Windows Forum

Ask something
Discussion Locked

cannot access internet in terminal serv.

0 helpful
13 replies

by reference

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have a win2k server running in application mode. The internet and DNS works fine if logged in as administrator, but if logged in with non-administrative rights, DNS does not work. I can't access the internet or ping any names (www.yahoo.com, www.microsoft.com, etc...) I can ping any internet ip addresses so I know it's a DNS thing. I can view ip info from cmd prompt, looks fine (static ip. DNS pointing to itself and functioning properly otherwise) I've checked terminal services configuration,local/domain policies, user properties....but I am obviously missing something! Thanks in advance for your help!

13 replies

by acattr

I've never heard of a DNS server selectively restricting access based on Username.

But what you can do, as standard practice, is have more than one DNS server listed in your TCP/IP properties. Add a new dns server to your domain or Call yourISP and ask them what thier DNS servers are, Put one of them as the second DNS server.

YOu can also enable logging on the DNS server. And use nslookup.exe to run queries on it, to see what errors you get back.

by reference

I don't think it's recommended to have anything other than the Server's IP address listed in dns section of the tcp/ip properties, are you thinking of forwarders in the DNS properties? I'll play around a little more with logging and nslookup, thanks

by jon pratt

When you say that DNS is pointing to itself what do you mean? More specifically what server is the DNS service running on?

by reference

The server that I connect to is the DNS server for my domain. In this server's TCP/IP properties, the ip address I have listed for DNS server is it's own ip address (server ip = 192.168.1.254 DNS server properties = 192.168.1.254) since it is the DNS server for the domain it needs to point to itself for DNS to function properly.

by acattr

there are two fields in DNS, one for Primary DNS server and another for secondary DNS server. Not looking for points here, but you have these two fields for redundancy. If the first doesn't work, it will use the next. Out of the 50+ networks I havesetup, I have never setup a server or DHCP settings without atleast two DNS servers.

AC - Sr. Network Systems Engineer
MCSE+Internet in NT, MCSE 2000, Network+, CCNA, A+

by reference

Microsoft recommends only using the server ip in the networking->TCP/IP properties for DNS servers, and to use forwarders within the DNS for any ISP or global DNS resolution. Do you not agree with this configuration? Also, would this have any bearing on the fact that an administrator, or user with admin rights has no problems? Thanks for the input

by acattr

I agree that you can use forwarders, but if the DNS service fails on that one server or if you bring it down, What are you going to do for resolution of names? Call Microsoft?

PS: DNS does not use ACL's for authentication. It will allow anybody access.

by reference

Understood, and I hate to keep rejecting your responses (I tried e-mailing you directly but got rejected) Anyway, I do add global dns entries into my dhcp options that go out to the workstations on the LAN(I apologize for not understanding what you were getting at), But the problem I'm having is on the server itself (accessed via terminal services), And ONLY with non-admin users (either from inside the LAN or remotely) in which case the information from DHCP is not used since the terminal "session" runs directly on the server.
Please feel free to e-mail me directly!reference@ccaccess.net

by beermonster

Hi,
Just a thought, but I don't suppose there's a proxy or ISA server that's blocking traffic for everyone but admin?

by reference

Not an issue, users on the LAN can access fine, it's only through terminal services that resolution doesn't work for non-admin users. Thanks!

This discussion is closed to new replies.