Greetings,

I had posted previously concerning this error (Event ID:1000; Source:
Userenv) in the Active Directory forum and after trying to get this
resolved, was told to try my post here. The original post is subject:Windows
cannot determine the user or computer name; Date: 4/26/05. Below is the a
portion of the conversation...

Per Paul's suggestion, I reviewed some info from Eventid.com. Two kb
articles were mentioned: Q328691 & Q257623. I've verified there are no
viruses/trojans and the DNS suffix is correct (ipconfig /all shows the
proper suffix, which also shows up correctly in the dns zone). This server
is a DC and is replicating without a problem. I had a DNS issue recently,
but that is resolved. All srv records are in the dns zone. When I run
dcdiag, all tests pass, except I do get a strange error message during the
frs test:

Starting test: frssysvol
There are errors after the SYSVOL has been shared.
The SYSVOL can prevent the AD from starting.
......................... DC3 passed test frssysvol

Looking at the event log of this server, I have received several 13508 error
messages, the latest being on 4/27.

Event Type: Warning
Event Source: NtFrs
Event Category: None
Event ID: 13508
Date: 3/24/2005
Time: 6:01:53 PM
User: N/A
Computer: DC3
Description:
The File Replication Service is having trouble enabling replication from DC1
to DC3 for c:\winnt\sysvol\domain using the DNS name DC1.Domain.com. FRS
will keep retrying.
Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name DC1.Domain.com from this
computer.
[2] FRS is not running on DC1.Domain.com.
[3] The topology information in the Active Directory for this replica has
not yet replicated to all the Domain Controllers.

This event log message will appear once per connection, After the problem
is fixed you will see another event log message indicating that the
connection has been established.
Data:
0000: 05 00 00 00 ....

I have verified my dns setup: only one dns server listed in TCP/IP
properties on all three DCs (no ISP DNS listed). And as mentioned above, the
appropriate srv & host records are recorded in the zone.

I have discovered that this error is happening on three member servers as
well and that the date when these errors were first logged are the same on
all.

Sorry for the length of the post. Very confused....

I understand that you have verified your DNS setup but everything you
are saying points to a DNS issue, from Sysvol sharing errors to FRS
name resolution. Do you have a reverse lookup zone configured? You say
only 1 DNS server listed in TCP properties, for all DNS servers; that
is the DNS server's own IP address right?

Sorry I cant offer anything else at this point but post back and I'll
see what else comes to mind.

Thanks for the reply...I've been out on vacation and just getting back.
Sysvol is shared and I'm not seeing any frs errors. Reverse zone is
configured for all locations and the TCPIP properties on this server is
pointing to the root dns server for our internal domain (not it's own).

"taranis" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> I understand that you have verified your DNS setup but everything you
> are saying points to a DNS issue, from Sysvol sharing errors to FRS
> name resolution. Do you have a reverse lookup zone configured? You say
> only 1 DNS server listed in TCP properties, for all DNS servers; that
> is the DNS server's own IP address right?
>
> Sorry I cant offer anything else at this point but post back and I'll
> see what else comes to mind.
>

Hi,

Your previous post has gone. So pls post again any relevant event log here
for us to have a look.

br,
Denis

"C Hall" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Thanks for the reply...I've been out on vacation and just getting back.
> Sysvol is shared and I'm not seeing any frs errors. Reverse zone is
> configured for all locations and the TCPIP properties on this server is
> pointing to the root dns server for our internal domain (not it's own).
>
> "taranis" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > I understand that you have verified your DNS setup but everything you
> > are saying points to a DNS issue, from Sysvol sharing errors to FRS
> > name resolution. Do you have a reverse lookup zone configured? You say
> > only 1 DNS server listed in TCP properties, for all DNS servers; that
> > is the DNS server's own IP address right?
> >
> > Sorry I cant offer anything else at this point but post back and I'll
> > see what else comes to mind.
> >
>
>

Denis,

Here it is..

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 7/7/2005
Time: 3:09:54 PM
User: NT AUTHORITY\SYSTEM
Computer: WCOLADC1
Description:
Windows cannot determine the user or computer name. Return value (1326).


As mentioned in previous posts, I've been receiving this error since I
dcpromoed some time ago. Replication doesn't appear to be a problem and
everything seems to be running okay, but I'd like to get rid of the error...

TIA,
Chris

"Denis Wong @ Hong Kong" <H_O_T_A_P_P_S_@_H_O_T_M_A_I_L_._C_O_M> wrote in
message news:(E-Mail Removed)...
> Hi,
>
> Your previous post has gone. So pls post again any relevant event log here
> for us to have a look.
>
> br,
> Denis
>
> "C Hall" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> Thanks for the reply...I've been out on vacation and just getting back.
>> Sysvol is shared and I'm not seeing any frs errors. Reverse zone is
>> configured for all locations and the TCPIP properties on this server is
>> pointing to the root dns server for our internal domain (not it's own).
>>
>> "taranis" <(E-Mail Removed)> wrote in message
>> news:(E-Mail Removed)...
>> > I understand that you have verified your DNS setup but everything you
>> > are saying points to a DNS issue, from Sysvol sharing errors to FRS
>> > name resolution. Do you have a reverse lookup zone configured? You say
>> > only 1 DNS server listed in TCP properties, for all DNS servers; that
>> > is the DNS server's own IP address right?
>> >
>> > Sorry I cant offer anything else at this point but post back and I'll
>> > see what else comes to mind.
>> >
>>
>>
>
>

In the configuration of the nic, what DNS servers are you using?

Ken

"(E-Mail Removed)" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Denis,
>
> Here it is..
>
> Event Type: Error
> Event Source: Userenv
> Event Category: None
> Event ID: 1000
> Date: 7/7/2005
> Time: 3:09:54 PM
> User: NT AUTHORITY\SYSTEM
> Computer: WCOLADC1
> Description:
> Windows cannot determine the user or computer name. Return value (1326).
>
>
> As mentioned in previous posts, I've been receiving this error since I
> dcpromoed some time ago. Replication doesn't appear to be a problem and
> everything seems to be running okay, but I'd like to get rid of the
> error...
>
> TIA,
> Chris
>
> "Denis Wong @ Hong Kong" <H_O_T_A_P_P_S_@_H_O_T_M_A_I_L_._C_O_M> wrote in
> message news:(E-Mail Removed)...
>> Hi,
>>
>> Your previous post has gone. So pls post again any relevant event log
>> here
>> for us to have a look.
>>
>> br,
>> Denis
>>
>> "C Hall" <(E-Mail Removed)> wrote in message
>> news:(E-Mail Removed)...
>>> Thanks for the reply...I've been out on vacation and just getting back.
>>> Sysvol is shared and I'm not seeing any frs errors. Reverse zone is
>>> configured for all locations and the TCPIP properties on this server is
>>> pointing to the root dns server for our internal domain (not it's own).
>>>
>>> "taranis" <(E-Mail Removed)> wrote in message
>>> news:(E-Mail Removed)...
>>> > I understand that you have verified your DNS setup but everything you
>>> > are saying points to a DNS issue, from Sysvol sharing errors to FRS
>>> > name resolution. Do you have a reverse lookup zone configured? You say
>>> > only 1 DNS server listed in TCP properties, for all DNS servers; that
>>> > is the DNS server's own IP address right?
>>> >
>>> > Sorry I cant offer anything else at this point but post back and I'll
>>> > see what else comes to mind.
>>> >
>>>
>>>
>>
>>
>
>

Hi Chris,

Value 1326 means Logon failure: unknown user name or bad password. There
could be a million reason why username and password do not match. It may be
a change of password, or a security issue.

Take a look at these.

http://eventid.net/display.asp?event...serenv&phase=1
http://support.microsoft.com/?kbid=328691
http://support.microsoft.com/?kbid=257623

br,
Denis

"(E-Mail Removed)" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Denis,
>
> Here it is..
>
> Event Type: Error
> Event Source: Userenv
> Event Category: None
> Event ID: 1000
> Date: 7/7/2005
> Time: 3:09:54 PM
> User: NT AUTHORITY\SYSTEM
> Computer: WCOLADC1
> Description:
> Windows cannot determine the user or computer name. Return value (1326).
>
>
> As mentioned in previous posts, I've been receiving this error since I
> dcpromoed some time ago. Replication doesn't appear to be a problem and
> everything seems to be running okay, but I'd like to get rid of the
error...
>
> TIA,
> Chris
>
> "Denis Wong @ Hong Kong" <H_O_T_A_P_P_S_@_H_O_T_M_A_I_L_._C_O_M> wrote in
> message news:(E-Mail Removed)...
> > Hi,
> >
> > Your previous post has gone. So pls post again any relevant event log
here
> > for us to have a look.
> >
> > br,
> > Denis
> >
> > "C Hall" <(E-Mail Removed)> wrote in message
> > news:(E-Mail Removed)...
> >> Thanks for the reply...I've been out on vacation and just getting back.
> >> Sysvol is shared and I'm not seeing any frs errors. Reverse zone is
> >> configured for all locations and the TCPIP properties on this server is
> >> pointing to the root dns server for our internal domain (not it's own).
> >>
> >> "taranis" <(E-Mail Removed)> wrote in message
> >> news:(E-Mail Removed)...
> >> > I understand that you have verified your DNS setup but everything you
> >> > are saying points to a DNS issue, from Sysvol sharing errors to FRS
> >> > name resolution. Do you have a reverse lookup zone configured? You
say
> >> > only 1 DNS server listed in TCP properties, for all DNS servers; that
> >> > is the DNS server's own IP address right?
> >> >
> >> > Sorry I cant offer anything else at this point but post back and I'll
> >> > see what else comes to mind.
> >> >
> >>
> >>
> >
> >
>
>

Hi Ken,

On the server in question, I have it pointed to the forest role holder only.
We did previously have a dns problem and in order to get that resolved, I
removed it's own ip address from the tcp/ip properties.

"Ken B" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> In the configuration of the nic, what DNS servers are you using?
>
> Ken
>
> "(E-Mail Removed)" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> Denis,
>>
>> Here it is..
>>
>> Event Type: Error
>> Event Source: Userenv
>> Event Category: None
>> Event ID: 1000
>> Date: 7/7/2005
>> Time: 3:09:54 PM
>> User: NT AUTHORITY\SYSTEM
>> Computer: WCOLADC1
>> Description:
>> Windows cannot determine the user or computer name. Return value (1326).
>>
>>
>> As mentioned in previous posts, I've been receiving this error since I
>> dcpromoed some time ago. Replication doesn't appear to be a problem and
>> everything seems to be running okay, but I'd like to get rid of the
>> error...
>>
>> TIA,
>> Chris
>>
>> "Denis Wong @ Hong Kong" <H_O_T_A_P_P_S_@_H_O_T_M_A_I_L_._C_O_M> wrote in
>> message news:(E-Mail Removed)...
>>> Hi,
>>>
>>> Your previous post has gone. So pls post again any relevant event log
>>> here
>>> for us to have a look.
>>>
>>> br,
>>> Denis
>>>
>>> "C Hall" <(E-Mail Removed)> wrote in message
>>> news:(E-Mail Removed)...
>>>> Thanks for the reply...I've been out on vacation and just getting back.
>>>> Sysvol is shared and I'm not seeing any frs errors. Reverse zone is
>>>> configured for all locations and the TCPIP properties on this server is
>>>> pointing to the root dns server for our internal domain (not it's own).
>>>>
>>>> "taranis" <(E-Mail Removed)> wrote in message
>>>> news:(E-Mail Removed)...
>>>> > I understand that you have verified your DNS setup but everything you
>>>> > are saying points to a DNS issue, from Sysvol sharing errors to FRS
>>>> > name resolution. Do you have a reverse lookup zone configured? You
>>>> > say
>>>> > only 1 DNS server listed in TCP properties, for all DNS servers; that
>>>> > is the DNS server's own IP address right?
>>>> >
>>>> > Sorry I cant offer anything else at this point but post back and I'll
>>>> > see what else comes to mind.
>>>> >
>>>>
>>>>
>>>
>>>
>>
>>
>
>

Hi Denis,

I appreciate the reply. I have seen these articles and they didn't resolve
my problem.
Chris

"Denis Wong @ Hong Kong" <H_O_T_A_P_P_S_@_H_O_T_M_A_I_L_._C_O_M> wrote in
message news:%(E-Mail Removed)...
> Hi Chris,
>
> Value 1326 means Logon failure: unknown user name or bad password. There
> could be a million reason why username and password do not match. It may
> be
> a change of password, or a security issue.
>
> Take a look at these.
>
> http://eventid.net/display.asp?event...serenv&phase=1
> http://support.microsoft.com/?kbid=328691
> http://support.microsoft.com/?kbid=257623
>
> br,
> Denis
>
> "(E-Mail Removed)" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> Denis,
>>
>> Here it is..
>>
>> Event Type: Error
>> Event Source: Userenv
>> Event Category: None
>> Event ID: 1000
>> Date: 7/7/2005
>> Time: 3:09:54 PM
>> User: NT AUTHORITY\SYSTEM
>> Computer: WCOLADC1
>> Description:
>> Windows cannot determine the user or computer name. Return value (1326).
>>
>>
>> As mentioned in previous posts, I've been receiving this error since I
>> dcpromoed some time ago. Replication doesn't appear to be a problem and
>> everything seems to be running okay, but I'd like to get rid of the
> error...
>>
>> TIA,
>> Chris
>>
>> "Denis Wong @ Hong Kong" <H_O_T_A_P_P_S_@_H_O_T_M_A_I_L_._C_O_M> wrote in
>> message news:(E-Mail Removed)...
>> > Hi,
>> >
>> > Your previous post has gone. So pls post again any relevant event log
> here
>> > for us to have a look.
>> >
>> > br,
>> > Denis
>> >
>> > "C Hall" <(E-Mail Removed)> wrote in message
>> > news:(E-Mail Removed)...
>> >> Thanks for the reply...I've been out on vacation and just getting
>> >> back.
>> >> Sysvol is shared and I'm not seeing any frs errors. Reverse zone is
>> >> configured for all locations and the TCPIP properties on this server
>> >> is
>> >> pointing to the root dns server for our internal domain (not it's
>> >> own).
>> >>
>> >> "taranis" <(E-Mail Removed)> wrote in message
>> >> news:(E-Mail Removed)...
>> >> > I understand that you have verified your DNS setup but everything
>> >> > you
>> >> > are saying points to a DNS issue, from Sysvol sharing errors to FRS
>> >> > name resolution. Do you have a reverse lookup zone configured? You
> say
>> >> > only 1 DNS server listed in TCP properties, for all DNS servers;
>> >> > that
>> >> > is the DNS server's own IP address right?
>> >> >
>> >> > Sorry I cant offer anything else at this point but post back and
>> >> > I'll
>> >> > see what else comes to mind.
>> >> >
>> >>
>> >>
>> >
>> >
>>
>>
>
>