Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For some reason, any new domain users created on Windows Server 2003's Active Directory cannot login to the domain. However, existing domain users can login just fine.

I have even tried copying an existing user (who can login) and then giving the new user a new username and a password.

What's causing this? I have recently updated the server with the latest update. I am not sure if it is related.

share|improve this question
Please give more detail about the logon failure. What error message do the users receive when they try to log on? – Jay Michaud Jun 21 '09 at 0:19
+1 for Jay - I am so sick of people reporting "can't logon" errors. There is an ERROR MESSAGE displayed when you "can't logon". READ IT. sigh – Evan Anderson Jun 21 '09 at 3:56

One possibility...

You may have a DNS or other Active Directory issue on your domain preventing PC's from contacting a domain controller, and since "existing" users have already logged into their PCs, they're simply logging in under their cached account.

Quick litmus test - if you go to a PC in the domain and ping domainname.local (where domainname.local is the FQDN of your domain, but does not contain any server name), do you get the IP address for one of your domain controllers?

share|improve this answer
Or another test, a user who can successfully login to their own machine, can they log on to a machine they've never logged on to before? – Joel Mansford Jun 21 '09 at 16:20

Have you checked to ensure the new user accounts are being replicated properly to all domain controllers?

share|improve this answer

Do the users show up in the AD list?

Can they login from the workstations, on the local machine, with

..more details...specific error they show up in the logs as failed logon?

share|improve this answer

Your AD members are not replicating correctly. While this is a minor issue at first, over time it can become a serious one. You will want to force replication between the servers as soon as possible and examine the System log(s) of the server(s) in question.

share|improve this answer
Poster needs to clarify how many domain controllers there are, and their relative location. – Joel Mansford Jun 21 '09 at 16:21

Sorry about posting this on the wrong forum.

Anyway, we only have one domain controller. The new users are showing up on the AD. The users can login from outside of the network just fine using virtual private network. And if a user's password gets changed in the active directory, the user has to use the new password.

And there is no security log for the new user attempting to login.

I'm not sure how to force replicate AD members. So, I'll look that up and give that a try.


share|improve this answer
If you only have one Domain Controller, then replication is not your problem. Back to the original comments, what exact error message to users get when trying to log on? Were things working fine before you installed the "latest update"? What was the "latest update" that you installed? What happens if you uninstall that update? – Sean Earp Jun 24 '09 at 6:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.