Clients Cannot List Active Directory Users

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hey,

I am stumped with an issue concerning our Domain Controller.
Its a Windows 2000 Machine running AD, DHCP and DNS... actually it basically
runs everything since it is our only server...

The Issue is: From the client computers in the domain I cannot seem to
access the AD/LDAP information. And therefore not list users (When trying to
add share permissions for example). If I simply type in the name the server
returns the correct information. But it cannot enumerate users…

There is no problem on the server itself. It can access the Active Directory
fine….
Only the clients have the problems...

# Additional Issues on the clients… Most likely all related to the same
problem:

---------------------------------------
EventViewer on client:
---------------------------------------
Source : UsrEnv
Event ID : 1000

Windows cannot establish a connection to <DomainName> with (10053).

---------------------------------------
Administrative tools on client:
---------------------------------------
# Cannot connect to Domain Server with:
“Active Directory Domains and Trustsâ€
“Active Directory Sites and Servicesâ€
“Active Directory Users and Computersâ€.

---------------------------------------
ldp.exe:
---------------------------------------

# When Trying to connect it returns this message:

ld = ldap_open("<DomainName>", 389);
Established connection to <DomainName>.
Retrieving base DSA information...
Error<94>: ldap_parse_result failed: No result present in message
Getting 0 entries:

# However when trying to connect with the ‘connectionless’ tick enabled it
gives back a hole bunch of data. But then it failes on the bind operation
with:

res = ldap_bind_s(ld, NULL, &NtAuthIdentity, 1158); // v.3
{NtAuthIdentity: User=’<UserName>'; Pwd= <unavailable>; domain =
'<DomainName>'.}
Error <2>: ldap_bind_s() failed: Protocol Error.

=============================

I just do not know what could be wrong...
Any Help would be greatly appreaciated...

Thanks in advance,

R. Bayes
 
What server do your clients point to for DNS? What server does the DC point
to for DNS in the properties of TCP/IP?


DDS
 
All clients point to the server (192.168.0.1) for DNS (Distributed via DHCP)
The Server itself also points to itself (192.168.0.1) for DNS in the TCP/IP
properties.
 
Hey Updated information... I have just found that I can connect to the server
with the management console... and additionally that it is also possible to
list the Computers that are in the directory... Just not the Users...

Hope this helps the question...

R. Bayes
 
Yes I alreaddy had a look at them and yes they are all there... perhaps a few
to many... even after i deleted some they came back again (as expected) so
the AD does register with the DNS...

I just dont have a clue .. heh...

Regards...

R. Bayes
 
Hey,

Another Error I found on the server this time. After I started up there was
the following event...
=================================
Event Type: Warning
Event Source: NTDS Inter-site Messaging
Event Category: Inter-Site Messaging
Event ID: 1369
Date: 11/08/04
Time: 8:26:37 PM
User: N/A
Computer: SERVER
Description:
The Inter-Site Messaging Service requested an LDAP one-level search starting
at container object CN=Sites,CN=Configuration,DC=blabla,DC=blabla,DC=blabla.
The operation failed with the following message:

The specified server cannot perform the requested operation.
=================================

I am almost sure that the LDAP service is not running or not responding
propperly...

Are there security settings for the LDAP access?
Or Any other reasons why I woul dnot be able to access the LDAP service?

Thanks again,

R. Bayes
 
At this point I would make sure there was not a hardware issue. Maybe switch
out the NIC, maybe change ports on the hub/switch that the server is plugged
in to.

Not too sure what is going on.


hth
DDS
 
Just a guess coming from me, but the 192.168.0.1 address sounds like
you've got ICS running on the DC (which you need to abolish if it is
set up that way), or at least with the problems the clients are having
you are running multiple NICs on the DC. Nevertheless, problems with
enumerating security principals in a 2k/2k3 environment come down to
DNS. I would make sure you dont have any unreachable (to the clients)
IPs for the DC that show up in DNS and really go through it with a
fine-toothed comb.

Chris Malone
 
Back
Top