Domain users accounts corrupted

  • Thread starter Thread starter Endre
  • Start date Start date
E

Endre

Hi,

I'm experimenting with a software called VMware, which
lets you build up images of virtual machines. The software
is not really of concern, for all intents and purposes the
result is a totally simulated machine with it's own
installation of windows, own instance on the network, it's
own IP. The only complications I can see are the fact that
these images can be copied in order to create several
variants without starting from scratch every time. When
this is done the copy virtual machine is started up and I
assign it a new computer name so that doubles will not
occur...

However, I've been having the problem that users of a
domain that have been granted access to the virtual
machines are spontaneously being unresolved. What I mean
is that all user accounts that have previously been
granted access to the virtual machine can no longer log on
due to the following error message:

"The system cannot log you on to this domain because the
system's computer account in its primary domain is missing
or the password on that account is incorrect."

The only way to log on is to use the local machine logins,
(such as "administrator") which do not suffer from this
problem. Once logged on, if you view the users and groups
properties in computer management, the domain users
accounts display as "\S-1-5-21-85988...etc".

After all this time I have not been able to isolate a
solid pattern or cause to when and why this occurs, so I'm
starting to think It's not related to VMware. A coworker
has some experience with this effect when using Norton
Ghost, where if he saves an image of a computer that is
connected to a domain, when the image is reloaded the
computer must manually be disconnected and then
reconnected to the domain in order to resolve the domain
users and groups. I believe this similarity is the key,
and of course I can resolve the virtual machines the same
way temporarily, but I'm not sure how to resolve this
permanently. I heard it may have something to do with a
kind of machine ID that expires?

At first I thought it was just a fluke or related to some
other problem and I could clean it up, but it's getting to
the point that I've spent half my time just logging in to
fix these errors, which I see now reoccur continuously.
Does anyone have any ideas as to a resolution, or at least
identify what is causing the machines to unresolve the
user accounts? Please, any input is appreciated and
needed!!! :'(


Thanks!!!
 
Most of the time when I have seen unresolved sids, the system you were on is
having a hard time resolving the name from the dc. How is DNS/WINS
Configured?

Have you run Netdiag /v on the system you are seeing this on, any errors?
Check that on dc as well to make sure it isn't a weird name resolution
issue. That would be a good place to start and double check yourself.
--

Brian Oakes

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit.
 
When you clone a machine using Ghost, you also clone the Security Identifier (SID). You must change the SID after cloning before logging onto the domain. Ghost has a tool to do this. MS uses sysprep. I don't know if this is related to your user issue, but I have seen a similar issue where a workstation logs off one domain, onto another, then back again and the user profiles are lost as you describe.
 
Thanks for the help and pointers! I will investigate as
time permits...

-----Original Message-----
When you clone a machine using Ghost, you also clone the
Security Identifier (SID). You must change the SID after
cloning before logging onto the domain. Ghost has a tool
to do this. MS uses sysprep. I don't know if this is
related to your user issue, but I have seen a similar
issue where a workstation logs off one domain, onto
another, then back again and the user profiles are lost as
you describe.
 
Back
Top