1 PC out of 20 cannot join Domain

[Guest]

I am converting from Novell to Windows, so I am new to AD and DCs. I have
smoothly joined all PCs on my network (~20) except for 1. All PCs have Win
XP, SP2. The only PC that cannot join gives me this error when trying to
join the domain..."a domain controller for the domain could not be contacted.
Ensure that the domain name is typed correctly". The Details talk about SRV
records and child root zones but logic tells me that my DC is configured just
fine since the other PCs joined. This PC uses a VPN client but 4 other PCs
using VPN clients joined just fine. Some have Firewalls turned on and others
do not so this doesn't seem to be the cause either. His computer actually
shows up on the list of computers in AD and he can see the network drives but
can only view files/folders.

Any ideas what the problem could be?

Thanks,
Johnny

 

[Danny Sanders]

Is this computer pointed at the same DNS server as the PCs that can join?

hth
DDS W 2k MVP MCSE

 

[Guest]

I have all my PCs obtaining IPs and DNS server addresses automatically.

 

[Guest]

I went to Control Panel/Network Connections and looked at the settings again
and decided to turn OFF the Windows Firewall. When I try to join the domain,
I at least get the prompt for the username/password of an account that can
join the domain. After pressing enter and a short pause, I get the following
error...."the following error occurred attempting to join the domain. The
specified server cannot perform the requested operation."

 

[Danny Sanders]

Does this PC have TCP/IP installed and bound to the adapter?

IPX/SPX can/should be removed.


hth
DDS W 2k MVP MCSE

 

[Kurt]

If the computer shows up in ADU&C but is not joined to the domain, that
could be the problem. IS it possible you have another computer with the same
name? If not, try deleting the computer account then try to rejoin.

....kurt

 

[Guest]

IPX/SPX has been removed and TCP/IP is installed. I'm not sure what you mean
by bound to the adapter.

 

[Guest]

Hmmm, I deleted the computer in ADU&C like you suggested and tried to join
the domain. I am asked for a u/p of someone who can join the domain but I'm
still getting the same error "the following error occurred attempting to join
the domain. The specified server cannot perform the requested operation."

Interestingly, the computer showed up again in ADU&C but appeared to be
disabled. I enabled it and tried to join the domain again but it failed. In
Control Panel/System, the the full computer name of his system now shows the
complete domain info.

 

[Ace Fekay [MVP]]

In Johnny Rio <[email protected]> stated, which I commented

I have all my PCs obtaining IPs and DNS server addresses
automatically.

Automatic is cool, but does that mean the only DNS addresses configured in
DHCP Option 006 are ONLY the internal DNS servers that host the AD zone? (No
ISPs.)

Just as an FYI, this of course includes all machines: DCs, member servers,
clients and potential clients you want to add). If an ISP's DNS exists
anywhere other than a configured forwarder, the results will be problematic
at best. Keep in mind, any domain service requests are inititated by a query
to DNS to 'find' the AD domain and it's resources and services.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

If you are having difficulty in reading or finding responses to your post,
instead of the website you are using, if I may suggest to use OEx (Outlook
Express or any other newsreader of your choosing), and configure a newsgroup
account, pointing to news.microsoft.com. This is a direct link into the
Microsoft Public Newsgroups, and it is FREE and DOES NOT require a Usenet
account with your ISP. With OEx, you can easily find your post, track
threads, cross-post, and sort by date, poster's name, watched threads or
subject.

Not sure how? It's easy:
How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Windows Server Directory Services
Microsoft Certified Trainer
Assimilation Imminent. Resistance is Futile.
Infinite Diversities in Infinite Combinations.
=================================

 

[Ace Fekay [MVP]]

In Johnny Rio <[email protected]> stated, which I commented

Hmmm, I deleted the computer in ADU&C like you suggested and tried to
join the domain. I am asked for a u/p of someone who can join the
domain but I'm still getting the same error "the following error
occurred attempting to join the domain. The specified server cannot
perform the requested operation."

Interestingly, the computer showed up again in ADU&C but appeared to
be disabled. I enabled it and tried to join the domain again but it
failed. In Control Panel/System, the the full computer name of his
system now shows the complete domain info.

Are there any Event log errors on the DC(s)?

Ace

 

[Guest]

I didn't see anything that just jumps out at me in the event logs.....

 

[Guest]

The only entry for DHCP Option 006 is the IP address of that server (the DC).
The only entries in my Network Connections since I have specified an IP
address is the IP of that server (my DC), the subnet, gateway (my router's
address) and the DNS entry of my DC.

 

[Herb Martin]

IPX/SPX has been removed and TCP/IP is installed. I'm not sure what you
mean
by bound to the adapter.

"bound" is the technical term for "being in use with a particular
adapter" or "in use with another (inferior) protocol".

(Inferior meaning 'below' in the stack sense, not bad or some
pejorative term).

Examples: SMB can be bound to (any of) TCP/IP, SPX/IPX,
NetBEUI, or others (in the old days.)

IP or IPX could each be (separately) bound to some or all of
your NICs or other Interfaces (VPN or RAS-dial.)

They were just asking the obvious, which you already indicated,
and have now confirmed: IP is in use with the adapter and is
the only (network) protocol in use with the adapter. (i.e., IP
is bound but IPX is not in use.)

Was this computer cloned from another? How was the OS
installed?

The other responders have already attacked the MAJOR
reason for such failures (and had I responded earlier that
would have been my STRONG guess since it is very
common):

The affected machine usually has the 'wrong' DNS server
listed on its NIC OR it has MULTIPLE DNS servers (at
least one of them 'wrong') listed.

You have clearly stated this is not the case so we (probably)
need to look elsewhere.

Can you ping? Can you ping the DC by name? By IP only?

Can you ping it by both the complete DNS name, e.g.,
computerX.domain.com AND by the short name (computerX)
Tell us what works and what doesn't?

What does NSLookup give (from the affected machine) if you ask
for domainname.com: nslookup domainname.com

(Show all answers, not just the first if there are more than one.)

Does the affected workstation have a "hosts" file? What's in it?

Does the affected workstation have a full DNS name suffix
listed in the SYSTEM control panel, Computer Name (change),
More (NIC suffixes are largely irrelevant)?

The full DNS suffix should be listed there and it should generally
be checked to change with the domain membership.

Try NetDIAG on this machine and capture the output to a text
file where you can search for Fail, Warn, Error and report or
fix those.

--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

 

[Ace Fekay [MVP]]

In Johnny Rio <[email protected]> stated, which I commented

I didn't see anything that just jumps out at me in the event logs.....

Is the Novell utilities still installed?

Ace

 

[Guest]

The DC never had any Novell utilities installed. I'm gonna remove all
network connections on the PC and try that first.

 

[Guest]

Problem solved!!!! I REALLY appreciate the time everyone spent writing these
posts! Herb, you probably realized you needed to speak on a third grade
level.

Your emphasis on STRONG as to your guess that my problem was related to what
the other responders had attacked regarding DNS made me do more checking.
Your statement, "The affected machine usually has the 'wrong' DNS server
listed on its NIC OR it has MULTIPLE DNS servers (at least one of them
'wrong') listed" made me drill into the advanced tab. There were some
entries in "append these DNS suffiixes (in order)" that this user had
inserted for some reason. Once I removed them and selected "append primary
and connection specific DNS suffixes" I could join the domain just fine.

I re-read all the posts to see if I missed something but there was only a
brief mention that I had the TCP/IP properties obtain IP and DNS properties
automatically. ACE was on target with his questioning but I just missed it.

Thanks,
Johnny

IPX/SPX has been removed and TCP/IP is installed. I'm not sure what you
mean
by bound to the adapter.

"bound" is the technical term for "being in use with a particular
adapter" or "in use with another (inferior) protocol".

(Inferior meaning 'below' in the stack sense, not bad or some
pejorative term).

Examples: SMB can be bound to (any of) TCP/IP, SPX/IPX,
NetBEUI, or others (in the old days.)

IP or IPX could each be (separately) bound to some or all of
your NICs or other Interfaces (VPN or RAS-dial.)

They were just asking the obvious, which you already indicated,
and have now confirmed: IP is in use with the adapter and is
the only (network) protocol in use with the adapter. (i.e., IP
is bound but IPX is not in use.)

Was this computer cloned from another? How was the OS
installed?

The other responders have already attacked the MAJOR
reason for such failures (and had I responded earlier that
would have been my STRONG guess since it is very
common):

The affected machine usually has the 'wrong' DNS server
listed on its NIC OR it has MULTIPLE DNS servers (at
least one of them 'wrong') listed.

You have clearly stated this is not the case so we (probably)
need to look elsewhere.

Can you ping? Can you ping the DC by name? By IP only?

Can you ping it by both the complete DNS name, e.g.,
computerX.domain.com AND by the short name (computerX)
Tell us what works and what doesn't?

What does NSLookup give (from the affected machine) if you ask
for domainname.com: nslookup domainname.com

(Show all answers, not just the first if there are more than one.)

Does the affected workstation have a "hosts" file? What's in it?

Does the affected workstation have a full DNS name suffix
listed in the SYSTEM control panel, Computer Name (change),
More (NIC suffixes are largely irrelevant)?

The full DNS suffix should be listed there and it should generally
be checked to change with the domain membership.

Try NetDIAG on this machine and capture the output to a text
file where you can search for Fail, Warn, Error and report or
fix those.

--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

 

[Herb Martin]

Problem solved!!!! I REALLY appreciate the time everyone spent writing
these
posts! Herb, you probably realized you needed to speak on a third grade
level.

Glad to help but I re-read that message and it was at

Your emphasis on STRONG as to your guess that my problem was related to
what
the other responders had attacked regarding DNS made me do more checking.
Your statement, "The affected machine usually has the 'wrong' DNS server
listed on its NIC OR it has MULTIPLE DNS servers (at least one of them
'wrong') listed" made me drill into the advanced tab. There were some
entries in "append these DNS suffiixes (in order)" that this user had
inserted for some reason.

Actually that CANNOT cause the problem you describe
unless the CORRECT entry was just missing completely.

(You cannot hurt anything by having additional entries.)

Once I removed them and selected "append primary
and connection specific DNS suffixes" I could join the domain just fine.

Something else happened. Reset of the NIC or something else
was changed.

I re-read all the posts to see if I missed something but there was only a
brief mention that I had the TCP/IP properties obtain IP and DNS
properties
automatically. ACE was on target with his questioning but I just missed
it.

I would still go check to see if the SYSTEM Control panel
has the correct NAME THERE. That is the one that really
counts.

--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

IPX/SPX has been removed and TCP/IP is installed. I'm not sure what
you
mean
by bound to the adapter.

"bound" is the technical term for "being in use with a particular
adapter" or "in use with another (inferior) protocol".

(Inferior meaning 'below' in the stack sense, not bad or some
pejorative term).

Examples: SMB can be bound to (any of) TCP/IP, SPX/IPX,
NetBEUI, or others (in the old days.)

IP or IPX could each be (separately) bound to some or all of
your NICs or other Interfaces (VPN or RAS-dial.)

They were just asking the obvious, which you already indicated,
and have now confirmed: IP is in use with the adapter and is
the only (network) protocol in use with the adapter. (i.e., IP
is bound but IPX is not in use.)

Was this computer cloned from another? How was the OS
installed?

The other responders have already attacked the MAJOR
reason for such failures (and had I responded earlier that
would have been my STRONG guess since it is very
common):

The affected machine usually has the 'wrong' DNS server
listed on its NIC OR it has MULTIPLE DNS servers (at
least one of them 'wrong') listed.

You have clearly stated this is not the case so we (probably)
need to look elsewhere.

Can you ping? Can you ping the DC by name? By IP only?

Can you ping it by both the complete DNS name, e.g.,
computerX.domain.com AND by the short name (computerX)
Tell us what works and what doesn't?

What does NSLookup give (from the affected machine) if you ask
for domainname.com: nslookup domainname.com

(Show all answers, not just the first if there are more than one.)

Does the affected workstation have a "hosts" file? What's in it?

Does the affected workstation have a full DNS name suffix
listed in the SYSTEM control panel, Computer Name (change),
More (NIC suffixes are largely irrelevant)?

The full DNS suffix should be listed there and it should generally
be checked to change with the domain membership.

Try NetDIAG on this machine and capture the output to a text
file where you can search for Fail, Warn, Error and report or
fix those.

--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

hth
DDS W 2k MVP MCSE


I went to Control Panel/Network Connections and looked at the
settings
again
and decided to turn OFF the Windows Firewall. When I try to join
the
domain,
I at least get the prompt for the username/password of an account
that
can
join the domain. After pressing enter and a short pause, I get the
following
error...."the following error occurred attempting to join the
domain.
The
specified server cannot perform the requested operation."

:

Is this computer pointed at the same DNS server as the PCs that can
join?

hth
DDS W 2k MVP MCSE


I am converting from Novell to Windows, so I am new to AD and DCs.
I
have
smoothly joined all PCs on my network (~20) except for 1. All
PCs
have
Win
XP, SP2. The only PC that cannot join gives me this error when
trying
to
join the domain..."a domain controller for the domain could not
be
contacted.
Ensure that the domain name is typed correctly". The Details
talk
about
SRV
records and child root zones but logic tells me that my DC is
configured
just
fine since the other PCs joined. This PC uses a VPN client but 4
other
PCs
using VPN clients joined just fine. Some have Firewalls turned
on
and
others
do not so this doesn't seem to be the cause either. His computer
actually
shows up on the list of computers in AD and he can see the
network
drives
but
can only view files/folders.

Any ideas what the problem could be?

Thanks,
Johnny

 

[Ace Fekay [MVP]]

In Johnny Rio <[email protected]> stated, which I commented

I re-read all the posts to see if I missed something but there was
only a brief mention that I had the TCP/IP properties obtain IP and
DNS properties automatically. ACE was on target with his questioning
but I just missed it.

I was trying to be professionally subtle about a possible misconfiguration
but at a 6th grade level.


Glad you got it working!

Ace