Can't Copy Local Profile - "Local Security Authority cannot be contacted"

[Bryan Linton]

I'm the admin for a Server 2003 domain with about 30 users. All
workstations are running 2000 Pro or XP Pro. I'd like to deploy roaming
user profiles in our organization, so I began testing roaming profiles by
converting my local profile to roaming several weeks ago. So far, it's
worked well. I'm now setting up a temporary computer for a new user, but
she'll only use this computer for a few weeks before "her" computer becomes
available. I figured I'd set up her with a roaming profile as well, so I
could avoid some duplication of work when I have to migrate her to her
regular machine in a few weeks. Things are not going well.

I created a local profile for her by logging in with her domain account once
the computer had been joined to the domain. I then logged her out and
logged on with the domain admin account to copy her local profile to a
network location. When I click the Copy To button, as you know, I have two
configurable options: "Copy Profile To" and "Permitted to use". For
"Copy Profile To" I have no problems browsing to the network location I've
desginated for profiles. Then I click "Permitted to use" to choose the user
to set permissions. Here's where I have trouble.


After clicking the "Change" button, I'm in the "Select User or Group"
dialog. When I click the "Advanced..." button to browse the directory for
her user account, I get the following message:

"The Advanced page cannot be opened because of following error:
The Local Security Authority cannot be contacted"

It doesn't matter what I specify for the object type. The location (our
domain) is specified correctly.

When this first failed, the workstation in question had a copy of XP that
had been upgraded from 98 a couple of years ago. I assumed that the
installation of XP was ailing, and since there was nothing that needed to be
preserved on that hard drive, I simply wiped it and performed a clean
install of XP Pro this morning, thinking that would solve the problem.
Nope.

When I try to log on to the same machine with my roaming user profile, it
also errors out, claiming it can't find the server copy of my roaming user
profile. I'm able to log onto other workstations with my roaming profile.
Other workstations also allow me to click the "Advanced..." button on the
"Select User or Group" dialog without the error message.

Any ideas, anyone?

Thanks in Advance,

Bryan Linton
Connell Insurors, Inc.

 

[Bryan Linton]

After digging in the event logs, I've discovered that for whatever reason,
I'm getting warnings on Event ID 40960 & 40961 from source SPNEGO in the
System Log. Each message is as follows:

40960: The Security System detected an attempted downgrade attack for server
cifs/[fqdn of our server]. The failure code from authentication protocol
Kerberos was "No authority could be contacted for authentication.
(0x80090311)".

Right after that appears event ID 40961:

The Security System could not establish a secured connection with the server
cifs/[fqdn of our server]. No authentication protocol was available.

The same set of messages appears for two other servers, LDAP and DNS (all of
which are the same SBS 2003 Server).

In the Application Log, I get the following corresponding messages:

Event ID: 1053
Source: Userenv

Windows cannot determine the user or computer name. (An internal error
occurred. ). Group Policy processing aborted.

This machine also fails to run the logon script that all the other
workstations have no problem running.

I've verified what I think are correct DNS entries for this client in the
forward and reverse lookup zones.

 

[PlayDoh]

We're having similar problems on our network. When we reboot, th
problem seems to disappear (or jump to some other computer) and neve
happen on that particular PC again. Have you found out anything?

Thanks in advance,

Chri


-
PlayDo