REPOST: AD MMC Failed HELP !!

[M. T]

Ok, I have posted this issue a few times and after
further attempts I have been unable to fix this problem.
In short, my AD snapin is not accessable on my PDC. 40
users/ 1 PDC / 3 files servers / 1 Terminal Server / 1
mail (freebsd) server is our layout. Below is the pasted
issue from my other posts:

Main Post:

I am having issues with my Active directory Snap-in. I
attempted to:

Type Secedit /configure /cfg %SystemRoot%
\Repair\secsetup.inf /db secsetup.sdb and press Enter.

3. Type Secedit /configure /cfg %SystemRoot%
\Repair\secdc.inf /db secdc.sdb and press Enter

Which generated the below .log file (with errors):

----Configuration engine is initialized successfully.----

----Reading Configuration template info...


----Configure User Rights...

User Rights configuration completed successfully.


----Configure Group Membership...

Group Membership configuration completed
successfully.


----Configure Registry Keys...
Error 234: More data is available.
Error enumerating info for
machine\system\currentcontrolset\control\print.

Registry keys configuration completed with error.


----Configure File Security...
Warning 2: The system cannot find the file specified.
Error setting security on c:\ntbootdd.sys.

File security configuration completed
successfully.


----Configure General Service Settings...

General Service configuration completed
successfully.


----Configure available attachment engines...

Attachment engines configuration completed
successfully.


----Configure Security Policy...
Configure password information.

System Access configuration completed
successfully.

Audit/Log configuration completed successfully.

Kerberos policy configuration completed
successfully.

Registry values configuration completed
successfully.


----Configure available attachment engines...

Attachment engines configuration completed
successfully.


----Un-initialize configuration engine...


All users can logon to the Domain just fine. So my DC
seems to still be auth. all users correctly. I download
a remote AD tool (Hyena) and was able to create my needed
new account, but I was not able to set a password. As a
message popped up with a LDAP error connecting to. I was
able to allow this new user to join the Domain just as
normal. How might I go about repairing the above
generated errors in the *.log file? File "ntbootdd.sys"
seems to be in reference to SCSI drives. Which my DC is
using IDE only...??


Much Thanks in advance for any help with this matter!!


Reply Post:

Schema Owner, Domain role owner, PDC role, IRD pool
manager, and infrastructure owner all point to my DC.

What might happen on a reboot with all the above
happening currently?

Any suggestions would be GREAT!!

When I attempt to open the AD snap-in, I get this error
message:

"Naming information can not be located because: The
logon attempt failed." But like I said, I can gain access
to AD via Hyena but can not modify passwords. I can
create accounts though.

 

[Diana Smith [MSFT]]

Hello,

Please remove the registry settings from the group policy -->
machine\system\currentcontrolset\control\print.

Also remove the following entry from "configure file security" ---> Error
setting security on c:\ntbootdd.sys.

Check your Domain and Domain Controller Policies for these entries. Once
you find them, remove them and than refresh the policy on that machine.

Thank You.

Diana.

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[M. T]

Well, I can not access GPO via my PDC. So I attempted to
get to it via Hyena. This is the error message I get
when attempting to view the GPO: "Group Policy Error"
Failed to open the Group Policy Object. "You may not
have appropriate rights" (yet I am logged in with DC
Admin account) "The specified domain either does not
exist or could not be contacted" ...?? how can I verify
that my DC is still "working" as a DC? It is still
allowing all users to sign on to the domain. another
thing that seems incorrect is that normally when an
account is joined to a domain, within documents and
settings the users profile folder will show
username.domain-name. Which seems to be no longer the
case on our LAN. Might this shed a little light on the
problem? In the event that the AD snap-in is "not
fixable", would I be able to create a new Windows 2000
Server w/AD and somehow "re-direct" the local users
authenication process/rights to this new machine w/o
cuasing any ill-effects on the users profiles?

Much thanks

 

[M. T]

More information: I attempted to create a new GP and got
this error: "Unable to create new policy 'LDAP://DBA-
SERVER/DC=saminco,DC=local'. the network path was not
found.