error 40960 and 40961 HELP !

[Thomas]

We have a small (17 users) office network with 4 servers.
1: Proxy (NT4)
2: fastserver > win2k server
3: transposserver (DC) > win 2k server
4: topserver

Our network consists of mainly windows xp client machines.
All of the machines get these two event id's:

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40961
Date: 27/11/2003
Time: 13:55:41
User: N/A
Computer: TESTPC2
Description:
The Security System could not establish a secured
connection with the server cifs/topserver. No
authentication protocol was available.


AND

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 27/11/2003
Time: 13:55:41
User: N/A
Computer: TESTPC2
Description:
The Security System detected an attempted downgrade attack
for server cifs/topserver. The failure code from
authentication protocol Kerberos was "There are currently
no logon servers available to service the logon request.
(0xc000005e)".

I get these msges also for the fastserver, transposserver
and proxy.

This is also a msg I get:

Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5790
Date: 27/11/2003
Time: 9:05:05
User: N/A
Computer: TESTPC2
Description:
No suitable Domain Controller is available for domain
TRANSPOSIA. An NT4 or older domain controller is available
but it cannot be used for authentication purposes in the
Windows 2000 or newer domain that this computer is a
member of. The following error occurred:
There are currently no logon servers available to service
the logon request.



Also get this one:

Event Type: Warning
Event Source: W32Time
Event Category: None
Event ID: 14
Date: 27/11/2003
Time: 9:05:03
User: N/A
Computer: TESTPC2
Description:
The time provider NtpClient was unable to find a domain
controller to use as a time source. NtpClient will try
again in 15 minutes.



Some people get kicked from the servers .

I already searched the whole net for these errors, and I
found that it has probably smth to do with the fwd/reverse
lookup zones at out DC (transposserver).

When I look at the 'manage DNS' I see two forward lookup
zones:

TRANSPOSIA
And
TRANSPOSIA.COM

The problem here is, that there are no _msdcs, _sites,
_tcp, _udp folders at the transposia domain (the domain we
use now).
At the transposia.com domain I can see those folders
though, but. we can't connect to the transposia.com domain.


Reverse lookup zone= 192.168.0.* Subnet with a pointer to
192.168.0.30 (the DC)
DC's dns is pointing to itself: 127.0.0.1

Conclusion:

I think the problem is the 'transposia' domain, it does
not containt the '_' folders (with kerberos, etc) ..

What can I do best? Delete the transposia.com domain and
rename the transposia.com?
Try to get the 'folders' in the transposia domain ? (how?)
Smth else??????

I hope somebody can help me out here ..

 

[Marina Roos]

DNS should point to the server-IP on all server- and clientnics.
Check the ipconfig/all from the clients. Everything should be pointing to
the server-IP.
If you have W9x/ME/NT4-clients, you will need WINS installed on the server
as well.
Options 003, 006, 015, 044 and 046 (0x8) should be set in DHCP-server, Scope
options.
In DNS-server you should set the ISP-DNS-numbers in the tab Forwarders.

Marina