Problem logging users in to 2k3 domain

Ok, heres a slight problem I'm having right now that i haven't seen before.

I've tried google, support.microsoft etc etc. no joy


I just finished installing 2K3 Enterprise on a server, installed AD, and DNS on it. Created my users, but when I try to login to the domain from a computer it says that it cannot log me in.

Logging in as "Administrator" works, but logging in as a user/domain user does not work.

I've created about 10 different test users, but none of them can log in. If I go to the server itself and try to login, it tells me I cannot log in interactively to this machine. Which of course is cause I don't have "Allow local Login" enabled in the GPO, but at least its finding the user. But not on the workstations :(

I'm somewhat puzzled, my DNS on the workstations are pointing to the AD server, and I have no problems having computers join the domain, I just can't for the life of me get the users to be able to log in from a workstation.


Also another thing, not sure if its associated with this, but when you press CTRL + ALT + DEl to login, and you select the domain to login to a small window pops up that says "Finding Domains, or Refreshing Domain List" Don't remember which one. the only way to make it go away is to CTRL + ALT + DEL again.


Any ideas?

Hi!

What does the event viewer say on the Domain Controller?

Are there any DNS errors in there too?

It looks like the workstation can't find the domain controller when it tries to log the user on......is it configured for the correct domain?

I would expect you to find errors along the lines of 'a suitable domain controller can not be found for the configured domain' in the workstation logs.....

Just out of interest - Does the work station have a Static IP or DHCP'd?

Whats the exact error message you get when trying to login to the domain with a user?

Edit: Because its a fresh install, you could demote/promote the dc.

Theres no errors in the event viewer about the Domain Controller, at least none that I could see. I'll check the workstation logs, didn't think of that.

There were a few DNS errors, about not being able to find certain root domains on the net, but nothing concerning the internal network.

The exact error message is "Unable to login to the domain with the specified User/pass" I've checked it like 3 million times, its the right user/pass.


The workstations user DHCP, the servers are Static.

Are your servers pointing to themselves as the primary DNS server?

yes, I only have 1 AD server at the momen which is also the DNS server, and it points to itself for DNS.

Guess I'm having problems getting these computers to see the domain

Quote:

---

Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted.

Automatic certificate enrollment for local system failed to contact the active directory (0x8007054b). The specified domain either does not exist or could not be contacted.
Enrollment will not be performed.

---

But my DNS for the computers point to the AD machine.

As an initial troubleshooting step I woud try deleteing the computer account from the AD and removing the workstation from the domain.

Then from the workstation logon locally and add it back in to the domain, enter the relevant credentials and let it create its own computer account in Active Directory - dont create the computer acount from the domain controller.

It is a two fold thing as if it works all is well, if it doesnt work you will get a more detailed event in the event viewer! :D

But in my experience it is usually a DNS problem or an auto enrollment problem, so I would re-double check you have the correct DNS server IP address configured on the client and then check your auto enrollment settings in the local policy (gpedit.msc).

Also check that the domain controller is pointing to itself for DNS resolution on all network interfaces.

Run a quick nslookup on the workstation to check it can talk to the DNS server and the DNS server is working.

I take it it is XP workstation and 2003 Domain Controller?

I actually never create the computer accounts in AD, just create a use account in AD, the log on from the remote machines...I'double check my DNS settings and my GPO policies.

Hi,

Did you create the computer accounts in that way this time? If so everything must have been working at one point for the workstation to contact the DC and create the Computer Account successfully........? :S

Why not try my suggestion of demote/promote? Surely this would be a less tedious excersise? Ive had a similar problem and trying to get to the bottom of it can be a right bollocks. Especially if youve got no event logs for information!

I'll give the demote/promote thing a try...I don't have event logs though as you'll see in a few posts up.


Nokia:
Yes I created the user accounts this way this time, and in all the previous domain setups I've done. I have no problem joining the domain, or even logging in as the Administrator, just user accounts give me this problem.


Gonna try DCpromo, and your sugesstions as well.


Thanks for the help

Hi mate

The problem is that you have not configured the two GPO's yet
The first is "default domain controllers sec policy and the other is "default domain sec policy".

Just log on to DC with admin and go to "default domain controllers security policy" then go to
computer config-->windows settings-->security settings-->Local policies-->user right assignment
then double click "Allow log on locally option" and add Domain user group and to be on the safer side also add individual domain users to it. So this will allow these users to log on to domain controller machine only.


And for users to log on to domain from workstations, log on to dc with admin account do the same thing as above but this time with "default domain security policy"

Then go to start -->run and type "gpupdate /force"

This should solve ur first problem.

Bye

I don't want them to log onto the Domain controller though...I was just testing if the Domain controller itself would recognize the users.

But did my reply solve your problem?

I haven't tried it yet....but I believe your first part will not solve the problem as allowing users to log on locally, only allows them to log onto the the domain controller itself. Which is what I don't want to do, at least for now, might do it later so I can set up roaming profiles.


I'm not so sure its a problem with users being denied access to the machines, but the machines themselves not able to find the Domain controller. If you go up a few posts you'll see that the event log errors refer to the computer unable to find a domain controller.

when you change your cpmputer mode from "workgroup" to "domain" ,
there have to input the username and password
can you pass this process?

Just wanted to update you guys on this.


I got it going the other day.

The problem ended up being that I had another domain Controller that was running, and I didn't know about it. So basically I had a conflict going on, and I was trying to log onto a domain where I had no users, and that my DNS was not pointing to.

Thanks for the help guys.