Greetings,
We have a Win2k Server that is our Primary Domain Controller, WINS, IIS, and is a our login/Active Directory Server. Our Win2k Server has been behaving itself for the most part. No major problems... until now.
The problem is complicated and I am still not sure exactly what/where the problem is, so let me explain the symptoms.
Symptom #1:
When a user who is logged into the domain on a Windows 2000 Professional Workstation cannot access file shares on the server. But if the computer disjoins the domain and is in a workgroup they can access these shares fine. When the user rejoins the domain, at the very moment before they restart their computer, they can access the server but as soon as they restart and get back into windows they cannot. They get the following error message:
“<COMPUTERNAME> is not accessible.
There are currently no logon servers available to service the login request.”
Symptom #2:
--Occurs when the user goes to Users and Passwords in the Control Panel and tries to add domain users to their local workstation. They get the famous error message that reads:
“The user could not be added because the following error has occurred:
The trust relationship between this workstation and the primary domain failed.”
The usual fix has always been disjoined the workstation from the domain and put it in the workgroup “WORKGROUP”, deleted the computer object out of the Active Directory, rebooted the workstation, and finally have it rejoin the domain to recreate the trust relationship. But this fix appears to not work anymore. Of course at that very moment, if you don’t restart the computer when it asks you to after joining the domain, you can add Domain users to the local workstation from Users and Passwords. But when you restart and log into the domain, again, the user is unable to access the server. Almost as if rebooting breaks the trust relationship.
Symptom #3:
-- Occurs when the user tries to access another workstation, say in a workgroup. When the user is logged into the domain and tries to access a file share on another co-workers workstation that they have had access to before this mess had happened, they get the same error message as described in problem 2.
I've also made some observations:
The weird thing is at the beginning of the onset of these problems, it was intermittent. Only one workstation exhibited it. Now all the computers in the domain have this problem. Thankfully it is Sunday, 4 a.m. (tomorrow I will call in sick unless I find a solution
)
Another observation is no changes have occurred to the PDC that would have invoked this problem. The only change that has occurred is Windows Updates, it does them automatically. Another change on our network as a whole which has occurred is the introduction of an XServe. That thing was a B*^%$ to make communicate with the AD. But no changes where made to the PDC server to make the XServe communicate with it.
Third observation is the System event log in the PDC server is filled with the following errors repetitiously:
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5774
Date: 6/8/2003
Time: 3:54:48 AM
User: N/A
Computer: XXXX
Description:
Registration of the DNS record '_kpasswd._udp.coll.univ.edu. 600 IN SRV 0 100 464 servname.coll.univ.edu.' failed with the following error:
DNS server unable to interpret format.
Data:
0000: 29 23 00 00 )#..
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5774
Date: 6/8/2003
Time: 3:54:48 AM
User: N/A
Computer: XXXX
Description:
Registration of the DNS record '_kpasswd._tcp.coll.univ.edu. 600 IN SRV 0 100 464 servername.coll.univ.edu.' failed with the following error:
DNS server unable to interpret format.
Data:
0000: 29 23 00 00 )#..
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5774
Date: 6/8/2003
Time: 3:54:48 AM
User: N/A
Computer: XXXX
Description:
Registration of the DNS record '_kerberos._udp.coll.univ.edu. 600 IN SRV 0 100 88 servname.coll.univ.edu.' failed with the following error:
DNS server unable to interpret format.
Data:
0000: 29 23 00 00 )#..
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5774
Date: 6/8/2003
Time: 3:54:48 AM
User: N/A
Computer: XXXX
Description:
Registration of the DNS record '_gc._tcp.Default-First-Site-Name._sites.coll.univ.edu. 600 IN SRV 0 100 3268 servname.coll.univ.edu.' failed with the following error:
DNS server unable to interpret format.
Data:
0000: 29 23 00 00 )#..
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5774
Date: 6/8/2003
Time: 3:54:47 AM
User: N/A
Computer: XXXX
Description:
Registration of the DNS record '_kerberos._tcp.Default-First-Site-Name._sites.coll.univ.edu. 600 IN SRV 0 100 88 servname.coll.univ.edu.' failed with the following error:
DNS server unable to interpret format.
Data:
0000: 29 23 00 00 )#..
On the client end the following System event logs are being logged:
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5788
Date: 6/8/2003
Time: 3:58:24 AM
User: N/A
Computer: Userscomputer
Description:
Attempt to update HOST Service Principal Names (SPNs) of the computer object in Active Directory failed. The updated values were '<UNAVAILABLE>' and '<UNAVAILABLE>'. The following error occurred:
Could not find the domain controller for this domain.
Data:
0000: 74 07 00 00 t...
Applications Event Log on client computer shows:
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 6/8/2003
Time: 4:01:31 AM
User: NT AUTHORITY\SYSTEM
Computer: Userscomputer
Description:
Windows cannot determine the user or computer name. Return value (1908).
Event Type: Information
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 6/8/2003
Time: 3:56:05 AM
User: NT AUTHORITY\SYSTEM
Computer: Userscomputer
Description:
Windows could not save the registry settings in your user profile on its first try because another program or service was editing them. Windows tried again and saved them after 8 attempts.
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 6/8/2003
Time: 3:12:43 AM
User: NT AUTHORITY\SYSTEM
Computer: Userscomputer
Description:
Windows cannot unload your registry file. If you have a roaming profile, your settings are not replicated. Contact your administrator.
DETAIL - Access is denied. , Build number ((2195)).
My manager looked at these event logs and scratched his head. He said, “When I was taught DNS at school I was playing DOOM”. --In other words, I’m on my own.
Basically if the user logs into the domain they can’t access any computer file shares almost as if they are using cached credentials. When the user logs in locally they can access everything. Problem to this is, none of our users log in locally. Most of our computers are in a lab classroom for public use.
I’m sorry if this post is too long but I want to make sure the reader has a clear picture of what is going on because I am not sure myself. If anyone has any suggestions, would like more details on something I might have left out, or have dealt with this sort of problem please let me know. I'm curious.
Thanks in Advance,
jade >:O>
We have a Win2k Server that is our Primary Domain Controller, WINS, IIS, and is a our login/Active Directory Server. Our Win2k Server has been behaving itself for the most part. No major problems... until now.
The problem is complicated and I am still not sure exactly what/where the problem is, so let me explain the symptoms.
Symptom #1:
When a user who is logged into the domain on a Windows 2000 Professional Workstation cannot access file shares on the server. But if the computer disjoins the domain and is in a workgroup they can access these shares fine. When the user rejoins the domain, at the very moment before they restart their computer, they can access the server but as soon as they restart and get back into windows they cannot. They get the following error message:
“<COMPUTERNAME> is not accessible.
There are currently no logon servers available to service the login request.”
Symptom #2:
--Occurs when the user goes to Users and Passwords in the Control Panel and tries to add domain users to their local workstation. They get the famous error message that reads:
“The user could not be added because the following error has occurred:
The trust relationship between this workstation and the primary domain failed.”
The usual fix has always been disjoined the workstation from the domain and put it in the workgroup “WORKGROUP”, deleted the computer object out of the Active Directory, rebooted the workstation, and finally have it rejoin the domain to recreate the trust relationship. But this fix appears to not work anymore. Of course at that very moment, if you don’t restart the computer when it asks you to after joining the domain, you can add Domain users to the local workstation from Users and Passwords. But when you restart and log into the domain, again, the user is unable to access the server. Almost as if rebooting breaks the trust relationship.
Symptom #3:
-- Occurs when the user tries to access another workstation, say in a workgroup. When the user is logged into the domain and tries to access a file share on another co-workers workstation that they have had access to before this mess had happened, they get the same error message as described in problem 2.
I've also made some observations:
The weird thing is at the beginning of the onset of these problems, it was intermittent. Only one workstation exhibited it. Now all the computers in the domain have this problem. Thankfully it is Sunday, 4 a.m. (tomorrow I will call in sick unless I find a solution
) Another observation is no changes have occurred to the PDC that would have invoked this problem. The only change that has occurred is Windows Updates, it does them automatically. Another change on our network as a whole which has occurred is the introduction of an XServe. That thing was a B*^%$ to make communicate with the AD. But no changes where made to the PDC server to make the XServe communicate with it.
Third observation is the System event log in the PDC server is filled with the following errors repetitiously:
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5774
Date: 6/8/2003
Time: 3:54:48 AM
User: N/A
Computer: XXXX
Description:
Registration of the DNS record '_kpasswd._udp.coll.univ.edu. 600 IN SRV 0 100 464 servname.coll.univ.edu.' failed with the following error:
DNS server unable to interpret format.
Data:
0000: 29 23 00 00 )#..
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5774
Date: 6/8/2003
Time: 3:54:48 AM
User: N/A
Computer: XXXX
Description:
Registration of the DNS record '_kpasswd._tcp.coll.univ.edu. 600 IN SRV 0 100 464 servername.coll.univ.edu.' failed with the following error:
DNS server unable to interpret format.
Data:
0000: 29 23 00 00 )#..
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5774
Date: 6/8/2003
Time: 3:54:48 AM
User: N/A
Computer: XXXX
Description:
Registration of the DNS record '_kerberos._udp.coll.univ.edu. 600 IN SRV 0 100 88 servname.coll.univ.edu.' failed with the following error:
DNS server unable to interpret format.
Data:
0000: 29 23 00 00 )#..
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5774
Date: 6/8/2003
Time: 3:54:48 AM
User: N/A
Computer: XXXX
Description:
Registration of the DNS record '_gc._tcp.Default-First-Site-Name._sites.coll.univ.edu. 600 IN SRV 0 100 3268 servname.coll.univ.edu.' failed with the following error:
DNS server unable to interpret format.
Data:
0000: 29 23 00 00 )#..
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5774
Date: 6/8/2003
Time: 3:54:47 AM
User: N/A
Computer: XXXX
Description:
Registration of the DNS record '_kerberos._tcp.Default-First-Site-Name._sites.coll.univ.edu. 600 IN SRV 0 100 88 servname.coll.univ.edu.' failed with the following error:
DNS server unable to interpret format.
Data:
0000: 29 23 00 00 )#..
On the client end the following System event logs are being logged:
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5788
Date: 6/8/2003
Time: 3:58:24 AM
User: N/A
Computer: Userscomputer
Description:
Attempt to update HOST Service Principal Names (SPNs) of the computer object in Active Directory failed. The updated values were '<UNAVAILABLE>' and '<UNAVAILABLE>'. The following error occurred:
Could not find the domain controller for this domain.
Data:
0000: 74 07 00 00 t...
Applications Event Log on client computer shows:
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 6/8/2003
Time: 4:01:31 AM
User: NT AUTHORITY\SYSTEM
Computer: Userscomputer
Description:
Windows cannot determine the user or computer name. Return value (1908).
Event Type: Information
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 6/8/2003
Time: 3:56:05 AM
User: NT AUTHORITY\SYSTEM
Computer: Userscomputer
Description:
Windows could not save the registry settings in your user profile on its first try because another program or service was editing them. Windows tried again and saved them after 8 attempts.
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 6/8/2003
Time: 3:12:43 AM
User: NT AUTHORITY\SYSTEM
Computer: Userscomputer
Description:
Windows cannot unload your registry file. If you have a roaming profile, your settings are not replicated. Contact your administrator.
DETAIL - Access is denied. , Build number ((2195)).
My manager looked at these event logs and scratched his head. He said, “When I was taught DNS at school I was playing DOOM”. --In other words, I’m on my own.
Basically if the user logs into the domain they can’t access any computer file shares almost as if they are using cached credentials. When the user logs in locally they can access everything. Problem to this is, none of our users log in locally. Most of our computers are in a lab classroom for public use.
I’m sorry if this post is too long but I want to make sure the reader has a clear picture of what is going on because I am not sure myself. If anyone has any suggestions, would like more details on something I might have left out, or have dealt with this sort of problem please let me know. I'm curious.
Thanks in Advance,
jade >
:O>