XP Pro access denied in joining Win2K3

[henrymsilva]

I triend joining my win xp pro sp2 workstations to our new win 2k3 domain .. mostly are successful but i had five workstations could not join the domain. I had the ecountered this message "An error had occured while joining XXXXX domain. Access Denied". I checked my account and password, all is correct. No same name computer accounts in the server. DNS and other network settings are perfectly correct. Anyone had same problem and found a solution other that reformatting the pc/laptop? Note that I tried re-installing the OS of the one that is having a problem and it was able to join the domain without any problem. Note also that all my workstations are a member of an old AD Domain...

 

[bcastner]

You could turn off the firewall, or see:

http://support.microsoft.com/default.aspx?kbid=840634&product=windowsxpsp2

 

[henrymsilva]

thanks on your reply but we already make sure that the firewall had been switched off.

any more sugeestion where we should look for other possibilities?

 

[bcastner]

Even switched off, I would be happiest if a provision was made for RPC:

Use a the Netsh command-line tool

On the Windows XP SP2-based computer, run a netsh command to permit traffic through Windows Firewall on TCP port 445: 1. Click Start, click Run, type cmd in the Open box, and then click OK.

2. Type the following command, and then press ENTER:
netsh firewall set portopening tcp 445 smb enable
You receive the following message:
Ok.

3. Quit the command prompt.

If that succeeds, implement this change throughout your organization, run this netsh command-line from a batch file or from a script.

 

[bcastner]

. Are you trying to do all the joins from the same local Administrator user account? If so, you are limited to 10 joins.

. Check the workstation date and time settings

 

[henrymsilva]

bcastner, thanks for all your suggestions but unfortunately, still it did not work. I attached the logs below to give you idea on what is the error...

*********************************
11/05 05:37:50 NetpDoDomainJoin
11/05 05:37:50 NetpMachineValidToJoin: 'MACHINE1'
11/05 05:37:50 NetpGetLsaPrimaryDomain: status: 0x0
11/05 05:37:50 NetpMachineValidToJoin: status: 0x0
11/05 05:37:50 NetpJoinDomain
11/05 05:37:50 Machine: MACHINE1
11/05 05:37:50 Domain: MYDOMAIN
11/05 05:37:50 MachineAccountOU: (NULL)
11/05 05:37:50 Account: MYDOMAIN\ADMIN
11/05 05:37:50 Options: 0x21
11/05 05:37:50 OS Version: 5.1
11/05 05:37:50 Build number: 2600
11/05 05:37:50 ServicePack: Service Pack 2
11/05 05:37:50 NetpValidateName: checking to see if 'MYDOMAIN' is valid as type 3 name
11/05 05:37:50 NetpCheckDomainNameIsValid [ Exists ] for 'MYDOMAIN' returned 0x0
11/05 05:37:50 NetpValidateName: name 'MYDOMAIN' is valid for type 3
11/05 05:37:50 NetpDsGetDcName: trying to find DC in domain 'MYDOMAIN', flags: 0x1020
11/05 05:38:05 NetpDsGetDcName: failed to find a DC having account 'MACHINE1$': 0x525
11/05 05:38:05 NetpDsGetDcName: found DC '\\SERVER1' in the specified domain
11/05 05:38:05 NetUseAdd to \\SERVER1\IPC$ returned 5
11/05 05:38:05 Trying add to \\SERVER1\IPC$ using NULL Session
11/05 05:38:05 NetpJoinDomain: status of connecting to dc '\\SERVER1': 0x0
11/05 05:38:05 NetpGetLsaPrimaryDomain: status: 0x0
11/05 05:38:05 NetpGetDnsHostName: Read NV Hostname: MACHINE1
11/05 05:38:05 NetpGetDnsHostName: PrimaryDnsSuffix defaulted to DNS domain name: MYDOMAIN.com
11/05 05:38:05 NetpLsaOpenSecret: status: 0xc0000034
11/05 05:38:05 NetpGetLsaPrimaryDomain: status: 0x0
11/05 05:38:05 NetpLsaOpenSecret: status: 0xc0000034
11/05 05:38:06 SamConnect to \\SERVER1 failed with 0xc0000022
11/05 05:38:06 NetpJoinDomain: status of setting machine password: 0x5
11/05 05:38:06 NetpJoinDomain: initiaing a rollback due to earlier errors
11/05 05:38:06 NetpLsaOpenSecret: status: 0x0
11/05 05:38:06 NetpJoinDomain: rollback: status of deleting secret: 0x0
11/05 05:38:06 NetpJoinDomain: status of disconnecting from '\\SERVER1': 0x0
11/05 05:38:06 NetpDoDomainJoin: status: 0x5

********************************

Any suggestions anyone?

Thanks.

 

[bcastner]

It appears that the Window 2003 server has a complex password policy in place, and the workstation is using a password that fails the complexity test.

See this entire newsgroup discussion in which the same issue from your log above (11/05 05:38:06 SamConnect to \\SERVER1 failed with 0xc0000022) is discussed and resolved by Microsoft support:

http://groups.google.com/groups?hl=...iled+with+0xc0000022&hl=en&btnG=Google+Search

 

[henrymsilva]

Hi.. Thank you for the tip... I tried applying the solution they found but it did not work with me.. I believe this is a trial and error fix... no definite procedure... xp sp2 really sucks

 

[bcastner]

Time to do your own hit or miss. XP SP2 support is without charge:

http://support.microsoft.com/oas/default.aspx?ln=en-us&x=20&y=10&c1=509&prid=8101&gprid=273354

 

[henrymsilva]

Thanks.. It seems we are thinkin the same thing ..I just did that a while ago..