Network Authentication Problems

[James Griffith]

Problem 1.

The network is controlled by a pair of Windows 2000
Domain Controllers. All the clients are running XP. There
is one subnet, and (at present) no connections to other
networks, save that a server (the one running the VPN
stuff below) is multihomed, with one NIC on the office
network and the other connecting through the firewall to
the internet.

Occasionally I am getting on my XP client a 5719 Netlogon
error (the cannot find a domain controller one) but can
ping the DC, look at files on it etc just fine. Also, I
cannot run the AD administrative tools (which are
installed from the Win 2003 Svr Admin Pack). These ran
fine on my wrkstation for months, but now when opened say
they cannot connect to the Active Directory. Needless to
say, I can search the Active Directory without any
difficulties.

Do these problems sound familiar to anyone? If they do,
it would be really useful if you could give me a hint.

Problem 2.

As I mentioned, that first problem is a nuisance but not
crucial (I can administer AD on the servers no problem).
But I included it in case it is related to this one.

I have RAS working on the multihomed server and when I
connect via a VPN from either a Win 98 or a Win 2000
machine, I get authenticated, though I get asked for the
password a couple of times, and then experience a variety
of problems.

Having connected to the network, I can ping any of the
servers on it, but when I type in their UNC name I get an
error telling me they don't exist. The only server this
does not affect is the one running RAS (and occasionally
a couple of the others, seemingly at random). I can never
view the shares on either of the DCs though, again, I can
ping them.

From Win 98 I get an error telling me no DC could be
found when I log on, but on Win 2000 I do not.

Finally, on Win 98 I never get a list of computers on the
network, but with Win 2000 I do, but clicking on most of
them gives me the same "you cannot connect to this server
because it does not exist" error message.

Once after trying the VPN connections I got the same 5719
Netlogon error on the multihomed server, but normally I
don't.

I am also getting an error from the browser service on
the multihomed server (saying it can't find a master
browser), but this is happening on the interface to the
internet where it would be expected not to find a master
browser service. I do not get this error on the interface
to the internal network.

If anyone has any ideas about this, I would be most
grateful.

Cheers,


James Griffith

 

[Bill Grant]

Hi,

This can be a problem with RRAS enabled as a VPN server on a DC.

The first thing I would do is disable Netbios over TCP/IP on the external
NIC of the multihomed server, if you have not already done so. Then you need
to also disable it on the RRAS "virtual" IP (ie the one the remote clients
communicate with). This requires a registry change.

To prevent Netbt on the RRAS interface.

Open Registry Editor.
Navigate to HKLM\System\CurrentControlSet\Services (continued next line)
\RemoteAccess\Parameters\Ip

Create a new REG_DWORD called DisableNetbiosOverTcpip
Set its value to 1

These two things are to prevent the Netbios name of the server being
associated with more than one IP. This is vital for browsing.

What roles are assigned to the two AD servers? The PDC emulator role
should not be assigned to the multihomed server. This server automatically
becomes your domain master browser, and should not be multihomed.

For logon, W9x/NT behave differently from W2k/XP. The former use the
NT style logon using Netbios names (ie they look for the <domainname
1c> special name for logon server), while W2k/XP clients use DNS and LDAP to
find a logon server in AD. On a single segment, the W9x clients should be
able to find a logon server by broadcasts. If you go to multiple segments,
you will need WINS to resolve Netbios names across routers. From remote
clients, WINS is also pretty much necessary, unless you use LMHOSTS files.
(A bit messy). If the W98 clients have the AD client installed, they behave
more like W2k.

Name resolution from a remote can be tricky. Here again, W2k/XP prefer
DNS, while W9x/NT handle Netbios better. This really involves running WINS
or the LAN, because broadcasts don't work over WAN connections. If the
remote client can see the WINS server on the LAN, it can resolve Netbios
names of LAN machines. Browsing is possible, but not easy.

With DNS it is a matter of getting the DNS suffixes correct in the
client's connection properties, so that they look in the right place.

Best wishes,
Bill
MS MVP - Networking