2166-11D1-B1D0-00805FC1270E} to the user NT AUTHORITY\NETWORK SERVICE SID {S-1-5-20} –  Vinko Vrsalovic May 26 '10 at 13:01
    
@Vinko: How abotu on the win7 box? –  Zypher May 26 '10 at 13:10
    
Wait... when did you hit 10K? Congrats. =) –  Wesley May 26 '10 at 21:43
    
@Wesley: Thanks! hit it last night round 11:30 EST while i was waiting to do an outage. That last 500 rep was a real onesey twosey slog though! –  Zypher May 26 '10 at 21:48

This might depend on the domain level or what it's been upgraded for, and shouldn't matter with 2003 as far as I can tell - but just for fun, try changing the local security policy on the Windows 7 machine to send LM and NTLM responses and only use NTLMv2 when negotiated.

Local Security Policy Manager -> Local Policies -> Security Options -> Network Secuity: LAN Manager Authentication Level = Send LM & NTLM - use NTLMv2 session security if negotiated.

And if you try to ping the domain (not a specific DC) will it still return a response from a DC?

share|improve this answer
    
NTLMv2 is the default in Server 2003; the domain would have to be running in NT4 compatibility mode for this to be an issue. –  Chris S May 26 '10 at 13:14
    
Yeah, but the DC could have been upgraded over the years from NT4 and still be in that mode - at least I figured it could ^^ –  Oskar Duveborn May 26 '10 at 13:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.