Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have one computer that is acting very strangly when working with the domain. I have removed and rejoined this computer to the domain and it found and connected to the domain just fine. but it is unable to see the domain after joining. I am able to do an nslookup on the domain and the correct server responds but the computer itself does not seem to authenticate or see the rest of the domain. I can connect to other file shares for instance but it prompts for a login since it can't authenticate itself.

This computer uses our standard XP image and its just a basic loadout. User accounts are user accounts, only administrator accounts on the machine are the local and domain administrators. Windows Firewall is disabled

I did perform the following commands on it and made sure it was in the right mode.

nbtstat -R
nbtstat -RR
netsh interface ip reset reset.log
netsh winsock reset
ipconfig /flushdns
ipconfig /registerdns

From the command line on the client I an able to lookup the domain, (And the DNS server is one of the DCs so its obviously talking to it.) but that seems to be all I can do with it. One thing too is the domain sees it just fine, I'm connected into it with both VNC and RDP

C:\Documents and Settings\Administrator>nslookup DOMAIN.lan
Server:  SERVER1.DOMAIN.lan
Address:  10.0.0.4

Name:    DOMAIN.lan
Addresses:  10.0.0.4, 10.0.0.147, 10.0.0.15, 10.0.0.11


C:\Documents and Settings\Administrator>nslookup DOMAIN
Server:  SERVER1.DOMAIN.lan
Address:  10.0.0.4

SERVER1.DOMAIN.lan can't find domain: Non-existent domain

C:\Documents and Settings\Administrator>nslookup SERVER1
Server:  SERVER1.DOMAIN.lan
Address:  10.0.0.4

Name:    SERVER1.DOMAIN.lan
Address:  10.0.0.4


C:\Documents and Settings\Administrator>nslookup SERVER1.DOMAIN.lan
Server:  SERVER1.DOMAIN.lan
Address:  10.0.0.4

Name:    SERVER1.DOMAIN.lan
Address:  10.0.0.4


C:\Documents and Settings\Administrator>ping DOMAIN.lan
Ping request could not find host DOMAIN.lan. Please check the name and try
again.

C:\Documents and Settings\Administrator>ping SERVER1

Pinging SERVER1 [10.0.0.4] with 32 bytes of data:

Reply from 10.0.0.4: bytes=32 time<1ms TTL=128
Reply from 10.0.0.4: bytes=32 time<1ms TTL=128
Reply from 10.0.0.4: bytes=32 time<1ms TTL=128
Reply from 10.0.0.4: bytes=32 time<1ms TTL=128

Ping statistics for 10.0.0.4:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\Documents and Settings\Administrator>ping DOMAIN.lan
Ping request could not find host DOMAIN.lan. Please check the name and try
again.

C:\Documents and Settings\Administrator>ping SERVER1.DOMAIN.lan
Ping request could not find host SERVER1.DOMAIN.lan. Please check the name and try
again.

The ipconfig looks like it should, its getting all the information although I'm a little curious as to why the domain shows up twice in the DNS Suffix Search list.

C:\Documents and Settings\Administrator>ipconfig /all

Windows IP Configuration

    Host Name . . . . . . . . . . . . : COMPUTER8862
    Primary Dns Suffix  . . . . . . . : DOMAIN.lan
    Node Type . . . . . . . . . . . . : Hybrid
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No
    DNS Suffix Search List. . . . . . : DOMAIN.lan
                                        DOMAIN.lan

Ethernet adapter Local Area Connection:

    Connection-specific DNS Suffix  . : DOMAIN.lan
    Description . . . . . . . . . . . : Intel(R) PRO/100 VE Network Connection
    Physical Address. . . . . . . . . : 34-CD-B2-9C-43-FA
    Dhcp Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes
    IP Address. . . . . . . . . . . . : 10.0.0.118
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Default Gateway . . . . . . . . . : 10.0.0.254
    DHCP Server . . . . . . . . . . . : 10.0.0.4
    DNS Servers . . . . . . . . . . . : 10.0.0.4
                                        10.0.0.147
    Primary WINS Server . . . . . . . : 10.0.0.4
    Secondary WINS Server . . . . . . : 10.0.0.2
    Lease Obtained. . . . . . . . . . : Monday, October 25, 2010 8:06:10 AM
    Lease Expires . . . . . . . . . . : Monday, October 25, 2010 10:06:10 AM

I've been unable to find anything on it and giving it one last day before I just reimage the machine again.

share|improve this question
    
Your secondary WINS is different than your secondary DNS. Is it on purpose? –  Benoit Nov 30 '10 at 14:25
    
Did you check time synchronization? –  SpacemanSpiff Nov 30 '10 at 14:30
    
@Benoit - Thats actually a leftover from a change in servers, 10.0.0.2 was shutdown around this time last year and 10.0.0.147 was switched in to take over DNS, guess when it was setup they never changed up the WINS settings. 10.0.0.4 hasn't had any issues so its never come up before. I'll take a look at correcting that up. –  Shial Dec 2 '10 at 13:51

5 Answers 5

I saw this once before. All of the tests you ran worked, but it still couldn't pull down the group policies. NSlookup worked just fine, it could talk to and resolve the DCs just fine. And yet, no policies.

What ended up being the problem was the "TCP/IP NetBIOS Helper Service" was turned off for some reason. This setting came from the image, as it happened, so the image had to be re-baked, but it worked just fine once enabled.

share|improve this answer
    
Just checked, looks like TCP/IP NetBIOS Helper Service is started and Automatic. Bounced it to make sure but looks like a dead end in this particular situation. though taking a look to make sure its working correctly. –  Shial Oct 25 '10 at 16:19

Go into device manager and uninstall the NIC card(s), and then reboot and try again. Sometimes the networking components get messed up, and that should reset everything.

share|improve this answer
    
Nice idea, didn't work in this particular instance though. –  Shial Oct 26 '10 at 14:56

When you remove from the domain, try going one step further and delete the Computer account from AD. Let AD replicate and retry the domain join.

share|improve this answer
    
Tried but again no luck –  Shial Oct 26 '10 at 15:30
    
Any Kerberos errors in the event log? –  Simon Catlin Oct 26 '10 at 21:29
    
Does not appear to be any at the moment although I seeing some for LSASRV due to being unable to secure a connection with one of the DCs, no Authentication protocol was available. The other errors I'm seeing under application appear to be related to not being able to see the domain (GPO failing to update, Windows updates failing to talk to our WSUS, etc) –  Shial Oct 29 '10 at 12:52
    
Actually check that, I did find a few but from a couple of days ago, The kerberos subsystem encountered a PAC verification failure. This indicates that the PAC from the client Administrator in realm OPPORTUNITY.LAN had a PAC which failed to verify or was modified. Contact your system administrator. –  Shial Oct 29 '10 at 12:54

Perhaps having some more info would help.

  1. Does the client obtain the IP address via DHCP? If so, try manually assigning the IP. If the ip is manually assigned, make sure the subnet mask matches that of the server/domain.

  2. Is DNS Active Directory Integrated? More than one DC? If so, have they replicated all the info to one another? Do all the _KPASSWD,_KERBEROS,_ldap records exist in DNS for the correct DC?

  3. Try plugging in a different network card and see if it could be a hardware issue related to that.

  4. Does the client see any other machines on the network i.e. clients and other domain controller(s)/member servers? What about the other way around? Do other machines see this one?

share|improve this answer
    
1- Yes, DHCP. THe IPconfig at the tail end of my post has that information. It is pulling an address fine, I will attempt to do it manually though and see what it looks like 2- Yes again, The _KPASSWD, _kerberos and _ldap all exist and look fine, 3 - Ill check, 4- Somewhat, initially it wasn't, after removing from domain and back it does seem to but still doesn't see the domain itself so group policies fail. Even before other computers could see it (VNC and RDP) but interestingly I can't access the admin shares. –  Shial Oct 26 '10 at 14:35
up vote 0 down vote accepted

Finally just ended up replacing the computer and reimaging it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.