failed test MachineAccount

[Antonin Koudelka]

Hi,

I can not connect to \\myserver\sysvol.
When runnig dcdiag /test:MachineAccount I get the following error:

Doing primary tests

Testing server: Default-First-Site-Name\MYSERVER
Starting test: MachineAccount
Could not open pipe with [MYSERVER]:failed with 53: The network pat
as not found.
Could not get NetBIOSDomainName
Failed can not test for HOST SPN
Failed can not test for HOST SPN
* Missing SPN null)
* Missing SPN null)
......................... MYSERVERfailed test MachineAccount

I spent lot of time on the net looking for answers, tried few suggestions
and got nowhere.

Please, help.

Antonin

 

[Ace Fekay [MVP]]

In

Hi,

I can not connect to \\myserver\sysvol.
When runnig dcdiag /test:MachineAccount I get the following error:

Doing primary tests

Testing server: Default-First-Site-Name\MYSERVER
Starting test: MachineAccount
Could not open pipe with [MYSERVER]:failed with 53: The
network pat as not found.
Could not get NetBIOSDomainName
Failed can not test for HOST SPN
Failed can not test for HOST SPN
* Missing SPN null)
* Missing SPN null)
......................... MYSERVERfailed test MachineAccount

I spent lot of time on the net looking for answers, tried few
suggestions and got nowhere.

Please, help.

Antonin

SPN is based on the DNS FQDN name.
Error 53 usually means The network path was not found.

So between these two errors, I'm thinking its a DNS lookup issue. To better
assist, we'll need some config info. So can you please post:

1. An unedited ipconfig /all
2. Name of your AD DNS domain name
3 The zone name in DNS and if updates are enabled

Appreciate your help in helping you out to diagnose this.

--
Regards,
Ace

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Windows Server - Directory Services

Security Is Like An Onion, It Has Layers
HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.

 

[Antonin]

Thanks Ace for your reply.

Here it is

C:\>ipconfig/all

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : southpath
Primary DNS Suffix . . . . . . . : health.on.net
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : health.on.net
on.net

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : HP NC3163 Fast Ethernet NIC
Physical Address. . . . . . . . . : 00-02-A5-EC-AC-CE
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 150.101.2.85
Subnet Mask . . . . . . . . . . . : 255.255.255.248
Default Gateway . . . . . . . . . : 150.101.2.86
DNS Servers . . . . . . . . . . . : 150.101.2.85

The name of my AD DNS domain name: health.on.net

The zone name in DNS is health.on.net and dynamic updates are enabled.

Regards,
Antonin


"Ace Fekay [MVP]"

In

Hi,

I can not connect to \\myserver\sysvol.
When runnig dcdiag /test:MachineAccount I get the following error:

Doing primary tests

Testing server: Default-First-Site-Name\MYSERVER
Starting test: MachineAccount
Could not open pipe with [MYSERVER]:failed with 53: The
network pat as not found.
Could not get NetBIOSDomainName
Failed can not test for HOST SPN
Failed can not test for HOST SPN
* Missing SPN null)
* Missing SPN null)
......................... MYSERVERfailed test MachineAccount

I spent lot of time on the net looking for answers, tried few
suggestions and got nowhere.

Please, help.

Antonin

SPN is based on the DNS FQDN name.
Error 53 usually means The network path was not found.

So between these two errors, I'm thinking its a DNS lookup issue. To better
assist, we'll need some config info. So can you please post:

1. An unedited ipconfig /all
2. Name of your AD DNS domain name
3 The zone name in DNS and if updates are enabled

Appreciate your help in helping you out to diagnose this.

--
Regards,
Ace

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Windows Server - Directory Services

Security Is Like An Onion, It Has Layers
HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.

 

[Ace Fekay [MVP]]

In

Thanks Ace for your reply.

Here it is

C:\>ipconfig/all

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : southpath
Primary DNS Suffix . . . . . . . : health.on.net
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : health.on.net
on.net

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : HP NC3163 Fast Ethernet
NIC Physical Address. . . . . . . . . : 00-02-A5-EC-AC-CE
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 150.101.2.85
Subnet Mask . . . . . . . . . . . : 255.255.255.248
Default Gateway . . . . . . . . . : 150.101.2.86
DNS Servers . . . . . . . . . . . : 150.101.2.85

The name of my AD DNS domain name: health.on.net

The zone name in DNS is health.on.net and dynamic updates are enabled.

Regards,
Antonin

Hi Antonin,

Thanks for posting that information. It actually looks good. Your Primary
DNS Suffix matches the AD domain name and you are using your internal DNS
(itself). Are there any errors in the Event logs? I'm assuming your SRV
records exist under the health.on.net zone.

The one other error I see is the NetBIOS name doesn't exist. Do you have
NetBIOS disabled? Is the DHCP Client service disabled? (that will cause
problems too, whether DHCP or static since the DNS resolver service uses it
and needs to be enabled).

Try running netdiag /v /fix and then re-run a dcdiag /v and then after
that run a dcdiag /v /test:MachineAccount.


--
Regards,
Ace

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Windows Server - Directory Services

Security Is Like An Onion, It Has Layers
HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.

 

[Antonin]

Hi Ace,

Thanks for your help.

I ran netdiag /v /fix and dcdiag /v /fix. It did not help. I started the
DHCP Client service and nothing changed.

I am not running WINS. Shiould I?

What do you mean by "NetBIOS name doesn't exit"?

I have NetBIOS over TCP/IP enabled.

There is an error in the event log every 5 minuts:

EventID 1000, Windows cannot access the registry information at
\\health.on.net\sysvol\health.on.net\Policies\{31B2F340-016D-11D2-945F-00C04
fB984F9}\Machine\registry.pol with (51).

One other thing. It used to work OK for years. I do not know what changed
and why.

Regards,
Antonin


"Ace Fekay [MVP]"

 

[Ace Fekay [MVP]]

In

Hi Ace,

Thanks for your help.

I ran netdiag /v /fix and dcdiag /v /fix. It did not help. I started
the DHCP Client service and nothing changed.

I am not running WINS. Shiould I?

What do you mean by "NetBIOS name doesn't exit"?

I have NetBIOS over TCP/IP enabled.

There is an error in the event log every 5 minuts:

EventID 1000, Windows cannot access the registry information at
\\health.on.net\sysvol\health.on.net\Policies\{31B2F340-016D-11D2-945F-00C04
fB984F9}\Machine\registry.pol with (51).

One other thing. It used to work OK for years. I do not know what
changed and why.

Regards,
Antonin

HI Antonin,

You don't 'need' NEtBIOS for AD, but that was that error you had: "NetBIOS
name doesn't exit", that came up in your original dcdiag results.

You said you 'started the DHCP Client service...."? You mean it wasn't
running before? I need to ask, are there any other services that you may
have inadvertenly disabled not being sure that they were needed?

The Event ID 1000 error is indicative of a DNS lookup problem.

Do the SRV records (those 4 folders that start with underscores) exist in
your zone?

Are there records that looks like these exist under the 'health.on.net'
zone?
(same as parent) A 150.101.2.85
southpath A 150.101.2.85


--
Regards,
Ace

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Windows Server - Directory Services

Security Is Like An Onion, It Has Layers
HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.

 

[Antonin]

Hi Ace,


"Ace Fekay [MVP]"

In
\\health.on.net\sysvol\health.on.net\Policies\{31B2F340-016D-11D2-945F-00C04

HI Antonin,

You don't 'need' NEtBIOS for AD, but that was that error you had: "NetBIOS
name doesn't exit", that came up in your original dcdiag results.

I thought you were referring to the ipconfig output. That's why I did not
understand it.

You said you 'started the DHCP Client service...."? You mean it wasn't
running before? I need to ask, are there any other services that you may
have inadvertenly disabled not being sure that they were needed?

Other services not running are Alerter, Messenger, Network DDE, Network DDE
DSDM, Printer Spooler, Routing and Remote Access.

The Event ID 1000 error is indicative of a DNS lookup problem.

I can do nslookup for southpath or southpath.health.on.net or just
health.on.net both on this computer and on the other server without any
problem.

Do the SRV records (those 4 folders that start with underscores) exist in
your zone?

The _msdcs, _sites, _tcp, _udp folders are there.

Are there records that looks like these exist under the 'health.on.net'
zone?
(same as parent) A 150.101.2.85
southpath A 150.101.2.85

These records are there as well.

Regards,
Antonin

 

[Ace Fekay [MVP]]

In Antonin <[email protected]> made a post then I commented below

Hi Antonin,

At least you have the DHCP service running now. The others I do not see as
important for this, but just for a test, I would like to see you enable
Network DDE and the Alerter service.

Is there a personal firewall installed on the machine?

Also, that EventID 1000 you posted, I looked it up, and here is what it has
to say about it:

"Error code 51 - "The remote computer is not available." - "The \\Active
Directory Domain Name\Sysvol share is a special share that requires the
distributed file system (Dfs) client to make a connection. If the Dfs client
is disabled, the error messages are generated. ". See the link to Q259398."

Is the DFS Client service disabled? Enable and start it please, if it is. If
you have any probs getting it to work, see this article:

SceCli Event ID 1001 and UserEnv Event ID 1000 When Dfs Client Is Disabled:
http://support.microsoft.com/?id=259398



--
Regards,
Ace

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Windows Server - Directory Services

Security Is Like An Onion, It Has Layers
HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.

 

[Antonin Koudelka]

Hi Ace,

I started the Network DDE and Alerter service. The Dfs is also running. I
read the article and at least 10 others. I restarted the server but the
problem persists.

Thanks
Antonin


"Ace Fekay [MVP]"

 

[Ace Fekay [MVP]]

In

Hi Ace,

I started the Network DDE and Alerter service. The Dfs is also
running. I read the article and at least 10 others. I restarted the
server but the problem persists.

Thanks
Antonin

Hmm, plot thickens...

Is there a firewall between the machines? Is there an ISA server? Is there a
NAT between them? If so, have an MTU changes been made?

Ace

 

[Antonin Koudelka]

Hi Ace,

There is only one other PC in the health.on.net domain. A shared directory
which resides on the other PC can be mapped by IP address and accessed from
the DC. However, it is not possible in the other direction. If I try it I
get an error message "The network path was not found."
If I try to run \\southpath\sysvol on the DC or if I click the sysvol share
I get the same error message "The network path was not found."

There is no firewall between these machines. No ISA server. No NAT. I looked
in the registry and did not find any entry for MTU so I suppose no changes
were made and default values are used.
The problem with accessing the sysvol share is even on the computer where
the share resides so no network traffic outside the computer is involved.

Thanks,
Antonin



"Ace Fekay [MVP]"

 

[Ace Fekay [MVP]]

In

Hi Ace,

There is only one other PC in the health.on.net domain. A shared
directory which resides on the other PC can be mapped by IP address
and accessed from the DC. However, it is not possible in the other
direction. If I try it I get an error message "The network path was
not found."
If I try to run \\southpath\sysvol on the DC or if I click the
sysvol share I get the same error message "The network path was not
found."

There is no firewall between these machines. No ISA server. No NAT. I
looked in the registry and did not find any entry for MTU so I
suppose no changes were made and default values are used.
The problem with accessing the sysvol share is even on the computer
where the share resides so no network traffic outside the computer is
involved.

Thanks,
Antonin

This is strange. Obviously something is blocking resolution. DHCP Client
service is set to automatic and its started? Is there any adware on the
machine, or the hosts file got hijacked? I know I asked about a firewall,
but just want to make certain if the PC is XP Pro, that ICF isn't enabled?
Switch problems? Wiring? Subnet mask correct on both machines for that
subnet?

Can you run an nslookup from the PC and see if it will resolve the DC's
name?

nslookup

southpath.health.on.net

Can you post the whole result? Nslookup uses its own built in resolver
service and doesn't rely on the system's DNS Client resolver service. I just
want to rule out the DNS server.

Do me another favor too and type in:
net start

and post that too please. I just want to take a look at all your services
not running.

--
Regards,
Ace

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Windows Server - Directory Services

Security Is Like An Onion, It Has Layers
HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.

 

[Antonin Koudelka]

Hi Ace,

DHPC Client is running and is set to automatic.

There is a Server Protect running on the DC.

The hosts file is there with only the following entry
127.0.0.1 localhost

The DC runs Windows 2000 Server.

C:\>nslookup southpath
Server: southpath
Address: 150.101.2.85

Name: southpath.health.on.net
Address: 150.101.2.85


C:\>nslookup southpath.health.on.net
Server: southpath
Address: 150.101.2.85

Name: southpath.health.on.net
Address: 150.101.2.85

These Windows 2000 services are started:

Alerter
Automatic Updates
COM+ Event System
Compaq Storage Agents
Computer Browser
DHCP Client
Distributed File System
Distributed Link Tracking Client
Distributed Link Tracking Server
Distributed Transaction Coordinator
DNS Client
DNS Server
Event Log
File Replication Service
Fmcnetx Service
FTP Publishing Service
IIS Admin Service
Intersite Messaging
IPSEC Policy Agent
Kerberos Key Distribution Center
License Logging Service
Logical Disk Manager
Messenger
Net Logon
Network Connections
Network DDE
Network DDE DSDM
NT LM Security Support Provider
Plug and Play
Print Spooler
Protected Storage
Remote Access Connection Manager
Remote Procedure Call (RPC)
Remote Procedure Call (RPC) Locator
Remote Registry Service
Removable Storage
RunAs Service
Security Accounts Manager
Server
Simple Mail Transport Protocol (SMTP)
SNMP Service
Surveyor
System Event Notification
systempoolmanager
Task Scheduler
TCP/IP NetBIOS Helper Service
Telephony
Terminal Services
Trend ServerProtect
Trend ServerProtect Agent
TridiaVNC Server
Windows Management Instrumentation
Windows Management Instrumentation Driver Extensions
Windows Time
Workstation
World Wide Web Publishing Service

The command completed successfully.

Thanks,
Antonin

 

[Ace Fekay [MVP]]

In

Hi Ace,

DHPC Client is running and is set to automatic.

There is a Server Protect running on the DC.

The hosts file is there with only the following entry
127.0.0.1 localhost

The DC runs Windows 2000 Server.

C:\>nslookup southpath
Server: southpath
Address: 150.101.2.85

Name: southpath.health.on.net
Address: 150.101.2.85


C:\>nslookup southpath.health.on.net
Server: southpath
Address: 150.101.2.85

Name: southpath.health.on.net
Address: 150.101.2.85

These Windows 2000 services are started:

Alerter
Automatic Updates
COM+ Event System
Compaq Storage Agents
Computer Browser
DHCP Client
Distributed File System
Distributed Link Tracking Client
Distributed Link Tracking Server
Distributed Transaction Coordinator
DNS Client
DNS Server
Event Log
File Replication Service
Fmcnetx Service
FTP Publishing Service
IIS Admin Service
Intersite Messaging
IPSEC Policy Agent
Kerberos Key Distribution Center
License Logging Service
Logical Disk Manager
Messenger
Net Logon
Network Connections
Network DDE
Network DDE DSDM
NT LM Security Support Provider
Plug and Play
Print Spooler
Protected Storage
Remote Access Connection Manager
Remote Procedure Call (RPC)
Remote Procedure Call (RPC) Locator
Remote Registry Service
Removable Storage
RunAs Service
Security Accounts Manager
Server
Simple Mail Transport Protocol (SMTP)
SNMP Service
Surveyor
System Event Notification
systempoolmanager
Task Scheduler
TCP/IP NetBIOS Helper Service
Telephony
Terminal Services
Trend ServerProtect
Trend ServerProtect Agent
TridiaVNC Server
Windows Management Instrumentation
Windows Management Instrumentation Driver Extensions
Windows Time
Workstation
World Wide Web Publishing Service

The command completed successfully.

Thanks,
Antonin

Well, it appears your DNS server is running just fine and your HOSTS file is
intact. I'm not familiar with Trend's Server Protect, but assume it doesn't
have anything to do with this.

So obviously it appears so far to be a client issue. On the client (what
client OS is it?), is there anything turned off, or altered, hosts file,
etc.

If you happen to have another client machine around that you can join the
domain just to test this, can you do that?

Ace

 

[Antonin Koudelka]

Hi Ace,

Thanks for your patience and persistence. English is my second language and
I am not the best communicator.

I will try to explain my view as it differs from you suggestion. I have a PC
running Windows 2000 DC for development on my desk. I have another one at
home for experimenting. I am running Trend's Server Protect on both. On
these two I have no problems to connect to the sysvol share. I am talking
about the sysvol share on the computer itself with network disconnected. I
cannot connect to the sysvol share on the southpath DC from the southpath
DC.

It suggests to me that it is something wrong on the southpath computer.

I have the suspicion that it happened after a guy tried to install
unsuccessfully Intel's VPN client software on it.

I will try to connect another client machine to the southpath DC. The DC is
at another location in the ISP server room. I am connecting to it remotely.
To connect another client I have to organize a trip there and access to the
server room which is a hassle but I will do it.

Antonin

 

[Ace Fekay [MVP]]

In

Hi Ace,

Thanks for your patience and persistence. English is my second
language and I am not the best communicator.

I will try to explain my view as it differs from you suggestion. I
have a PC running Windows 2000 DC for development on my desk. I have
another one at home for experimenting. I am running Trend's Server
Protect on both. On these two I have no problems to connect to the
sysvol share. I am talking about the sysvol share on the computer
itself with network disconnected. I cannot connect to the sysvol
share on the southpath DC from the southpath DC.

It suggests to me that it is something wrong on the southpath
computer.

I have the suspicion that it happened after a guy tried to install
unsuccessfully Intel's VPN client software on it.

I will try to connect another client machine to the southpath DC. The
DC is at another location in the ISP server room. I am connecting to
it remotely. To connect another client I have to organize a trip
there and access to the server room which is a hassle but I will do
it.

Antonin

Your English seems fine to me!

But I am confused now. You are saying on the domain controller itself that
it cannot connect to the sysvol share after the VPN client was installed on
the domain controller itself? Then it tells me the DNS settings the client
is using is not the DNS server the domain controller needs to be querying
for the domain FQDN (called the LdapIpAddress). What appears to be happening
is when the DC connects thru the VPN, it is possibly using some other DNS,
such as the ISP's?

Ace

 

[Antonin Koudelka]

Hi Ace,

The VPN client is no longer there. I uninstalled it. It was not working
anyway and when rebooting the server was sitting for 15 minutes trying to
establish network connection. Maybe the VPN has nothing to do with it. It is
just clutching the straw as I really do not know what caused it and how to
fix it.
I am using Terminal Services to manage the server. However, the same error
happened when I was on the site and using the console
And yes I cannot connect to the sysvol share on the domain controller
itself.

When I try to open Domain Controller Security Policy (on the domain
controller itself) I get an error "Failed to open the Group Policy
Object...." and in details "The network path was not found".

I do not know if this information helps in troubleshooting or just confuses
everybody more.

Antonin

 

[Ace Fekay [MVP]]

In

Hi Ace,

The VPN client is no longer there. I uninstalled it. It was not
working anyway and when rebooting the server was sitting for 15
minutes trying to establish network connection. Maybe the VPN has
nothing to do with it. It is just clutching the straw as I really do
not know what caused it and how to fix it.
I am using Terminal Services to manage the server. However, the same
error happened when I was on the site and using the console
And yes I cannot connect to the sysvol share on the domain controller
itself.

When I try to open Domain Controller Security Policy (on the domain
controller itself) I get an error "Failed to open the Group Policy
Object...." and in details "The network path was not found".

I do not know if this information helps in troubleshooting or just
confuses everybody more.

Antonin

Maybe the VPN wasn't fully uninstalled? Check Add/Remove Hardware for hidden
devices too other than Network & Dialup Connections,

Can you physically access thru Windows explorer the winnt\sysvol folder?

Ace

 

[Antonin Koudelka]

Hi Ace,

I just checked the show hidden devices box and uninstalled the VPN. I
restarted the computer. However, the problem is still there.

I can physically access the folder winnt\SYSVOL\sysvol and all the
subfolders. I checked the permissions on the sysvol folder and subfolder and
they are all correct according to an article on the Microsoft Knowledge
Base.

I searched the Internet and there seems to be a lot of people with the same
problem - not being able to access the sysvol share and group policy.

Antonin


"Ace Fekay [MVP]" >

 

[Ace Fekay [MVP]]

In

Hi Ace,

I just checked the show hidden devices box and uninstalled the VPN. I
restarted the computer. However, the problem is still there.

I can physically access the folder winnt\SYSVOL\sysvol and all the
subfolders. I checked the permissions on the sysvol folder and
subfolder and they are all correct according to an article on the
Microsoft Knowledge Base.

I searched the Internet and there seems to be a lot of people with
the same problem - not being able to access the sysvol share and
group policy.

Antonin

This error, as I previously stated, is *normally* due to a DNS lookup, that
is if there are no other issues to deal with, such as VPN software, personal
or entry point firewalls, ICF, required services not started, etc. I would
look into a .sys file that may still be present from that VPN that was
installed and apparently not fully removed properly (since you found it as a
hidden device). I've seen other software do that, such as Zone ALarm. If
uninstalled properly it leaves mutliple DLLs and a .sys file that the system
is still recognizing as a device, even if you remove it from the device list
in Add Hardware in control panel. The file had to be physically deleted. See
if you can contact the vendor that wrote it to see what other files that may
have not been removed properly.

Otherwise, for normal setups and misconfiguartions, this issue is rather
easy to fix. The issue with the VPN when you first noticed the problem with
the long logon time is a dead giveaway to the problem VPN software. So at
this point, I am sorry I am at a loss other than what I just mentioned.
Untested 3rd party software (and preferrably tested in a non-production
environment) on a DC can always do it to you!


Ace