Thanks for helping me out with this problem. I work for a small company that hired me as IS Manager. They recently implemented a new version of their AD server. I was hired to manage their IIS servers and I am not as familiar with AD. The original AD server (2000) also served as the main Domain Controller without problems for several years. Like I said I am more familiar with IIS than AD.
The original server was running Win2000 Adv Server for several years as an Active Directory/Domain Controller. Decided to rebuild the computer using Win 2003 Ent Server. Hard drives were all reformatted. The server runs raid 5. After the server was rebuilt I replicated the DNS server lookup zones manually first. Then I Implemented Active Directory. Following are the steps I took to implement AD.
1. After implementing AD on the new server I embedded all the network machines (all containing their own IP number-not NAT numbers).
2. I noticed that the tab that displays the computer operating system in AD were all blank where they were all displayed under the old Win2000 server.
3. Another forum user told me to re-assign the SIDs by clicking on the Network Identification button on each computer. This caused AD to recognize the machine on the network.
4. Each computer logs into the network with the administrator account. Each computer already had a “Documents & Settings” account labeled Administrator.CFSAC. However, after logging in using the new AD, each computer created a new “Doc & Settings” account labeled, “Administrator.CFSAC.000.
5. After these steps were taken the website files on the Web server could not be modified through such programs as Dreamweaver CS3 throwing the error message: “Access Denied
6. I went directly onto the Web server and made sure the “Administrator” had “full” permissions on the files and folders.
7. This did not work. The administrator still had no permissions to modify the files.
8. I can access the files through “My Network Places” and can create a network share but just to “read” only access. I cannot even create a new folder.
9. I then began to deduce that the computers were logging into the network using the “Administrator.CFSC.000” rather than the old “Administrator.CFSAC” account. So I implemented the following procedure:
a. I logged into the computer as the computer’s administrator account.
b. I copied the entire “Administrator.CFSAC” files, deleted both the “Administrator.CFSAC” and “Administrator.CFSAC.000” accounts.
c. Then I demoted the computer to “Workgroup.”
d. I then logged into the computer and joined it to the domain. The network user name/password window opened and I entered the user name “administrator” and password. This generated a “Welcome to CFSAC.COM domain. Success.
e. Then I re-logged into the network using the network’s Administrator account. Which created an account in “Docs & Settings” labelled “Administrator.CFSAC.”
f. I then logged out of the computer, re-logged in as the computer’s “administrator” account.
f. I then copied all the old “Administrator.CFSAC” account files into the new “Administrator.CFSAC” account. However, this did not work.
Since I had completely re-programmed each individual computer without result I am assuming the problem stems from Active Directory. Since AD is so complex I am not sure where to turn next. Does the problem stem from Group Policies or is there an AD database that could have become corrupt due to so many changes on the network computers? Could the problem be a combination of these along with a SIDs problem I am just not sure. The problem of “no file modification rights” seems to have begun right after I implemented the “Network Identification” applet on each computer so that AD could recognize the computer.
At this stage I don’t want to start digging around in AD until I know what I am doing. I could make the problem worse than it is. I joined several AD forums online, but most of the advice I have gotten from them is sketchy and I don’t have a lot of faith in what I am being told.
Thanks in advance, my name is Rick