Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 3 Windows Server 2008 R2 instances, all of which are virtual machines hosted on a single VMware ESX server:

  • Domain controller with DNS services
  • DHCP/RRAS
  • File server

All three servers are configured with static IPv4 addresses. All servers are in the same domain, SOFTWARE. RDP is enabled on all 3 servers.

I can connect to the DHCP/RRAS server via RDP, but I cannot connect to the domain controller or the file server.

When I add RDP users to the File server (both are domain admins for testing), they show up like this:

Screenshot of Remote Desktop Users dialog box. Test User 1 and Test User 2 are on the list. Question marks appear over their user icons, indicating a potential problem.

What is happening? Why don't I even get a login screen for RDP on the domain controller?

share|improve this question
    
Is the service started and allowed in the local firewall? –  chutz Oct 26 '12 at 10:59
    
@chutz yes, the service starts when you click the 3rd radio button and exception to the firewall is made. I've tried shutting firewall down - but that doesn't make a difference as it's an exception already. –  Rob Oct 26 '12 at 12:25
    
What OS are you connecting from and what is the exact error message that you get when it fails? Do all of your servers point to your AD DNS server and only your AD DNS server? –  MDMarra Oct 26 '12 at 13:18
    
are all of these machines members of the domain? and are you logging in with a local account or a domain account? –  longneck Oct 26 '12 at 13:25
    
@MDMarra all servers point to the AD/DNS DNS from the intern adapter. The external adapter points to the internet. This system is working for 1 PC (the active directory domain controller). I can login via RDP on that one. The other 2 servers refuse to login with the domain credentials. –  Rob Oct 26 '12 at 13:33

2 Answers 2

up vote 1 down vote accepted

This is already said in Bernie White's answer comments, but just to make it clearer for newcomers:

Execute:

C:\Windows\System32\sysprep\sysprep.exe /generalize /oobe /reboot

Then rebind to the domain and reboot.

share|improve this answer

Account Resolution

From your screen shot the user icons with the question mark indicate that the SIDs for the user accounts can not be resolved, which is fundamental. This could either be that the user accounts have been deleted from your Active Directory or there is a connectivity problem between the file server and your domain controller. Based on that you are having other issues I will assume the account do still existing in Active Directory.

To resolve this I would go back to the basics. Check the following:

1. DNS Resolution

Can you resolve you domain controller (DC) by DNS name.

i.e. Run > Cmd.exe and use nslookup .

e.g. nslookup server1.consoto.com

If you can’t resolve check that local network settings are point to the DC as the DNS server and that there is nothing between the two servers like Windows firewalls or devices that would prevent this type of connectivity. Also check that you can resolve DNS on the DC itself.

2. Time in Sync

Is the local time and time zones on both the DC and file server synchronised. They should be ideally exactly the same, and the file server should be getting it’s time off the DC. The following can help resolve this:

   w32tm /config /syncfromflags:domhier
   w32tm /resync /rediscover
   net stop w32time
   net start w32time

When running Windows domain connected servers as VMs on ESX, disable host time sync for all VMs. This is done ether by:

  1. editing the .vmx file directly by browsing the datastore from the command-line or downloading the file from the datastore making the changes and uploading the file again.
  2. using Configuration Parameters option from the VM's settings in the vSphere or VI client to Add a row.

See http://kb.vmware.com/kb/1189 for more information.

Also it is also good practise to:

  1. Configure an external time source for you Windows DC. See http://support.microsoft.com/kb/816042
  2. Configure youyr ESX/vSphere hosts to get time from the DC. See http://kb.vmware.com/kb/1035833

3. Check Event Logs

There would most likely be a lot of errors and warnings logged in the event log.

4. Re-establish Trust

If all else fails you can re-establish the trust between the file server and the DC be disconnecting it from the domain, rebooting and rejoining it again.

Don’t do this though if you have outstading time or DNS issues.

RDP to DC

It’s hard to say exactly without more information, like event logs (may be you can post some error event IDs). But I would suggest that you check the file server issue first because it may be indicative of another issue. When the file server is working try to RDP from the file server to the DC.

I would also check http://technet.microsoft.com/en-us/library/cc794832(v=ws.10).aspx if you are attempting to connect to the DC using an older RDP client or operating system.

If that doesn’t help please provide more information like where you are trying to connect from (is it across a RAS connection?) so we can help.

Hope that helps.

share|improve this answer
1  
If you are running the server as a VM on ESX, disable host time sync for all VMs. See kb.vmware.com/kb/1189 I cannot see those .vmx files. Only deployed templates. –  Rob Nov 2 '12 at 13:10
    
Use the step that indicates how to set a Configuration Parameter by adding a new row. The VM must be powered off. The article refers to the Virtual Infrastructure client but it is the same for new vSphere clients too. –  Bernie White Nov 2 '12 at 21:10
    
This helped me, but did not solve my issue unfortunately. Sorry for the very late reply. –  Rob Nov 15 '12 at 13:37
    
Where are you stuck at? –  Bernie White Nov 15 '12 at 21:43
    
I ran everything, but I'm still unable to RDP to the other servers. It keep showing my RDP using as broken users. –  Rob Nov 16 '12 at 8:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.