Bizzare issue

  • Thread starter Thread starter Invisible
  • Start date Start date
I

Invisible

I have a really bizzare issue! :-S

Server X is a file server. It serves files.

That is, it serves files... until I promote it to be a DC. Then it stops
serving files. And the only way to get it to work again is to demote it
back to being a member server.

I really need to fix this; we NEED our fileserver, but we also NEED more
than one DC. Apart from server X, there is only 1 other DC, and if
something happens to that... OK, I'm feeling really nervus here!


So, in detail then...

Server X is a member server. Everything works how it should. (The domain
works, file shares on server X works... everything works.)

I promote server X to be a DC. (Same domain - I'm not changing anything
there!) Promotion works just fine. Server is now a DC. I can still
browse the files on it. Great.

At some later point in time, I reboot server X. Oh dear... now, as soon
as I click it in network neighborhood, a little box pops up and says
"access denied". What on earth...?

And yet, I cannot find *anything* wrong with the domain. All the DNS
records are there, server X is pointing to the right DNS server, pinging
works fine, etc. I tried making directory alterations on *both* DCs; the
changes replicated from one to the other without issue.


And now, the most bizzare part: only the Windows NT workstations have a
problem. All the Windows 2000 and Windows XP machines apparently have no
problem. (98% of our computers are Windows NT - so the above isn't much
use!)

[I notice that the other domain controller is also a file server - and
shows no problems at all!]

Does anybody have ANY ideas here?
 
Hi Invisible,

The real key to this is that you mentioned that you can't share files to NT
workstations. The problem that you are seeing is SMB signing. To be able
to share files, you'll need to turn this off.

***************** Per Microsoft ********************************
You can disable SMB service signing in the following node of Default Domain
Controllers policy on the domain controllers organizational unit:
Computer Configuration\Windows Settings\Security Settings\Local
Policies\Security Options\Microsoft Network Server: Digitally sign
communications (always)

If domain controllers are not located in the domain controller's
organizational unit, you must link the default domain controller's Group
Policy object (GPO) to all organizational units that host Windows 2000 or
Windows Server 2003 domain controllers. Or, you can configure SMB service
signing in a GPO that is linked to those organizational units.
 
Ryan said:
Hi Invisible,

The real key to this is that you mentioned that you can't share files to NT
workstations. The problem that you are seeing is SMB signing. To be able
to share files, you'll need to turn this off.
Click to expand...

Thank you! You just saved my life... (And my sanity!)

This was of course complicated by the fact that just about every policy
setting can be altered from 5 different places, each using 7 different
tools, the results of which combine in ways which are really quite
difficult to follow. This is further complicated by the fact that
changes take time to replicate from DC to DC, and further complicated by
the fact that this particular change only seems to take effect after a
reboot. (Which, presumably, explains why it initially works, until you
reboot...)

As you can probably tell, even with your help, I've had fun with this...

Still, it now FINALLY works like it was supposed to in the first place.
Maybe now I can get some rest! >_<
 
Back
Top