Tommy said:
We have a 2000DC and a 2003DC in a mixed mode. The 2000 will soon be
removed. I have a strange problem though. One of the XP clients cannot
access any shares or resources on the 2003 server. It keeps asking for
username and password. Not even the administrator can access the
2003. I have taken the XP from domain and rejoined, checked tcpip
settings and so on.... Everthing seems ok.
Only error is NetBT 4321 sometimes.
Shenan said:
Only one PC?
Ghost it..
Rebuild it from scratch..
Update all the drivers and patches to the latest..
Put any necessary data back on it.
Tommy said:
Typical Microsoft answer
Reinstall....last option....
No - not Microsoft - logic.
Obviously you have been banging your head on this for some time or you
wouldn't have come here to ask (or you shouldn't be a system administrator -
one or the other I suppose.) It's a time/business thing. Work on it for 8
hours and get no where - rebuild it and have it back to the end-user in 4 or
less hours in KNOWN better shape and completely updated (so it will now
likely be "ok" longer.) Pure logic. Shortest path.
You want to 'figure it out' instead? Clean up the machine.
I would still make a ghost image NOW - before you start trying to fix it -
because sometimes you make things worse by removing the crap that made the
problem.
- Reset all the file/folder permissions using the security templates..
- Check for all spyware/adware you can and clean it off..
- Try a different user profile on the machine (by creating a new one - don't
use ANY that are there already)
- Update all hardware drivers, check for BIOS upgrade..
- Put in a different NIC and/or check the NIC settings (is it an Intel NIC
set to Auto/Auto connected to a Cisco network - try setting it to 100/Full
or - 100/half instead - They don't play well with CISCO sometimes.)
- Is it DHCP or Static IP?
- When you removed it from the domain - didy ou manually delete it from the
domain and use AD Sites and Services to manually replicate changes - and
still wait 15 minutes before joining it back to the domain?
- Did you try changing the name and SID before joining it back to the domain
in case it was a problem where it kept recreating some bum account on the
domain?
- Is this even an Sp2 machine? If not - be sure to patch it ASAP.
- Have you looked in the event log of both the DC and this particular
machine for what errors are produced when you try to connect?
Scan it with several online (not the same AV already on it) Antivirus
softwares:
Panda Antivirus Titanium (~$39.95 and up)
(Free Online Scanner:
http://www.pandasoftware.com/activescan/)
RAV AntiVirus Online Virus Scan (Free!)
http://www.ravantivirus.com/scan/
Trend Micro (~$49.95 and up)
(Free Online Scanner:
http://housecall.trendmicro.com/housecall/start_corp.asp)
Scan and clean it with at LEAST the first five AntiSpyware applications
below and make sure you do FULL SYSTEM SCANS - not any smart scans..
immunize with those who have that ability as well (Use IE-SpyAd2 so it
immunizes all users) and be sure your Internet Explorer settings (Temporary
Internet Files) are reasonable and emptied along with Cookies first.
First - make sure you have NOT installed "Rogue AntiSpyware". There are
people out there who created AntiSpyware products that actually install
spyware of their own! You need to avoid these:
Rogue/Suspect Anti-Spyware Products & Web Sites
http://www.spywarewarrior.com/rogue_anti-spyware.htm
Also, you can always visit this site..
http://mvps.org/winhelp2002/unwanted.htm
For more updated information.
Install the first five of these: (Install, Run, Update, Scan with..)
(If you already have one or more - uninstall them and download the
LATEST version from the page given!)
Lavasoft AdAware (Free and up)
http://www.lavasoft.de/support/download/
(How-to:
http://snipurl.com/atdn )
Spybot Search and Destroy (Free!)
http://www.safer-networking.net/en/download/index.html
(How-to:
http://snipurl.com/atdk )
Bazooka Adware and Spyware Scanner (Free!)
http://www.kephyr.com/spywarescanner/
(How-to:
http://snipurl.com/ate3 )
SpywareBlaster (Free!)
http://www.javacoolsoftware.com/sbdownload.html
(How-to:
http://snipurl.com/ate6 )
IE-SPYAD2 (Free!)
https://netfiles.uiuc.edu/ehowes/www/resource.htm
(How-to:
http://snipurl.com/ate7 )
CWShredder Stand-Alone (Free!)
http://www.intermute.com/spysubtract/cwshredder_download.html
Hijack This! (Free!)
http://www.spywareinfo.com/~merijn/downloads.html
(Log Analyzer:
http://hjt.iamnotageek.com/ )
ToolbarCop (Free!)
http://windowsxp.mvps.org/toolbarcop.htm
Microsoft AntiSpyware BETA (in testing stages - Free!)
http://www.microsoft.com/athome/security/spyware/software/
(How-to:
http://snipurl.com/fqur )
Once you have done all that - uninstall any third party or otherwise
software from the control panel you know is not being used/shouldn't be
there - if this is a business machine and you are the system administrator -
you should know what should be there.
Find and eliminate any startups/services (set them to manual) you don't
need:
Configuring Services
http://snakefoot.fateback.com/tweak/winnt/services.html
Task List Programs
http://www.answersthatwork.com/Tasklist_pages/tasklist.htm
Processes in Windows NT/2000/XP
http://www.reger24.de/prozesse/
There are also applications that AREN'T services that startup when you start
up the computer/logon. One of the better description on how to handle these
I have found here:
Startups
http://www.pacs-portal.co.uk/startup_content.php
Double-check the manufacturer web pages (particularly in your case for the
Motherboard Chipset and Network Card) for the latest firmware and Windows XP
drivers available and install those.
I guess you tried System Restore - if you have it on.. In any case - now is
a good time to clear it..
- Turn off System Restore.
http://support.microsoft.com/kb/310405
- Reboot the Computer.
- Review the first bullet to turn on System Restore
- Make a Manual Restoration Point.
http://snipurl.com/68nx