Kerberos tickets are taking me down.. Help Many servers Fail Kerberos netdiag test...

[Scott Townsend]

Help!!!

I'm having Kerberos Issues!!!

May of my users are getting denied access to servers. And many of the server
are failing the Kerberos Test from Netdiag.exe...

When I run netdiag I get the following on the server machines:
Kerberos test. . . . . . . . . . . : Failed
[FATAL] Kerberos does not have a ticket for :
And depending on the server the name is in the following
formats:
<host/server-name.domain.COM.>
<server-name$>


I've been working with one server trying to get its Kerberos ticket back in
line and I've done the following to it with no Success:
Renamed it (twice) and added it back to the domain
ran the netdom remove and netdom join
Went to ADUG and did a Reset Account

Help...


Thanks,
Scott<-

 

[Aimme Lirette MSFT]

These servers may not be domain controllers, but look at the steps in this
article:

http://support.microsoft.com/?id=837513

Aimme

 

[Scott Townsend]

Thanks for the reply,

When I try to get to that KB Article it come up with Doc Not Available.

http://support.microsoft.com/default.aspx?scid=fh;EN-US;KBERROR&style=error

I've tries entering it in the Search as the Article ID with the same
results.

Thanks,
Scott<-

These servers may not be domain controllers, but look at the steps in this
article:

http://support.microsoft.com/?id=837513

Aimme

--
This posting is provided "AS IS" with no warranties, and confers no rights.

Help!!!

I'm having Kerberos Issues!!!

May of my users are getting denied access to servers. And many of the server
are failing the Kerberos Test from Netdiag.exe...

When I run netdiag I get the following on the server machines:
Kerberos test. . . . . . . . . . . : Failed
[FATAL] Kerberos does not have a ticket for :
And depending on the server the name is in the following
formats:
<host/server-name.domain.COM.>
<server-name$>


I've been working with one server trying to get its Kerberos ticket back in
line and I've done the following to it with no Success:
Renamed it (twice) and added it back to the domain
ran the netdom remove and netdom join
Went to ADUG and did a Reset Account

Help...


Thanks,
Scott<-

 

[Steve]

you could try this

at the console open a cmd session using the AT scheduler service in
interactive mode
this will open the cmd window under the system account
then run kerbtray from the resource kit this will allow you to see the
machines kerberos tickets (eventually)
use setspn from the resource kit to list the spn's that the machine has
registered.
if there is not any then register them.
run a secedit /refreshpolicy machine_policy /enforce
to refresh the group policy of the machine and see if the kerberos ticket
has appeared in kerbtry


also just check your domain is in time sync, this is very impotant for
kerberos
here's a resouce just in case
http://labmice.techtarget.com/windows2000/timesynch.htm
hth
Steve

Thanks for the reply,

When I try to get to that KB Article it come up with Doc Not Available.

http://support.microsoft.com/default.aspx?scid=fh;EN-US;KBERROR&style=error

I've tries entering it in the Search as the Article ID with the same
results.

Thanks,
Scott<-

These servers may not be domain controllers, but look at the steps in this
article:

http://support.microsoft.com/?id=837513

Aimme

--
This posting is provided "AS IS" with no warranties, and confers no rights.

Help!!!

I'm having Kerberos Issues!!!

May of my users are getting denied access to servers. And many of the server
are failing the Kerberos Test from Netdiag.exe...

When I run netdiag I get the following on the server machines:
Kerberos test. . . . . . . . . . . : Failed
[FATAL] Kerberos does not have a ticket for :
And depending on the server the name is in the following
formats:
<host/server-name.domain.COM.>
<server-name$>


I've been working with one server trying to get its Kerberos ticket

back
in

line and I've done the following to it with no Success:
Renamed it (twice) and added it back to the domain
ran the netdom remove and netdom join
Went to ADUG and did a Reset Account

Help...


Thanks,
Scott<-