For the last week, we have found ourselves in a sticky spot with Windows XP machines on a Windows Server 2003 Active Directory. Our computers can't join the domain, change passwords, or anything like that. What could possibly be wrong. Both our primary and secondary domain controllers are on and online. Help!

  • Look in the event logs of the DCs and the workstations that can't be added and post anything possibly relevant as an update to your question. – mfinni Aug 17 '11 at 15:00

try using DCDIAG.exe infomation is found here at Microsoft. http://technet.microsoft.com/en-us/library/cc776854(WS.10).aspx

Can you login as the domain admin and make other changes? Has anyone gone in and made chages to the DNS/DHCP/permissions in the past week or so?

and possibly Netdiag.exe /fix

  • Running DCDIAG remotely results in this: LDAP bind failed with error 8341. – Nathan Lawrence Aug 17 '11 at 16:37
  • There may be a replication error or a firewall issue. repadmin.exe /showrepl dc* /verbose /all /intersite > c:\repl.txt start c:\repl.txt – tkrabec Aug 17 '11 at 20:52

Depending on the results on that look try this (excerpt below) http://forums.techarena.in/active-directory/45533.htm 1. Demote or reinstall the machine(s) that were disconnected. 2. Use the "repadmin /removelingeringobjects" tool to remove inconsistent deleted objects and then resume replication. 3. Resume replication. Inconsistent deleted objects may be introduced. You can continue replication by using the following registry key. Once the systems replicate once, it is recommended that you remove the key to reinstate the protection. Registry Key: HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Allow Replication With Divergent and Corrupt Partner

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.