Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have installed server 2008 r2 and made it a Domain Controller. There are 15 client machines that are connected to the domain. In the past month all domain user logons where working fine. Unfortunately since yesterday we are not able to logon to the domain with any user except the administrator logon. when we trying to logon with any user on the domain it says:

"You cannot log on because the logon method you are using is not allowed on this computer"

share|improve this question
    
Check time synchronization. –  SpacemanSpiff Dec 1 '10 at 19:30

7 Answers 7

Have you made any changes to group policy, recently? It's possible a mistaken change is blocking interactive logins on domain member computers or by users in a certain group or OU. GPO is the most likely explanation, since it's seems to have affected all users at the same time, but not Domain Admins.

Also check the settings on the individual user accounts; examine the 'Logon Hours' and 'Log On To' settings. Perhaps some script has placed the wrong restrictions on the accounts.

share|improve this answer

Check the time between the client and server. They should be within 15 minutes of each other for Kerberos to function properly. I also support the group policy idea mentioned by SmallClanger. It sounds liked the Domain Users group was denied log on access.

share|improve this answer

When it works for Administrator and noone else, check the event logs. If they fill up they don't allow local logins. Haven't seen this happen at the domain level, but is worth checking.

share|improve this answer

When I encounter an error like that, I just put the entire string into google.

There are lots of results coming back. Most seem to point to group policy. One indicates that the users might have been removed from a group or the policy doesn't allow log on locally.

Here are some of the google results: For more, google it yourself. http://www.chicagotech.net/troubleshooting/cannotlogon.htm

http://www.tech-archive.net/Archive/Windows/microsoft.public.windows.server.active_directory/2009-07/msg00509.html

http://forums.techarena.in/active-directory/1188850.htm

share|improve this answer

One of the reason is maybe you have second DHCP server on some ruters or gateway . Stop all DHCP server on another machines or gateways

share|improve this answer
3  
The error is an active refusal from the domain controller and doesn't suggest any kind of network fault. –  SmallClanger Dec 1 '10 at 14:30

I had a problem on a server 2008 machine that wasn't the DC that wouldn't let any non-local users login. That problem was updated broadcom drivers. Not exactly the same thing but maybe it'll spark something.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.