Here's an odd problem that arose between a Win2K laptop, and it's NT 4 PDC... [Archive] - SpeedGuide.net Broadband Community

View Full Version : Here's an odd problem that arose between a Win2K laptop, and it's NT 4 PDC...


YeOldeStonecat
04-10-02, 03:13 PM
Small 20 node network with single NT 4.0 server running as PDC, with Exh 5.5, and RRAS for some outlying offices.

Laptop that last year I rebuilt with Win2K Pro....set to log onto the domain....and the user always traveled with the laptop, logging on with cached information instead of changing to a local log on account.

2 months ago.....she outgrew her 6.4g HD...so I used Apricorn's EZGig drive transfer to copy her image to a new 10 gig drive. Everything copied fine...no problems whatsoever except for the complaints of her computer running quite slow (new drive was a Hitatchi...no wonder).....too slow for this power user. So about 6 weeks or so go by....she complains of how slow the computer is. I think perhaps a faulty drive.....get the Hitatchi RMA'd.....she gets shipped a nice new IBM Travelstar 10 gig drive.

Now here's the key.....since I wonder if her current slow drive image may be slightly corrupted, since she still has her original 6.4 gig drive as a backup....I imaged that 6.4 gig drive to her new replacement 10 gig drive.....and when that completed last night...it appeared everthing was fine...ran peppy...logged on and off several times on the laptop down here at the shop. She also took it home and started copying back data she had backed up at her home LAN, did her internet stuff, etc. What I mean by "Here's the key"....is that her original 6.4 gig drive has an image almost 2 months old. Her computer kept logging onto the domain over the past 2 months on the drive that I yanked out, so it's cached domain info evolved/changed over time (I obviously didn't think of this last night) Now this morning, she gets to work....pops the laptop into her docking station (with the image that's 2 months old)...and gets an error:

"The following error occured while attempting to join the domain <nameofdomain>. Log on failure unknown username or bad password."

No her domain account did not change. She can log onto other workstations at the office fine so nothing wrong with her user account or the server. If she disconnects the patch cable to her laptop, she can log on again using cached domain info...but plug the patch cable in....try to log on....nothing.

So I go to user manager, remove her computers account....let some time go by....try again..nothing. I add her computers account manually at the server....still nothing.

I have her change her laptops network properties to log into the workgroup instead of domain....reboot....then try to join the domain again....what comes up is the same error as above.

On the servers event viewer....with each attempt:

NETLOGON Event 5722 The session setup from the computer <nameofcomputer> failed to authenticate. The name of the account referenced in the security database is <nameofcomputer$>. The following error occurred: Access is denied.

I tried changing the NetBIOS name of the computer and tried to join the domain again...no luck.

I am trying to join the domain with known domain admin user accounts.

I stopped/started netlogon service.

I found references to a utility called netdom where you can manually update domain member info.....but it doesn't work, gets an access denied error trying to access the laptop across the network.

So....do I have to remove the user profile on the laptop...and create a new one? So much information to rebuild....might as well format it.

She's now just logging onto the laptop with a local workgroup account....username and password matching the domain account...and she can access the server's shares, etc...but I have to get her domain logon back.

???

twwabw
04-10-02, 04:18 PM
Hi YOSC-

When you imaged, you should have used sysprep. Her sid has changed, but still using the same machine ID and account info.

You've got to get rid of all traces of prior account now.

Delete pc in server manager. Delete mapping in DHCP manager. Finally, go into WINS manager, and delete the records that match the machine name- all of them. Don't tombstone them- delete them.

Then have the pc join the domain again.

YeOldeStonecat
04-10-02, 06:09 PM
Sysprep......gotta look that up and see what it is.

So you're thinking also going into DHCP and WINS, cleaning it out of there, will clear everything? I was thinking I have to somehow clear whatever tags she has locally on her machine. Was wondering what would happen if I deleted her userprofile locally for <username>/<domainname>. Will give it a go tomorrow morning.

twwabw
04-10-02, 07:16 PM
Sysprep is great- it's an MS utility, to be used in conjunction with imaging applications. As you know, you can't ghost a domain member pc, with having the sid's duplicated. You can only ghost it as a workgroup pc, start it up, rename it off the network, then have it join the domain- big pain.

With sysprep, you prepare the entire image pc the way you want it- apps, settings, etc. Then, you apply sysprep to the image. Now, when a new ghosted pc is booted for the 1st time, it looks like a new Windows install at first- asks you for pc name, admin password, etc. You also enter new CD-key / product ID here, which helps keep licensing straight. You're then prompted to join the domain, and voila! It's done. New unique SID, off a ghosted image.

As far as your situation, yes- delete all local profile info. too. Delete all domain profiles on there as well- clean it up. And yes- wipe any traces of it from WINS and DHCP. You should be good to go.

PM me if you want a copy of sysprep, instead of hunting all over MS for it.

YeOldeStonecat
04-11-02, 07:52 AM
Plz check yer PM.