2

Domain Controller is a physical server running Windows Server 2012 R2. FF Level is 2008 R2, DF Level is 2012 R2. However, I found a MS article that states XP is fully compatible with even a 2012 R2 FFL. This issue is only affecting Windows XP (and older) VMs. Exact error when I try to join a machine to the domain is:

The following error occurred attempting to join the domain "MyDomain": The specified network name is no longer available.

Troubleshooting steps attempted thus far:
- Rebooting the DC
- Re-enabling SMB1 and rebooting the DC (was already enabled) EDIT: Not true! Read on...
- Restarting NETLOGON service on DC (no issues) and on XP VMs (does not stay started)
- Running DCDIAG (all tests pass)
- Disabling IPv6 on the DC
- Disabling ISATAP NIC adapter (hidden device) in DevMgmt.msc

Here is the output from DCDiag /v

    PS C:\> DCDiag /v

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   * Verifying that the local machine MY-SERVER, is a Directory Server.
   Home Server = MY-SERVER
   * Connecting to directory service on server MY-SERVER.
   * Identified AD Forest.
   Collecting AD specific global data
   * Collecting site info.
   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=acme,DC=com,LDAP_SCOPE_SUBTREE,(objectCategory=ntDSSiteSettings),.......
   The previous call succeeded
   Iterating through the sites
   Looking at base site object: CN=NTDS Site Settings,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=acme,DC=com
   Getting ISTG and options for the site
   * Identifying all servers.
   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=acme,DC=com,LDAP_SCOPE_SUBTREE,(objectClass=ntDSDsa),.......
   The previous call succeeded....
   The previous call succeeded
   Iterating through the list of servers
   Getting information for the server CN=NTDS Settings,CN=MY-SERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=acme,DC=com
   objectGuid obtained
   InvocationID obtained
   dnsHostname obtained
   site info obtained
   All the info for the server collected
   * Identifying all NC cross-refs.
   * Found 1 DC(s). Testing 1 of them.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\MY-SERVER
      Starting test: Connectivity
         * Active Directory LDAP Services Check
         Determining IP4 connectivity
         * Active Directory RPC Services Check
         ......................... MY-SERVER passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\MY-SERVER
      Starting test: Advertising
         The DC MY-SERVER is advertising itself as a DC and having a DS.
         The DC MY-SERVER is advertising as an LDAP server
         The DC MY-SERVER is advertising as having a writeable directory
         The DC MY-SERVER is advertising as a Key Distribution Center
         The DC MY-SERVER is advertising as a time server
         The DS MY-SERVER is advertising as a GC.
         ......................... MY-SERVER passed test Advertising
      Test omitted by user request: CheckSecurityError
      Test omitted by user request: CutoffServers
      Starting test: FrsEvent
         * The File Replication Service Event log test
         Skip the test because the server is running DFSR.
         ......................... MY-SERVER passed test FrsEvent
      Starting test: DFSREvent
         The DFS Replication Event Log.
         ......................... MY-SERVER passed test DFSREvent
      Starting test: SysVolCheck
         * The File Replication Service SYSVOL ready test
         File Replication Service's SYSVOL is ready
         ......................... MY-SERVER passed test SysVolCheck
      Starting test: KccEvent
         * The KCC Event log test
         Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
         ......................... MY-SERVER passed test KccEvent
      Starting test: KnowsOfRoleHolders
         Role Schema Owner = CN=NTDS Settings,CN=MY-SERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=acme,DC=com
         Role Domain Owner = CN=NTDS Settings,CN=MY-SERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=acme,DC=com
         Role PDC Owner = CN=NTDS Settings,CN=MY-SERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=acme,DC=com
         Role Rid Owner = CN=NTDS Settings,CN=MY-SERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=acme,DC=com
         Role Infrastructure Update Owner = CN=NTDS Settings,CN=MY-SERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=acme,DC=com
         ......................... MY-SERVER passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         Checking machine account for DC MY-SERVER on DC MY-SERVER.
         * SPN found :LDAP/MY-SERVER.acme.com/acme.com
         * SPN found :LDAP/MY-SERVER.acme.com
         * SPN found :LDAP/MY-SERVER
         * SPN found :LDAP/MY-SERVER.acme.com/acme
         * SPN found :LDAP/121ee01d-112f-4dff-8dd1-ba8463ea8203._msdcs.acme.com
         * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/121ee01d-112f-4dff-8dd1-ba8463ea8203/acme.com
         * SPN found :HOST/MY-SERVER.acme.com/acme.com
         * SPN found :HOST/MY-SERVER.acme.com
         * SPN found :HOST/MY-SERVER
         * SPN found :HOST/MY-SERVER.acme.com/acme
         * SPN found :GC/MY-SERVER.acme.com/acme.com
         ......................... MY-SERVER passed test MachineAccount
      Starting test: NCSecDesc
         * Security Permissions check for all NC's on DC MY-SERVER.
         * Security Permissions Check for
           DC=ForestDnsZones,DC=acme,DC=com
            (NDNC,Version 3)
         * Security Permissions Check for
           DC=DomainDnsZones,DC=acme,DC=com
            (NDNC,Version 3)
         * Security Permissions Check for
           CN=Schema,CN=Configuration,DC=acme,DC=com
            (Schema,Version 3)
         * Security Permissions Check for
           CN=Configuration,DC=acme,DC=com
            (Configuration,Version 3)
         * Security Permissions Check for
           DC=acme,DC=com
            (Domain,Version 3)
         ......................... MY-SERVER passed test NCSecDesc
      Starting test: NetLogons
         * Network Logons Privileges Check
         Verified share \\MY-SERVER\netlogon
         Verified share \\MY-SERVER\sysvol
         ......................... MY-SERVER passed test NetLogons
      Starting test: ObjectsReplicated
         MY-SERVER is in domain DC=acme,DC=com
         Checking for CN=MY-SERVER,OU=Domain Controllers,DC=acme,DC=com in domain DC=acme,DC=com on 1 servers
            Object is up-to-date on all servers.
         Checking for CN=NTDS Settings,CN=MY-SERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=acme,DC=com in domain CN=Configurat
ion,DC=acme,DC=com on 1 servers
            Object is up-to-date on all servers.
         ......................... MY-SERVER passed test ObjectsReplicated
      Test omitted by user request: OutboundSecureChannels
      Starting test: Replications
         * Replications Check
         * Replication Latency Check
         ......................... MY-SERVER passed test Replications
      Starting test: RidManager
         * Available RID Pool for the Domain is 1601 to 1073741823
         * MY-SERVER.acme.com is the RID Master
         * DsBind with RID Master was successful
         * rIDAllocationPool is 1101 to 1600
         * rIDPreviousAllocationPool is 1101 to 1600
         * rIDNextRID: 1147
         ......................... MY-SERVER passed test RidManager
      Starting test: Services
         * Checking Service: EventSystem
         * Checking Service: RpcSs
         * Checking Service: NTDS
         * Checking Service: DnsCache
         * Checking Service: DFSR
         * Checking Service: IsmServ
         * Checking Service: kdc
         * Checking Service: SamSs
         * Checking Service: LanmanServer
         * Checking Service: LanmanWorkstation
         * Checking Service: w32time
         * Checking Service: NETLOGON
         ......................... MY-SERVER passed test Services
      Starting test: SystemLog
         * The System Event log test
         Found no errors in "System" Event log in the last 60 minutes.
         ......................... MY-SERVER passed test SystemLog
      Test omitted by user request: Topology
      Test omitted by user request: VerifyEnterpriseReferences
      Starting test: VerifyReferences
         The system object reference (serverReference) CN=MY-SERVER,OU=Domain Controllers,DC=acme,DC=com and backlink on
         CN=MY-SERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=acme,DC=com are correct.
         The system object reference (serverReferenceBL) CN=MY-SERVER,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=acme,DC=com
         and backlink on CN=NTDS Settings,CN=MY-SERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=acme,DC=com are correct.
         The system object reference (msDFSR-ComputerReferenceBL)
         CN=MY-SERVER,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=acme,DC=com and backlink on
         CN=MY-SERVER,OU=Domain Controllers,DC=acme,DC=com are correct.
         ......................... MY-SERVER passed test VerifyReferences
      Test omitted by user request: VerifyReplicas

      Test omitted by user request: DNS
      Test omitted by user request: DNS

   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : acme
      Starting test: CheckSDRefDom
         ......................... acme passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... acme passed test CrossRefValidation

   Running enterprise tests on : acme.com
      Test omitted by user request: DNS
      Test omitted by user request: DNS
      Starting test: LocatorCheck
         GC Name: \\MY-SERVER.acme.com
         Locator Flags: 0xe000f1fd
         PDC Name: \\MY-SERVER.acme.com
         Locator Flags: 0xe000f1fd
         Time Server Name: \\MY-SERVER.acme.com
         Locator Flags: 0xe000f1fd
         Preferred Time Server Name: \\MY-SERVER.acme.com
         Locator Flags: 0xe000f1fd
         KDC Name: \\MY-SERVER.acme.com
         Locator Flags: 0xe000f1fd
         ......................... acme.com passed test LocatorCheck
      Starting test: Intersite
         Skipping site Default-First-Site-Name, this site is outside the scope provided by the command line arguments provided.
         ......................... acme.com passed test Intersite
PS C:\>

At this point I am completely out of ideas? What could this be, a NTLM issue?

Improve this question
6
  • 2
    Disabling IPv6 on the DC. Disabling ISATAP NIC adapter (hidden device) in DevMgmt.msc. Those last two seem like pretty random things to do. Additionally, you should never disable IPv6. Furthermore, how did you disable IPv6? If you merely unchecked it in the properties of the NIC then you didn't disable it, you simply unbound it from the NIC. Have you run the relevant BPA's on the DC? How about the event logs on the DC? Anything of note?
    – joeqwerty
    Jan 5, 2019 at 18:03
  • Are you sure that the network configuration done in the XP VM is correct? Can you check if DNS settings point to DC(s) having DNS roles.
    – Am_I_Helpful
    Jan 5, 2019 at 18:12
  • I agree with @Am_I_Helpful, check DNS first. Also, check NETBIOS/WINS is properly working.
    – RobbieCrash
    Jan 5, 2019 at 18:52
  • Yes, the XP VMs are getting an IP from the same DHCP server just like Win7/8/10 clients (which do not have an issue joining the Domain).
    – KidACrimson
    Jan 5, 2019 at 19:08
  • @joeqwerty, nothing found in logs on the DC, at least not yet. I will run BPA for DNS and report back...
    – KidACrimson
    Jan 5, 2019 at 19:09

2 Answers 2

Reset to default
3

This has been resolved now. The DC was incorrectly reporting on the status of SMB1 (showing enabled when in fact it was not yet enabled): enter image description here

Running this PowerShell command fixed the issue (resource link here):
Set-SmbServerConfiguration -EnableSMB1Protocol $true

Improve this answer
1
  • 1
    Nice Find. My guess is that installing the SMB 1 feature doesn't actually enable it, much like installing the AD DS Role doesn't create a Domain Controller and Domain but just installs the "bits" needed to do so.
    – joeqwerty
    Jan 8, 2019 at 17:32
1

Do you have group policy configured to restrict legacy Kerberos encryption types? Some hardening guides or audit policies force you to configure this which could render legacy clients like XP unable to authenticate properly.

The setting is in Windows Settings - Security Settings - Local Policies - Security Options - Network security: Configure encryption types allowed for Kerberos. More info here:

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos

Improve this answer
2
  • Im not sure, but wasnt there at some point in time you could change/raise the domain compatibliy, so xp clients couldnt be used any more?
    – Mr Zach
    Jan 5, 2019 at 19:48
  • Thank you, Ryan. This setting is undefined on the DC, so doesn't seem to be the issue.
    – KidACrimson
    Jan 6, 2019 at 4:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .