Domain Controller issues with Virtual Machines

[majd.alwajeeh]

Hi,

I've been experimenting with setting up a number of virtual machines
using VMware. An initial image was created with a Windows XP, and later
a number of clones were created.

I've been able to logon to the network for a while with the virtual
machines, up until recently, where I get the following error message
whenever I try to login :


ERROR:--"Windows cannot connect to the domain, either because the
domain controller is down or otherwise unavailable, or because your
computer account was not found. Please try again later. If this message
continues to appear, contact your system administrator for
assistance."--


Now, this is strange because first of all, the domain controller is
NOT down, as I was able to log onto the physical machine first using
the same account information, and then launch VMware workstation 5.0,
and then launch a Virtual machine, only to be faced by that error.

I've researched this problem a little bit, and I found this
information on a website:



<<< Quote >>>
Why Does My Domain Computer Account Keep Dying?
Computer accounts are managed in the background between the computer
and its domain controller. Periodically the password for the computer
account is updated. Normally, you never know it, or care for that
matter. However if you have a virtual machine that is part of a domain,
eventually this catches up with you. The computer and the domain
controller negotiate a new password, you discard changes to your
virtual machine and restart, and there you have it- invalid computer
account credentials. You'll need to logon to the computer as local
administrator and rejoin the domain to establish a computer account
that is again in sync. When you shut down, be sure to commit changes to
the virtual machine or you'll be back in the same boat!

Another reason for the problem was also suggested: Your local machine
keeps a record of the last time it logged into the domain, which is
obviously set when you take the capture (or if you are using Ghost
imaging or similar). If the difference between todays date and last
time you logged into the domain exceeds 30 days, the domain refuses
entry. This is a microsoft "security" setting which cannot be modified.

With Windows 2003 Server Edition, you can now disable domain account
password updates using the information provided at the link:

http://www.microsoft.com/technet/pr...elp/2ee8cf56-7dcc-4c79-af46-737c40abbf8b.mspx.
<<</Quote>>>>



There are two scenarios from above, either the silent password updating
issue, or the 30 day expiry. Now the immediate solution for my problem
is probably to have the administrator rejoin the virtual machines to
the domain manually, however, this problem might recurr in the future
at which point this setup might be already implemented for the user,
and it'll be a big problem then. That's why i'm trying to understand
what could be done about this, or if these issues don't apply, then why
can't I log in to the network anymore.


I've contacted VMware support, and apparently they've heard of that
'domain controller is down' issue before, but never knew why, and they
were actually surprised to see those two suggestions that I've quoted
above. So I couldn't get help there.

Since Windows XP was setup like this, I'm sure other people have run
into these problems before, and I would very much appreciate it if you
could point out what the solutions are.


thanks in advance for the help,
mjd

 

[Majd]

Hello,

Thank you for any replies. I've rejoined the domain, and ensured the
SID and computer name are always consistent. I have to see if I get
kicked off the network again, but that'll probably be in a month's time
from the rejoining.

As for your question CraZ, in my post above I've quoted two possible
sources of the problem, it seems to me like these are likely in your
situation. Maybe the image you have negotiates a new password update
with the server, but when you revert, you lose those changes, and thus
cannot log back on to the server. You should investigate this
possibility by following the instructions in my post above for figuring
out if this feature is enabled in your server's configurations or not
(BTW, more research has revealed that this feature is DISABLED by
default).

Or it could be the second possibility, where it expires cuz when you
revert it, it'll think it joined the domain at the time of creating the
image, but when you revert, it might think this is the first time you
log in since creation, and probably a few months have passed by then so
it might expire. You should explore this option as well, I'm not sure
of a solution though as I've never dealth with ghost images that much
(and the reply I keep getting everywhere with VM's is that this
behaviour will exist in physical machines as well, and thus is
inherently a problem in all computers, not just VM's).

I hope this helps, and if I get any more information, I'll post back
here, you do the same.

Thanks all,
MJ