SailingNut

Was just thinking that maybe Windows Easy Transfer might work? What do you think? The next big thing would be exactly what settings, etc. Do I need to have Easy Transfer backup & restore. Sounds like some homework for me!

Luckily for me, I have been running a full backup every night, so I restored to that and the server is back in order. On the workstation side, I'm probably just going to re-load it with Windows 7. (it currently has Vista.) However, there is one more workstations that could possibly be hit with this. So, could you point me to a good resource for how to copy profiles and restore them? I need the "for dummies" version! ;-) Thanks!

That may be possible, but the biggest thing is that when I try to locally log into the SERVER it gives me the same error! So I have one workstation that is a member of the domain that has the problem AND the server has the problem. That is the oddest thing to my, why would the server be messed up. I should be clear, the server that I speak of is the only domain controler in the network. So it is not like I have a member server that is behaving badly and can't authenticate with the DC. The DC says it can't authenticate with itself!

Unfortunately, I had already tried the suggestion that you gave here and it did not work.I then moved on to the suggestion in the link I posted and that's when trouble struck big time! My big problem is that the server is doing that when I attempt to log in! It's really odd because I did not make any changes to the server account! I only edited the workstation account for the PC having the problem. So, I'm not sure if it is a problem with an update that I applied or what. Luckily I have been running nightly full backups on the server so I should be able to restore to that. I just hope I can get into the restore console to do that. (I disabled the local machine administrator account for "security" reasons. Just like most pleaces advise you to do.) I'm wondering if all of this is related to my botched server upgrade process that ICTCity helped me through a while back.

OK, I've had this problem with a couple of workstations in the domain before. With them I just un-joined the domain and re-joined the domain and presto, fixed! Well I had the same problem on another workstation where I didn't want to loose all of the local user account settings so I began searching on the Internet and found the following solution. One difference is that my problem is with a workstation. (I DID edit the workstation record NOT the server.) After doing that I applied a few updates that were available for the server and rebooted. Well now when I TRY to log into the server I'm getting the error paraphrased in the title. The full error is: "The security database on the server does not have a computer account for this workstation trust relationship." I'm not completely shut out of my server! Any ideas? Oh, I should mention that I'm pretty much a hack when it comes to server administration. This is a domain in my home with 5 client machines. TIA!

It's Win7 SP1 It's the only client having the problem, but we really don't have to login to our other systems much because we keep them running. I can't really test on the laptop because I left and re-joined the domain and the problem went away.

The setting on the server was already set to "Not Configured" and I checked on the client and there are no network policies set on the client. However if I run ipconfig /all I do see that a primary DNS suffix is set. (Not sure if this is related or not.)

OK, now for the first real operational problem! I have a laptop that we hibernate when not in use. We have opened it up & logged in several times since the domain changes. Well now when trying to unlock the machine (it exits hibernation in a locked state) I get the following error (with a known good passeord, have tried several times) "The security database on the server does not have a computer account for this workstation trust relationship" I tried creating a machine account for the computer on the server, but to no avail. :-( I have searched on Google a bit and have not found any satisfactory answers. I think this all points back to the SID problem that I mentioned the other day. What do you think? Looking forward to an answer! My wife is not happy without her laptop! And I'm even more unhappy without it! ;-) Thanks!

Glad I could give at least a little something back!

FYI, I now have a completely "clean" dcdiag report. It turns out the DHCP problem was that I had to "authorize" the DHCP server back into the domain after demoting and promoting. I found a problem where it was not handing out an address to my laptop connected on WiFi. I opened up the DHCP panel and it told me that I needed to authorize it and told me to right click on my domain name in the panel and select ahtorize. How simple was that?!?!? Hope this tidbit comes in handy for you some time in the future!

First operational hiccup....... My 2003 server is still on the network but demoted to a standalone server. I tried to log into it with a domain administrative account and it failed to authenticate. I had to log into the local computer. It this to be expected since I demoted it and it's no longer a member of the domain or is it failing because of some other reason? I checked the computer properties and it still thinks it's a part of the domain, so there may be some other problem lurking.

OK, I was worried about seeing errors in the event viewer and that it could catch up with me down the road. I'd love to get rid of the errors, but I don't want to jump through a bunch of hoops if they really aren't going to cause any problems. Thanks for all of your help! I'm not seeing any operational problems now!

I'd like to avoid that because I think it will wipe out the personal settings & etc. for each domain user on that computer. (Or am I completely wrong?)

The computer X are the workstation computers in my network. There is nothing in AD Domains & Trusts. When I right click on it & select manage it opens AD Users & Computers and that is where I added the computer account. (Trying to replicate on the server what happens when you join a machine to the domain.)

One more question, I'm getting errors in the event log saying that "The computer X tried to contact the server using the trust relationship established by the WTBHOME domain. However, the computer lost the correct security identifier (SID) when the domain was reconfigured. Reestablish the trust relationship." Where X is any of the machines on my network. I did some searching and the suggestion was to delete the couputer account from the domain and re-create it. Well, in my case there is no computer account in the domain, so I just created one. But, it still appears that the problem exists. Any ideas?

Permissions on SYSVOL are as follows: CREATOR OWNER - Special Permissions Authenticated Users - Read & execute, List folder contents, Read SYSTEM - Full control Administrators - Special permissions Server Operators - Read & execute, List folder contents, Read After performing the steps you suggested, I'm still getting a couple of errors in dcdiag. Here's the output: Directory Server Diagnosis Performing initial setup: Trying to find home server... Home Server = big-rig * Identified AD Forest. Done gathering initial info. Doing initial required tests Testing server: Default-First-Site-Name\BIG-RIG Starting test: Connectivity ......................... BIG-RIG passed test Connectivity Doing primary tests Testing server: Default-First-Site-Name\BIG-RIG Starting test: Advertising ......................... BIG-RIG passed test Advertising Starting test: FrsEvent ......................... BIG-RIG passed test FrsEvent Starting test: DFSREvent There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems. ......................... BIG-RIG failed test DFSREvent Starting test: SysVolCheck ......................... BIG-RIG passed test SysVolCheck Starting test: KccEvent ......................... BIG-RIG passed test KccEvent Starting test: KnowsOfRoleHolders ......................... BIG-RIG passed test KnowsOfRoleHolders Starting test: MachineAccount ......................... BIG-RIG passed test MachineAccount Starting test: NCSecDesc ......................... BIG-RIG passed test NCSecDesc Starting test: NetLogons ......................... BIG-RIG passed test NetLogons Starting test: ObjectsReplicated ......................... BIG-RIG passed test ObjectsReplicated Starting test: Replications ......................... BIG-RIG passed test Replications Starting test: RidManager ......................... BIG-RIG passed test RidManager Starting test: Services ......................... BIG-RIG passed test Services Starting test: SystemLog An error event occurred. EventID: 0x00000423 Time Generated: 05/16/2011 14:40:47 Event String: The DHCP service failed to see a directory server for authorization. ......................... BIG-RIG failed test SystemLog Starting test: VerifyReferences ......................... BIG-RIG passed test VerifyReferences Running partition tests on : ForestDnsZones Starting test: CheckSDRefDom ......................... ForestDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... ForestDnsZones passed test CrossRefValidation Running partition tests on : DomainDnsZones Starting test: CheckSDRefDom ......................... DomainDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... DomainDnsZones passed test CrossRefValidation Running partition tests on : Schema Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Running partition tests on : Configuration Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Running partition tests on : wtbhome Starting test: CheckSDRefDom ......................... wtbhome passed test CheckSDRefDom Starting test: CrossRefValidation ......................... wtbhome passed test CrossRefValidation Running enterprise tests on : wtbhome.net Starting test: LocatorCheck ......................... wtbhome.net passed test LocatorCheck Starting test: Intersite ......................... wtbhome.net passed test Intersite

Time service is running and it is started in the Local Service account

OK, somehow the time service got started since I last rain dcdiag. I then configured the time service to sync to an external source. However, dcdiag is still complaining abot the time service and being configured to use the domain hirearchy and that it can't find a time server. This is really odd since I did reconfigure the time service using w23tm /configure and for good measure I rebooted the server and dcdiag still has that time error. I checked the registry and I do see that the two external time servers I configured are in the registry, but it would appear that it is still configured to use the domain not the external servers I set up. What can I do to troubleshoot why this is and discover a fix. Thanks!

So I FINALLY had time to do the demote - rename - promote process you suggested. It appears to have worked. I recreated my domain user accounts and things look good. I do see some errors in dcdiag still, but not sure if they may be expected given my setup. Here's the output: Directory Server Diagnosis Performing initial setup: Trying to find home server... Home Server = big-rig * Identified AD Forest. Done gathering initial info. Doing initial required tests Testing server: Default-First-Site-Name\BIG-RIG Starting test: Connectivity ......................... BIG-RIG passed test Connectivity Doing primary tests Testing server: Default-First-Site-Name\BIG-RIG Starting test: Advertising ......................... BIG-RIG passed test Advertising Starting test: FrsEvent ......................... BIG-RIG passed test FrsEvent Starting test: DFSREvent There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems. ......................... BIG-RIG failed test DFSREvent Starting test: SysVolCheck ......................... BIG-RIG passed test SysVolCheck Starting test: KccEvent ......................... BIG-RIG passed test KccEvent Starting test: KnowsOfRoleHolders ......................... BIG-RIG passed test KnowsOfRoleHolders Starting test: MachineAccount ......................... BIG-RIG passed test MachineAccount Starting test: NCSecDesc ......................... BIG-RIG passed test NCSecDesc Starting test: NetLogons ......................... BIG-RIG passed test NetLogons Starting test: ObjectsReplicated ......................... BIG-RIG passed test ObjectsReplicated Starting test: Replications ......................... BIG-RIG passed test Replications Starting test: RidManager ......................... BIG-RIG passed test RidManager Starting test: Services ......................... BIG-RIG passed test Services Starting test: SystemLog An error event occurred. EventID: 0x0000040B Time Generated: 05/15/2011 20:30:39 Event String: The DHCP service was unable to create or lookup the DHCP Users local group on this computer. The error code is in the data. An error event occurred. EventID: 0x0000040C Time Generated: 05/15/2011 20:30:39 Event String: The DHCP server was unable to create or lookup the DHCP Administrators local group on this computer. The error code is in the data. An error event occurred. EventID: 0xC0001B61 Time Generated: 05/15/2011 20:30:43 Event String: A timeout was reached (30000 milliseconds) while waiting for the File Replication Service service to connect. A warning event occurred. EventID: 0x00002724 Time Generated: 05/15/2011 20:30:46 Event String: This computer has at least one dynamically assigned IPv6 address.For reliable DHCPv6 server operation, you should use only static IPv6 addresses. A warning event occurred. EventID: 0x800009CA Time Generated: 05/15/2011 20:30:47 Event String: The value named BIG-RIG in the server's registry key OptionalNames was not valid, and was ignored. If you want to change the value, change it to one that is the correct type and is within the acceptable range, or delete the value to use the default. This value might have been set up by an older program that did not use the correct boundaries. A warning event occurred. EventID: 0x800009CA Time Generated: 05/15/2011 20:30:50 Event String: The value named BIG-RIG in the server's registry key OptionalNames was not valid, and was ignored. If you want to change the value, change it to one that is the correct type and is within the acceptable range, or delete the value to use the default. This value might have been set up by an older program that did not use the correct boundaries. An error event occurred. EventID: 0x0000002E Time Generated: 05/15/2011 20:44:05 Event String: The time service encountered an error and was forced to shut down. The error was: 0x80070700: An attempt was made to logon, but the network logon service was not started. An error event occurred. EventID: 0xC0001B6F Time Generated: 05/15/2011 20:44:05 Event String: The Windows Time service terminated with the following error: An error event occurred. EventID: 0x0000002E Time Generated: 05/15/2011 20:44:28 Event String: The time service encountered an error and was forced to shut down. The error was: 0x80070005: Access is denied. An error event occurred. EventID: 0xC0001B6F Time Generated: 05/15/2011 20:44:28 Event String: The Windows Time service terminated with the following error: A warning event occurred. EventID: 0x8000001D Time Generated: 05/15/2011 20:46:52 Event String: The Key Distribution Center (KDC) cannot find a suitable certificate to use for smart card logons, or the KDC certificate could not be verified. Smart card logon may not function correctly if this problem is not resolved. To correct this problem, either verify the existing KDC certificate using certutil.exe or enroll for a new KDC certificate. A warning event occurred. EventID: 0x800009CA Time Generated: 05/15/2011 20:47:00 Event String: The value named BIG-RIG in the server's registry key OptionalNames was not valid, and was ignored. If you want to change the value, change it to one that is the correct type and is within the acceptable range, or delete the value to use the default. This value might have been set up by an older program that did not use the correct boundaries. A warning event occurred. EventID: 0x800009CA Time Generated: 05/15/2011 20:47:03 Event String: The value named BIG-RIG in the server's registry key OptionalNames was not valid, and was ignored. If you want to change the value, change it to one that is the correct type and is within the acceptable range, or delete the value to use the default. This value might have been set up by an older program that did not use the correct boundaries. An error event occurred. EventID: 0x0000040B Time Generated: 05/15/2011 20:47:15 Event String: The DHCP service was unable to create or lookup the DHCP Users local group on this computer. The error code is in the data. An error event occurred. EventID: 0x0000040C Time Generated: 05/15/2011 20:47:15 Event String: The DHCP server was unable to create or lookup the DHCP Administrators local group on this computer. The error code is in the data. A warning event occurred. EventID: 0x000003F6 Time Generated: 05/15/2011 20:47:28 Event String: Name resolution for the name _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.WTBHOME.NET timed out after none of the configured DNS servers responded. A warning event occurred. EventID: 0x00002724 Time Generated: 05/15/2011 20:47:34 Event String: This computer has at least one dynamically assigned IPv6 address.For reliable DHCPv6 server operation, you should use only static IPv6 addresses. An error event occurred. EventID: 0xC00038D6 Time Generated: 05/15/2011 20:47:38 Event String: The DFS Namespace service could not initialize cross forest trust information on this domain controller, but it will periodically retry the operation. The return code is in the record data. A warning event occurred. EventID: 0x0000000C Time Generated: 05/15/2011 20:47:37 Event String: Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient. An error event occurred. EventID: 0x00000423 Time Generated: 05/15/2011 20:47:43 Event String: The DHCP service failed to see a directory server for authorization. An error event occurred. EventID: 0x00000423 Time Generated: 05/15/2011 20:47:43 Event String: The DHCP service failed to see a directory server for authorization. A warning event occurred. EventID: 0x0000A001 Time Generated: 05/15/2011 20:47:43 Event String: The Security System could not establish a secured connection with the server ldap/wtbhome.net/wtbhome.net@WTBHOME.NET. No authentication protocol was available. An error event occurred. EventID: 0xC00038D6 Time Generated: 05/15/2011 20:47:53 Event String: The DFS Namespace service could not initialize cross forest trust information on this domain controller, but it will periodically retry the operation. The return code is in the record data. A warning event occurred. EventID: 0x000727AA Time Generated: 05/15/2011 20:50:04 Event String: The WinRM service failed to create the following SPNs: WSMAN/big-rig.wtbhome.net; WSMAN/big-rig. An error event occurred. EventID: 0x0000165B Time Generated: 05/15/2011 21:13:30 Event String: The session setup from computer 'CHGSINLATTITUDE' failed because the security database does not contain a trust account 'CHGSINLATTITUDE$' referenced by the specified computer. An error event occurred. EventID: 0x000016AD Time Generated: 05/15/2011 21:15:52 Event String: The session setup from the computer CHGSINLATTITUDE failed to authenticate. The following error occurred: An error event occurred. EventID: 0x0000165B Time Generated: 05/15/2011 21:15:52 Event String: The session setup from computer 'MISSMAGIC' failed because the security database does not contain a trust account 'MISSMAGIC$' referenced by the specified computer. ......................... BIG-RIG failed test SystemLog Starting test: VerifyReferences ......................... BIG-RIG passed test VerifyReferences Running partition tests on : ForestDnsZones Starting test: CheckSDRefDom ......................... ForestDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... ForestDnsZones passed test CrossRefValidation Running partition tests on : DomainDnsZones Starting test: CheckSDRefDom ......................... DomainDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... DomainDnsZones passed test CrossRefValidation Running partition tests on : Schema Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Running partition tests on : Configuration Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Running partition tests on : wtbhome Starting test: CheckSDRefDom ......................... wtbhome passed test CheckSDRefDom Starting test: CrossRefValidation ......................... wtbhome passed test CrossRefValidation Running enterprise tests on : wtbhome.net Starting test: LocatorCheck ......................... wtbhome.net passed test LocatorCheck Starting test: Intersite ......................... wtbhome.net passed test Intersite

I followed the steps in http://support.microsoft.com/kb/816587/en-us and my DC is configured as it should be. All of the SRV entries listed in the KB point to big-rig.wtbhome.net

It's not the octal to decimal that is giving me a problem. It's the meaning of the entire octet string. There are lots of bytes in there but I've only figured out what the last 4 are in a regular DNS entry. I may need to change things other than just the IP address. (Currently it has a nonsensical IP address)

The part that seemed to give me hopw was the line: The host 63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net could not be resolved to an IP address. Check the DNS server, DHCP, server I see that entry in ADSIEdit, but the problem is that the entry for the dnsRecord is an octet string and I don't know the meaning of the entire entry. I have been able to determine that the last 4 octets are the IPv4 address (at least in another record) Thinking that if we clear this up that maybe some of the other tools might start working and we'll be able to clean things up. Am I just clinging to false hope there? if I try the netdom method to rename the computer, I'm assuming that I should name it back to big-rig2 correct? So the syntax wuold be: netdom renamecomputer big-rig /NewName:big-rig2 /userid:{admin account} /password:{admin password} Correct?

Tried a bunch of things without any good luck, but think I may have some progress that we can work with. I edited the two netlogon files and no luck. I found out that those are written out when the netlogon service starts. (Or in my case attempts to start.) So, I went down the path of getting the AD DNS entries corrected and I tried editing the AD database with ADSIEdit. I did change one thing from big-rig2 to big-rig, but no help. I then restored to a backup I made just before doing that. Next I put an entry in the hosts file to point big-rig2 to the same IP as big-rig. I then ran dcdiag and the output gave me some hope that we might be able to make progress from here. Here's the output:

OK, I did a full search of the boot HD on the server for the string big-rig2 and here are the files where the string was found. I'm thinking of trying a "cleansing" of those references. What do you think? Sound crazy? C:\Users\Administrator\AppData\Roaming\Microsoft\MMC\dnsmgmt (no extension but content is XML) C:\Users\Administrator\AppData\Roaming\Microsoft\MMC\ServerManager (no extension but content is XML) C:\Windows\System32\config\netlogon.dns C:\Windows\System32\config\netlogon.dnb C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms (binary file) I did find a ton of hits, but they were mostly log files. These were the only ones tlat looked like they might do something. Any of these sound promising to you? Also, I checked and the registry is "clean" of references to big-rig2 so, it's tog to be in the files above where it's "holding on to" that name.

using the .net suffix did not work. Same error from nltest The dcdiag /fix failed because it's looking for big-rig2. Here's the output: Directory Server Diagnosis Performing initial setup: Trying to find home server... Home Server = big-rig * Identified AD Forest. Done gathering initial info. Doing initial required tests Testing server: wtbhome\BIG-RIG2 Starting test: Connectivity The host 63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net could not be resolved to an IP address. Check the DNS server, DHCP, server name, etc. Neither the the server name (big-rig2.wtbhome.net) nor the Guid DNS name (63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net) could be resolved by DNS. Check that the server is up and is registered correctly with the DNS server. Got error while checking LDAP and RPC connectivity. Please check your firewall settings. ......................... BIG-RIG2 failed test Connectivity Doing primary tests Testing server: wtbhome\BIG-RIG2 Skipping all tests, because server BIG-RIG2 is not responding to directory service requests. Running partition tests on : ForestDnsZones Starting test: CheckSDRefDom ......................... ForestDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... ForestDnsZones passed test CrossRefValidation Running partition tests on : DomainDnsZones Starting test: CheckSDRefDom ......................... DomainDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... DomainDnsZones passed test CrossRefValidation Running partition tests on : Schema Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Running partition tests on : Configuration Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Running partition tests on : wtbhome Starting test: CheckSDRefDom ......................... wtbhome passed test CheckSDRefDom Starting test: CrossRefValidation ......................... wtbhome passed test CrossRefValidation Running enterprise tests on : wtbhome.net Starting test: LocatorCheck Warning: DcGetDcName(GC_SERVER_REQUIRED) call failed, error 1722 A Global Catalog Server could not be located - All GC's are down. Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1722 A Primary Domain Controller could not be located. The server holding the PDC role is down. Warning: DcGetDcName(TIME_SERVER) call failed, error 1722 A Time Server could not be located. The server holding the PDC role is down. Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error 1722 A Good Time Server could not be located. Warning: DcGetDcName(KDC_REQUIRED) call failed, error 1722 A KDC could not be located - All the KDCs are down. ......................... wtbhome.net failed test LocatorCheck Starting test: Intersite ......................... wtbhome.net passed test Intersite