Weird Domain Issue

[Carp1812]

I have a rather odd problem regarding a computer that couldn't log in to my AD domain. I have 2 DCs running as replication partners on a fairly small domain. Earlier this week, a particular computer (that hadn't been experiencing any problems for some time) received an error when logging in to the domain. The error message said Windows cannot connect to the domain either because the domain controller is down or otherwise unavailable or because your computer account was not found. I found no errors in the AD tree on the DC servers. I wound up creating completely new user and computer accounts in the AD and removing and rejoining the machine from/to the domain. All seemed to work. Tonight, he rebooted his computer (for the first time since we got it up and running earlier in the week) and got the same error message as before. I checked the AD tree on the servers again and found nothing unusual. His user account is still there, still enabled, etc. His computer account is still there - looks OK. I removed the computer from the domain and rejoined it to the domain and it let him log on with seemingly no problems. However, the local user profile was removed from his computer and he has insufficient permissions to access certain areas of his hard drive when logged in to the domain. Soooooooo.... I added an account to his local users list with the domain and his user name and gave him local administrator permissions. Logged off - logged back on using that same domain name and password that he was just logged on with before, and he now has access to the entire contents of his hard drive. He rebooted the machine again and got the same error message. It doesn't do this when he logs off and back on again, but with every reboot, it fails again. This seems unnecessary to me on a clean machine like this. This machine was completely reformatted roughly a month ago for other reasons and XP Pro was reloaded on it. It has all service packs and critical updates. It has Norton Antivirus running with new definitions - nothing there. It has AdAware running with new definitions - nothing there. When the hard drive was reformatted a month ago, I joined him directly to the domain while installing XP. I don't know if this matters or not. Do you have any suggestions as to why this is happening? Thanks in advance.

 

[wlee]

Perhaps an "un-clean" shutdown ? Maybe his account profile is corrupt? Have you tried blowing it off the PDC and recreating it? ( after backing it up of course )

 

[Carp1812]

Originally posted by: wlee
Perhaps an "un-clean" shutdown ? Maybe his account profile is corrupt? Have you tried blowing it off the PDC and recreating it? ( after backing it up of course )

If you're saying what I think you are, I've already deleted both his user and computer accounts from the DC and created new ones. If that's not what you mean, could you define more clearly "blowing it off the PDC" Thanks.

 

[Carp1812]

Bump

 

[Carp1812]

Still having the problem. Today I tried the following to no avail:

Moved him to another port on the switch
Removed computer from domain
Deleted User and Computer accounts on the AD server
Created new User and Computer accounts of different names than previously on the AD server
Joined computer to domain

Anybody have any other ideas?

 

[Carp1812]

Nobody? Do I need to post other information that I forgot before? Please help.

 

[Fuzznuts]

Originally posted by: Carp1812
Nobody? Do I need to post other information that I forgot before? Please help.

looks to me like youve done all you can. id swap out nic then next step is a reinstall of the os if the nic swap dont work. also ensure that the nic is set to auto not full duplex or some other silly stuff

youve checked servers - clear
recreation of accounts - still exists
affecting others users - no
rename machine and add it to the domain - ?
check network hardware - ?
does it occur if that user logs in from another machine - ?

if the last 3 answers still come up moot then its reinstall time

 

[treetop]

try rename the machine to a different name.

 

[tippmann]

I had similar problems... I ended up changing the computer name and removing the the old compter name form AD before it worked again.

I don't think it would have anything to do with the user account.

Maybe the nic?

 

[Carp1812]

Thanks all for the input. I've done everything you guys have suggested thus far in regards to renaming it, removing the old name from the AD, etc. I'm gonna put a new NIC in it when I get a chance and see if that helps at all. Thanks for your help.

 

[wlee]

*TAKING A LONG SHOT*

You didn't make the mistake of having the machine name identical to the user login name did you ? This was allowed in Win98/WinNT4, but not in XP. I discovered that XP would allow this ( identical machine and user name ) *IF* you did an upgrade install on a Win98 machine where that condition already existed. I seem to recall this was a "no-no" for AD.

 

[MysticLlama]

Actually, XP Pro will let you have the username and machine name match, but only IN a domain environment.

At work with the AD, computernames and usernames match, at home without AD it won't let me do that.