Modify the Gpttmpl.inf file for the Default Domain Controllers Policy. Modify the Gpttmpl.inf file to confirm that the appropriate users have the Access this computer from the network user right on the domain controller. Method 3: Check the "Access this computer from the network" user rights Additionally, verify that the time is correctly synchronized between client computers and domain controllers. Verify that the time is correctly synchronized between domain controllers. We recommend that you set up forwarders to the ISP for name resolution on the Internet.įor more information about configuring DNS for Active Directory directory service, click the following article numbers to view the articles in the Microsoft Knowledge Base: 254680 DNS namespace planning Method 2: Synchronize the time between computers We recommend that you point the domain controller to itself or to another DNS server that supports dynamic updates and SRV records. One of the most common DNS mistakes is to point the domain controller to an Internet Service Provider (ISP) for DNS instead of pointing DNS to itself or to another DNS server that supports dynamic updates and SRV records. Make sure that DNS is configured correctly.The Netdiag tool is in the Windows 2000 Server Support Tools on the Windows 2000 Server CD-ROM or as a download. Resolve any DNS errors in the Netdiag.log file before you continue.This command creates a Netdiag.log file in the folder where the command was run. At a command prompt, run the netdiag -v command.Method 6: Reset the machine account password, and then obtain a new Kerberos ticket.Method 5: Fix the Kerberos realm (confirm that the PolAcDmN registry key and the PolPrDmN registry key match).Method 4: Verify that the domain controller's userAccountControl attribute is 532480.Method 3: Check the Access this computer from the network user rights.
Method 2: Synchronize the time between computers.Method 1: Fix Domain Name System (DNS) errors.
Microsoft Knowledge Base articles that describe less common fixes for these symptoms are listed later. Try each method until the problem is resolved. The list is followed by steps to perform each method. The following is a list of methods to try. There are several resolutions for these symptoms. The following event may be logged in the system event log of the affected domain controller: Event Type: Errorĭescription: The Kerberos Key Distribution Center service terminated with the following error: The security account manager (SAM) or local security authority (LSA) server was in the wrong state to perform the security operation. Kerberos does not have a ticket for krbtgt/. The Netdiag tool may display the following error messages:ĭC list test. Microsoft Outlook clients that are connected to Microsoft Exchange Server computers that are using affected domain controllers for authentication may be prompted for logon credentials, even though there is successful logon authentication from other domain controllers. Contact your system administrator to verify that your domain is properly configured and is currently online. Naming information cannot be located because: Target account name is incorrect. Naming information cannot be located because: No authority could be contacted for authentication. If you start any Active Directory administrative tools from the console of an affected domain controller, including Active Directory Sites and Services and Active Directory Users and Computers, you may receive one of the following error messages: No logon servers available (c000005e = "STATUS_NO_LOGON_SERVERS") When you try to use network resources from the console of an affected domain controller, including Universal Naming Convention (UNC) resources or mapped network drives, you may receive the following error message: If you use Active Directory Sites and Services to trigger replication, you may receive a message that indicates that access is denied. Last attempt yyyy-mm-dd hh:mm.ss failed, result 5: Access is denied. Last attempt yyyy-mm-dd hh:mm.ss failed, result 1753: There are no more endpoints available from the endpoint mapper. When you run the REPADMIN /SHOWREPS utility locally on a domain controller, you may receive one of the following error messages: When you run the Dcdiag tool on a Microsoft Windows 2000-Server based domain controller or on a Windows Server 2003-based domain controller, you may receive the following error message: This article provides common resolutions to the issue where domain controller is not functioning correctly.Īpplies to: Windows Server 2012 R2 Original KB number: 837513 Symptoms
0 kommentar(er)
