I have one computer that is acting very strangly when working with the domain. I have removed and rejoined this computer to the domain and it found and connected to the domain just fine. but it is unable to see the domain after joining. I am able to do an nslookup on the domain and the correct server responds but the computer itself does not seem to authenticate or see the rest of the domain. I can connect to other file shares for instance but it prompts for a login since it can't authenticate itself.

This computer uses our standard XP image and its just a basic loadout. User accounts are user accounts, only administrator accounts on the machine are the local and domain administrators. Windows Firewall is disabled

I did perform the following commands on it and made sure it was in the right mode.

nbtstat -R
nbtstat -RR
netsh interface ip reset reset.log
netsh winsock reset
ipconfig /flushdns
ipconfig /registerdns

From the command line on the client I an able to lookup the domain, (And the DNS server is one of the DCs so its obviously talking to it.) but that seems to be all I can do with it. One thing too is the domain sees it just fine, I'm connected into it with both VNC and RDP

C:\Documents and Settings\Administrator>nslookup DOMAIN.lan
Server:  SERVER1.DOMAIN.lan

Name:    DOMAIN.lan

C:\Documents and Settings\Administrator>nslookup DOMAIN
Server:  SERVER1.DOMAIN.lan

SERVER1.DOMAIN.lan can't find domain: Non-existent domain

C:\Documents and Settings\Administrator>nslookup SERVER1
Server:  SERVER1.DOMAIN.lan

Name:    SERVER1.DOMAIN.lan

C:\Documents and Settings\Administrator>nslookup SERVER1.DOMAIN.lan
Server:  SERVER1.DOMAIN.lan

Name:    SERVER1.DOMAIN.lan

C:\Documents and Settings\Administrator>ping DOMAIN.lan
Ping request could not find host DOMAIN.lan. Please check the name and try

C:\Documents and Settings\Administrator>ping SERVER1

Pinging SERVER1 [] with 32 bytes of data:

Reply from bytes=32 time<1ms TTL=128
Reply from bytes=32 time<1ms TTL=128
Reply from bytes=32 time<1ms TTL=128
Reply from bytes=32 time<1ms TTL=128

Ping statistics for
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\Documents and Settings\Administrator>ping DOMAIN.lan
Ping request could not find host DOMAIN.lan. Please check the name and try

C:\Documents and Settings\Administrator>ping SERVER1.DOMAIN.lan
Ping request could not find host SERVER1.DOMAIN.lan. Please check the name and try

The ipconfig looks like it should, its getting all the information although I'm a little curious as to why the domain shows up twice in the DNS Suffix Search list.

C:\Documents and Settings\Administrator>ipconfig /all

Windows IP Configuration

    Host Name . . . . . . . . . . . . : COMPUTER8862
    Primary Dns Suffix  . . . . . . . : DOMAIN.lan
    Node Type . . . . . . . . . . . . : Hybrid
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No
    DNS Suffix Search List. . . . . . : DOMAIN.lan

Ethernet adapter Local Area Connection:

    Connection-specific DNS Suffix  . : DOMAIN.lan
    Description . . . . . . . . . . . : Intel(R) PRO/100 VE Network Connection
    Physical Address. . . . . . . . . : 34-CD-B2-9C-43-FA
    Dhcp Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes
    IP Address. . . . . . . . . . . . :
    Subnet Mask . . . . . . . . . . . :
    Default Gateway . . . . . . . . . :
    DHCP Server . . . . . . . . . . . :
    DNS Servers . . . . . . . . . . . :
    Primary WINS Server . . . . . . . :
    Secondary WINS Server . . . . . . :
    Lease Obtained. . . . . . . . . . : Monday, October 25, 2010 8:06:10 AM
    Lease Expires . . . . . . . . . . : Monday, October 25, 2010 10:06:10 AM

I've been unable to find anything on it and giving it one last day before I just reimage the machine again.

  • Your secondary WINS is different than your secondary DNS. Is it on purpose? – Benoit Nov 30 '10 at 14:25
  • Did you check time synchronization? – SpacemanSpiff Nov 30 '10 at 14:30
  • @Benoit - Thats actually a leftover from a change in servers, was shutdown around this time last year and was switched in to take over DNS, guess when it was setup they never changed up the WINS settings. hasn't had any issues so its never come up before. I'll take a look at correcting that up. – Shial Dec 2 '10 at 13:51

I saw this once before. All of the tests you ran worked, but it still couldn't pull down the group policies. NSlookup worked just fine, it could talk to and resolve the DCs just fine. And yet, no policies.

What ended up being the problem was the "TCP/IP NetBIOS Helper Service" was turned off for some reason. This setting came from the image, as it happened, so the image had to be re-baked, but it worked just fine once enabled.

  • Just checked, looks like TCP/IP NetBIOS Helper Service is started and Automatic. Bounced it to make sure but looks like a dead end in this particular situation. though taking a look to make sure its working correctly. – Shial Oct 25 '10 at 16:19

Go into device manager and uninstall the NIC card(s), and then reboot and try again. Sometimes the networking components get messed up, and that should reset everything.

  • Nice idea, didn't work in this particular instance though. – Shial Oct 26 '10 at 14:56

When you remove from the domain, try going one step further and delete the Computer account from AD. Let AD replicate and retry the domain join.

  • Tried but again no luck – Shial Oct 26 '10 at 15:30
  • Any Kerberos errors in the event log? – Simon Catlin Oct 26 '10 at 21:29
  • Does not appear to be any at the moment although I seeing some for LSASRV due to being unable to secure a connection with one of the DCs, no Authentication protocol was available. The other errors I'm seeing under application appear to be related to not being able to see the domain (GPO failing to update, Windows updates failing to talk to our WSUS, etc) – Shial Oct 29 '10 at 12:52
  • Actually check that, I did find a few but from a couple of days ago, The kerberos subsystem encountered a PAC verification failure. This indicates that the PAC from the client Administrator in realm OPPORTUNITY.LAN had a PAC which failed to verify or was modified. Contact your system administrator. – Shial Oct 29 '10 at 12:54

Perhaps having some more info would help.

  1. Does the client obtain the IP address via DHCP? If so, try manually assigning the IP. If the ip is manually assigned, make sure the subnet mask matches that of the server/domain.

  2. Is DNS Active Directory Integrated? More than one DC? If so, have they replicated all the info to one another? Do all the _KPASSWD,_KERBEROS,_ldap records exist in DNS for the correct DC?

  3. Try plugging in a different network card and see if it could be a hardware issue related to that.

  4. Does the client see any other machines on the network i.e. clients and other domain controller(s)/member servers? What about the other way around? Do other machines see this one?

  • 1- Yes, DHCP. THe IPconfig at the tail end of my post has that information. It is pulling an address fine, I will attempt to do it manually though and see what it looks like 2- Yes again, The _KPASSWD, _kerberos and _ldap all exist and look fine, 3 - Ill check, 4- Somewhat, initially it wasn't, after removing from domain and back it does seem to but still doesn't see the domain itself so group policies fail. Even before other computers could see it (VNC and RDP) but interestingly I can't access the admin shares. – Shial Oct 26 '10 at 14:35
up vote 0 down vote accepted

Finally just ended up replacing the computer and reimaging it.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.