M
Marphyre
The guy before me at this company was a little DC crazy. The original
setup was 14 domain controllers (this is a network distributed over a
VPN WAN at 14 offices), approximately 170 XP workstations. I had
installed SP1 and R2 on all of the servers, and have slowly demoted all
but 2 here at the main office (that much replication traffic was just
plain unneccessary). 7 of these demoted servers are running fine. The
other 5 are having two specific problems - they will not update Group
Policy and they will not let me log into Remote Desktop using any
domain credentials - administrator or otherwise. Everything else is
running fine (they are also file/print servers, and some run a few
other tasks). An interesting point that I noticed is that if I ping
the domain name itself, sometimes it reports back one of the older
DC's. If I then run ipconfig /displaydns, under the domain name there
will be 4 servers - 2 are my current DC's and 2 are 2 of the other
servers that have been demoted. This same point will happen on
workstations also - they report the same 4 servers under my domain
name. I have cleaned everything I can find on the old DC's out of DNS
and WINS. I have tried removing one of the demoted servers from the
domain and rejoining it, and have the same problems. I have ran many
tools on these 5 servers and made sure that they are able to
communicate with the current DC's with no problems. The only problems
that I can come up with are the Group Policy and Terminal Server issues
(with TS, I can log into these servers using local users, just not
domain users). Here are the event log messages I'm getting that relate
(taken from one of the 5 demoted servers giving problems):
Application log:
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1054
Date: 3/30/2006
Time: 12:25:57 PM
User: NT AUTHORITY\SYSTEM
Computer: {name}
Description:
Windows cannot obtain the domain controller name for your computer
network. (An unexpected network error occurred. ). Group Policy
processing aborted.
The following two occur when I attempt to log in with Remote Desktop:
Application log:
Event Type: Error
Event Source: Winlogon
Event Category: None
Event ID: 1219
Date: 3/30/2006
Time: 2:02:50 PM
User: N/A
Computer: {name}
Description:
Logon rejected for DOMAIN\user. Unable to obtain Terminal Server User
Configuration. Error: Access is denied.
System log:
Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 3/29/2006
Time: 10:10:38 AM
User: N/A
Computer: {name}
Description:
The Security System detected an authentication error for the server
cifs/{dc name}. The failure code from authentication protocol Kerberos
was "There are currently no logon servers available to service the
logon request.
(0xc000005e)".
I've been working on this for a few days, and so far my buddy Google
hasn't found anything, so I'm hoping someone here can help! Thanks in
advance...
setup was 14 domain controllers (this is a network distributed over a
VPN WAN at 14 offices), approximately 170 XP workstations. I had
installed SP1 and R2 on all of the servers, and have slowly demoted all
but 2 here at the main office (that much replication traffic was just
plain unneccessary). 7 of these demoted servers are running fine. The
other 5 are having two specific problems - they will not update Group
Policy and they will not let me log into Remote Desktop using any
domain credentials - administrator or otherwise. Everything else is
running fine (they are also file/print servers, and some run a few
other tasks). An interesting point that I noticed is that if I ping
the domain name itself, sometimes it reports back one of the older
DC's. If I then run ipconfig /displaydns, under the domain name there
will be 4 servers - 2 are my current DC's and 2 are 2 of the other
servers that have been demoted. This same point will happen on
workstations also - they report the same 4 servers under my domain
name. I have cleaned everything I can find on the old DC's out of DNS
and WINS. I have tried removing one of the demoted servers from the
domain and rejoining it, and have the same problems. I have ran many
tools on these 5 servers and made sure that they are able to
communicate with the current DC's with no problems. The only problems
that I can come up with are the Group Policy and Terminal Server issues
(with TS, I can log into these servers using local users, just not
domain users). Here are the event log messages I'm getting that relate
(taken from one of the 5 demoted servers giving problems):
Application log:
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1054
Date: 3/30/2006
Time: 12:25:57 PM
User: NT AUTHORITY\SYSTEM
Computer: {name}
Description:
Windows cannot obtain the domain controller name for your computer
network. (An unexpected network error occurred. ). Group Policy
processing aborted.
The following two occur when I attempt to log in with Remote Desktop:
Application log:
Event Type: Error
Event Source: Winlogon
Event Category: None
Event ID: 1219
Date: 3/30/2006
Time: 2:02:50 PM
User: N/A
Computer: {name}
Description:
Logon rejected for DOMAIN\user. Unable to obtain Terminal Server User
Configuration. Error: Access is denied.
System log:
Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 3/29/2006
Time: 10:10:38 AM
User: N/A
Computer: {name}
Description:
The Security System detected an authentication error for the server
cifs/{dc name}. The failure code from authentication protocol Kerberos
was "There are currently no logon servers available to service the
logon request.
(0xc000005e)".
I've been working on this for a few days, and so far my buddy Google
hasn't found anything, so I'm hoping someone here can help! Thanks in
advance...
