Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

we are going through a process of moving our servers into a new AD domain, we have done loads without a hitch but now have one that refuses to move.

Every time we try and put it into the new domain you get an 'Access Denied' message. There is nothing in the event log, and not really any other clues as to what is happening.

Cheers Luke

share|improve this question
    
Tried to see if it shows up in AD as a computer account? You can delete it and try to re-add the server. –  pauska Oct 1 '10 at 15:34

3 Answers 3

I've run into this problem when I try to do too many things at once; that is, when I try to change the computer's name AND join it to a domain at the same time. This continued to be a bug up to Windows 2003, but in Windows 2008 it was no longer an issue.

The solution is to simply do one or the other first - change the domain, REBOOT, THEN change the name. Or vice-versa - change name, REBOOT, change domain.

Another problem could be that you are not running as an administrator of some type.

share|improve this answer
    
Had the exact same problem, don't ever rename AND join domain at the same time. +1 –  pauska Oct 1 '10 at 15:33

Try checking the clock and timezone and make sure they are reasonably close (within a minute or two). That should only keep you from logging in once you've joined, but it might preemptively deny you because you'd have an issue once you came back up if you didn't sync the clock.

I've had strange silent fails between domain trusts when the time looked the same, but the time zone was off. The silent fail was seeing zero users when browsing another domain, no big red box saying "dude, clock is off - way off."

This may not the be answer, but it's something to have a look at during a silent fail on credentials.

Also what credentials are you using? Are you a domain admin or just adding them as a regular user? If you don't hit the add limit, you may be seeing an existing computer object that your user account does not have the access to delete - then create. Even though you would have the access to create when joining a fresh machine.

share|improve this answer
up vote 0 down vote accepted

I have managed to finally work it out. I think the initial problem was as @josh described, but in this case restarting then changing name, then rebooting and adding to the domain did not fix the problem.

There are a couple of registry entries that control the security settings used when joining the domain, they are in HKLM\system\Current Control Set\services\lanmanserver\parameters and HKLM\system\Current Control Set\services\lanmanserver\parameters.

The 2 entries in here you are interested in are Requiresecuitysignature and Enablesecuritysignature.

Once i had enabled these (set both to 1), rebooted and it joined the domain cleanly. I think at some point a policy had been applied to these keys and that's why they were not set right.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.