I could really use some help here. My situation is this.

I have around 200 machines on a windows domain. The Domain controllers are running windows server 2003 and our exchange server is running exchange 2000.

Recently some of our Windows XP SP3 machines have started hanging at the applying computer settings in the boot up process. I can fix it by pulling out the network cable.

Upon checking the event logs in the client PCs I see that they have an error with net logon saying the DC cannot be contacted.

I have tried everything I could think of. So far I have tried the following:

Checking the DNS configuration and manually entering the IP Address of the DNS server on the client PCs. Still didn't work.

Using a packet sniffer to make sure the client PCs were talking to the DCs and they were.

System restores. Still didn't work.

Disabling the firewall on the client PCs. Still didn't work.

Moving the PC into a container on the domain which has no group policy settings. Still didn't work.

Checking the windows update servers for common failed updates on the client machines. There were no common failed updates.

Deleted all the user accounts on the client machine apart from the admin account. Then creating a new domain user account on the client. Still didn't work.

Removed the antivirus software on the client PCs. Still didn't work.

Rebooted the DCs. Still didn't work.

Reset the computer account on the DC. This caused some strange things to happen to the client PCs. After resetting the account I was able to get past applying computer settings. However at the login box when I try to log onto the machine using a domain account I get told "the system cannot log you in now because the domain is not available". To fix this I log on as a local admin disconnect from the domain, reboot and then log in as the local admin and reconnect to the domain. After this the PC gets past applying computer settings but after you log in it then hangs at loading personal settings. To fix this I have to remove the network cable.

The only tried and tested way I know to fix it is to reformat the machine. However this isn't really a very good fix as it would take too long to go round all the machines and reformat them.

I think that the problem may be something to do with the DCs. Could this be related to a replication issue between the DCs?

I am at my wits end any help at all would be really appreciated.

  • Are you trying to register with DNS servers outside of your domain? Please post an ipconfig /all. What do you get when you run these two commands? nltest /dsgetdc:domain-name.com nslookup -type=srv _ldap._tcp.dc._msdcs.domain-name.com
    – KCotreau
    May 26, 2011 at 10:48
  • Try enabling verbose logging and post the results if you need more help: support.microsoft.com/kb/221833
    – KCotreau
    May 26, 2011 at 10:52
  • Are you running WINS? Run the set command and make sure they are logging into the right server.
    – KCotreau
    May 26, 2011 at 10:56
  • Hi KCotreau, thanks for the tips. I will try to get a chance to check some of your suggestions out. Unfortunatley all my other work has piled up and I have to try to clear it now as I spent so long trying to fix this. May 27, 2011 at 8:15

1 Answer 1


I'd bet you have a DNS problem. If your clients do happen to have the IP address of your router or your ISP DNS server entered into their DNS configuration, they cannot resolve your AD DNS records which are necessary for DC location. If you have your AD DNS set into the client's IP configuration exclusively, please check your DC's configuration using the dcdiag and netdiag troubleshooting command-line tools

  • I would have thought it was DNS too, as everywhere I have been looking has pointed at the DNS server. But our network engineer assures me that its not. The DNS server is the same server as the AD Domain Controller. We tried manually configuring the ip address for the DNS server in the network card's properties. May 26, 2011 at 11:35
  • Hi folks, Just a quick update. I followed the suggestions to test DNS and the client PCs can definately contact the Domain Controllers. I think the problem lies with our domain controllers themselves, specifically our group policy settings. I have been checking out our group policy objects and when I click on one of our policies the following message is displayed "The enterprise domain controllers group does not have read read access to this GPO. The enterprise domain controllers group must have read access on all GPOs in the domain in order for Group Policy Modeling to function properly" Jul 4, 2011 at 9:15
  • Could you post the results of dcdiag and netdiag in your original question? It should help pin down your problems.
    – the-wabbit
    Jul 4, 2011 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.