I would actually prefer if you can send us reports generates from this
tool.
Microsoft Product Support's Reporting Tools
http://www.microsoft.com/downloads/...7C-7CA5-408F-88B7-F9C79B7306C0&displaylang=en
It creates a CAB file when it finishes generating all reports. If you
can email me that CAB file from the DC, that would give me a good idea
of what's up.
Also I would need a MPSREPORTS CAB file from a client machine where
you are facing the issues.
And yes, what are the many ways in which Microsoft suggests to fix the
issue. we could probably glean on those as well.
--
Gautam Anand
e: gautam at hotpop dot com
---------------------------------
"Ace Fekay [MVP]"
message | In | aaron.whittaker <
[email protected]> made a post then I
commented
| below
| > I have 2 domain controllers, yes there is replication between the
2.
| > Every hour. Modifications do appear on the other DC.
| >
| > But I am in Australia. I have one dc here. I also have another
| > domain controller that is in the US. All changes are done on the
Aust
| > DC. So I would think that it is irrelevant that we have another
| > server because it is never used by anyone in Australia. And I am
only
| > concerned with Australian users. Although all replication that I
have
| > tested and monitored is updated on the US server it would have
nothing
| > to do with the users trying to logon in Australia.
| >
| > 3. Can you Email me the output of DCDIAG /V and NETDIAG /V run on
all
| > DCs and also one run on the Client Machine
| > All documentation instructs me to do the following.
| > Click Start, click Run, type cmd (or command) in the Open box, and
| > then click OK.
| > At the command prompt, type DCdiag /v, and then press Enter.
| > and then i get
| > 'dcdiag' is not recognized as an internal or external command,
| > operable program or batch file.
| > I tried this on dc (2000), a 2003, and xp machine. They all
produced
| > the same error.
| > Why does this not work?
| >
| > 4. Definitely is network issues. It could be Name Resolution (DNS)
| > misconfiguration. It could be a bad wire somewhere or a bad piece
of
| > Network Hardware like the switch or NIC.
| > Could it really be a NIC as this is happening on multiple
machines?
| > All of these machines can get to the domain controller, and other
| > network resources via, remote desktop, UNC, and ssh.
| >
| > 5. It could be excessive traffic on your network - probable
reasons
| > Viruses propagating, Bad hardware. Im sure there are more.
| > I would hope that this is not the case. I check the Virus server.
| > Our network is has no viruses at the moment.
| > If someone's account is locked out (which is what this issue is
| > causing), I unlock their account and then they can immediately log
in.
| > This would suggest that each client can in-fact talk to the dc but
| > for some reason it just won't prompt them for a password change.
I
| > did however have someone who could not even change their password
| > after I unlocked and reset their password. They had to login and
then
| > go ctrl alt del, and change their password that way. I don't know
if
| > that is related, because they never told me what password they
were
| > trying to change it to. We do have GPO's which do the following.
| > Must be eight characters, have 3 different types of characters in
the
| > password. And it can't be the previous 3 passwords. So they
could
| > have just not been trying one that the GPO would allow.
| >
| > Also a lot of users leave their machines locked not logged out, as
| > they are developers with many items opened. So this would cause
| > machines never to ask for a new password. But most of them are
smart
| > enough to restart when exchange tells them that their password has
| > expired. So they do this but when they attempt to log back in, it
| > will either: allow them into their machines (with no ability to
access
| > network resources), or lock their account with no password prompt.
|
| 1. Curious, you mentione MS states multiple ways to fix this. I
asked
| earlier, but still curious, since you haven't responded to what you
read.
|
| 2. Also, if you have DCs across WAN links, and you are having
problems on
| one side, as Gautam suggested, it could be heavy traffic across the
WAN,
| slow WAN link, etc.
|
| 3. Also, the password change issue can be attributed to the PDC
emulator not
| being available, which can either indicate a DNS issue or WAN link
| communication issue, or both. Which machine holds that role?
|
| 4. In DNS, is there a DNS server in both locations? Are the zones AD
| Integrated? If yes or no, do the zones on both DNS have the same
exact copy
| of data, and the SRV records exist?
|
| 5. Is there a GC in Australia?
|
| 5. For netdiag and dcdiag, install the support tools off the Windows
CDROM.
| THen go to a CMD prompt and run them with the switches you
specified.
|
| 6. Is your domain a single label name?
|
| 7. Can you post an unedited ipconfig /all from both DCs from both
locations
| please?
|
| Thanks!
|
| --
| Regards,
| Ace
|
| Please direct all replies ONLY to the Microsoft public newsgroups
| so all can benefit.
|
| This posting is provided "AS-IS" with no warranties or guarantees
| and confers no rights.
|
| Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
| Microsoft Windows MVP - Windows Server - Directory Services
|
| Security Is Like An Onion, It Has Layers
| HAM AND EGGS: A day's work for a chicken;
| A lifetime commitment for a pig.
| --
| =================================
|
|
