Windows Forum

Ask something
Discussion Locked

Win2000 in NT4 domain

0 helpful
6 replies

by jeffwatt 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

This one has bitten me twice now, so please help if you can...
I have a Windows 2000 server that is/was a member server in an NT4 (sp5 all around)domain. Everything worked great until one day the Windows 2000 machine fell out of the domain. I've attempted to remove/readd the machine to the domain using a few different steps along the way. I've tried:
Delete the old computer account using Server Manager on an NT4 DC, use the Network Identification page on Win2000 box to create the account while adding the machine to the domain; Deleting the old computer account on the NT4 DC, Creating a new computer account on the NT4 DC, then changing the Domain on the Network Identification page; Leaving the old computer account in place and just attempting to change the domain on the Network Identification Page.
I keep recieving a "The account is not authorized to log in from this station" message.

I am not seeing any access denied messages on the NT4 PDC's or the Win2000 box's security event logs. I'm logging onto the Win2000 server with the local administrator account, and I'm supplying a Domain Admin account for the NT4 domain prompted while I attempt to join the domain on the Win2000 server.

Any ideas?

6 replies

by aaron_wurthmann

ohh, that is a bad one. Okay, well actually you should have never made the machine a member server in the first place, Windows 2000 Member Server participates with the Domain Controllers, although it doesn't keep a local copy of the SAM. So an otherwords a Win2k member server should not be a member of an NT domain. A workgroup server is best for your needs, I would start there. (I'm not quite sure how to do this but here is what I think, I haven't needed to do it, all of my servers are win2k) Move the server back to a workgroup and/or Start -> Run -> DCPROMO. One of the options should be workgroup server, then add it back to the domain afterwards. If non of that works, like I said I haven't tried it out myself, then install the "support" tools of the Windows 2000 server CD (you have to dig for them I think it is x:/support/tools) One of the tools is a dcpromo logger. After install try the dcpromo command again then check the logs if it fails, (you'll have to search for them, I don't remember where they are off the top of my head). I hope that helps.. good luck.

by aaron_wurthmann

TO ANYONE AND EVERYONE THAT READS THIS.. MICROSOFT SUGGESTS THAT WE ALL INSTALL THE SUPPORT TOOLS ON EVERY WINDOWS 2000 SERVER. THE TOOLS AID YOU AS WELL AS MS WHEN TROUBLES ACCUR ON THE MACHINE. X:/SUPPORT/TOOLS/SETUP (WHERE X IS YOUR CD DRIVE LETTER)

PS:
THE TOOLS ARE ALSO ON THE WINDOWS 2000 PRO CD AS WELL.

by jeffwatt

Sorry, this comment seemed to be way off what I know to be true...I have been working with Windows 2000 for too long to have missed that fine point.

by jeffwatt

Ok, some progress on the matter. The immediate problem was fixed by setting the "Secure Channel: Digitally sign secure channel date (when possible)" Local Policy setting to Disabled (and be sure the always option is not overriding this). There wasno problem joining the NT4 Domain after that.

After reading the first response, I don't think I agree with everything in there. First of all, Windows 2000 Server participates with the DC's at about the same level NT4 members participate with theDC's. Also, Win2000 member servers have the ability to act like NT4 member servers. They will attempt to use Win2000 methods of communicating with the domain initially, but they do fall back to the NT4 methods. I think I found the answer to my question in the Secure Channel issue. And I think the machine "fell out" of the domain due to lag in DC replication in NT4 (occasionally NT machines will change their password with the PDC, then attempt to use the new password on a BDC before the SAM replication reaches the BDC, effectively causeing the computer account to be lost).

If I'm wrong here, could somebody point me to some documentation where Answer #1's stance is outlined?

This discussion is closed to new replies.