I work remotely for my company, and use VPN to connect to the main office network and domain. The domain controller there is a W2k3 box. The workstation I use was joined to the domain before I moved it here, and so I can sign on using my domain credentials. However, if I need to sign on as a different domain user, or if I need to join another machine to the domain, I can't.

When I try, it says that the domain controller could not be located, or that the domain is unavailable.

Now, to compound this issue further (in my mind at least), I use domain credentials when I sign in to the VPN, and I can use any available login for that successfully. In the tcp/ip setup for the VPN connection on my workstation, I have added an entry for DNS that points to the domain controller.

Still, no dice. I'm in dire need here. Any thoughts?

  • You need to do quite a bit to DNS other than a single record. Can you clarify what you did? – MDMarra Jan 24 '11 at 21:04
  • I edited my question above to help clear up what I meant by that. In the setup for VPN connection, you can add a DNS address, and I did that - the internal IP of the domain controller. – Ducain Jan 24 '11 at 21:06

From what I understand you are doing, this is expected behaviour (I read that you have a VPN client on a computer, as opposed to a permanent VPN between your router and the office).

The reason you are able to log on to your machine when not connected to the main network is because your workstation caches your credentials to make logon possible.

From what I read you are trying to do, you are trying to log on as a different user (who has never logged on to your workstation) and this is failing (I'm making the assumption your VPN connection doesn't persist after you logout with this explanation). Because there are no cached credentials on the machine, it has to contact a Domain Controller to authenticate the logon, and this is where your problem lies - because you are not connected to the VPN, it cannot contact a Domain Controller.

The reason you are able to use any Domain credentials to sign on to your VPN is because the VPN connects to a Domain Controller and authenticates the credentials provided (this is not the same as logging on to the machine though).

The only real solution to your problem is either to have a local Domain Controller to authenticate logons (if you're at a branch office, this is feasible - if you're at home, not so much), or to have a permanent VPN connection between your router and the office.

  • Totally correct, and I'm smacking myself in the head about it somewhat - but that's cool - sometimes you just miss the obvious. Of course my VPN wouldn't persist after logoff. Hm. – Ducain Jan 24 '11 at 22:04

I agree with Ben's answer. There may be one more option though. Depending on the VPN client, it may be possible to establish the VPN connection at the Windows logon screen, before logging to the domain (Network logon). At least the built-in VPN clients on Vista and Windows 7 allow this.

I found this link on that subject: http://social.technet.microsoft.com/Forums/en/w7itpronetworking/thread/1ee7325e-3bb7-4cea-89b4-787713260bf3.

  • +1, this is a valid point. I did say my answer depended on the VPN client not surviving a logoff (and not all of them do - I know ours certainly doesn't). – Ben Pilbrow Jan 24 '11 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.