SBS 2003 R2 authentication slow - Applying computer settings : computer, settings, applying, 2003, sbs

May 17, 2008 11:58am pdt

1. TechSoEasy 589,227
2. RobWill 348,566
3. KCTS 142,774
4. Sembee 125,597
5. kieran_b 91,862
6. Dave_AND 90,993
7. mwecompu... 85,930
8. leew 79,627
9. olafdc 74,402
10. suppsaws 69,651
11. DrDave242 68,633
12. MrManderson 68,455
13. SysExpert 45,630
14. 18526 44,870
15. ormerodr... 44,293

1. TechSoEasy 5,981,216
2. Sembee 780,429
3. RobWill 557,256
4. olafdc 538,367
5. leew 452,493
6. KCTS 388,529
7. suppsaws 257,016
8. redseate... 248,724
9. vico1 205,195
10. Dave_AND 175,108
11. MrManderson 166,963
12. keith_al... 163,836
13. MPECSInc 144,854
14. tigermatt 141,769
15. sguinn100 135,295

02.09.2007 at 06:28AM PST, ID: 22156435

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

7.8

SBS 2003 R2 authentication slow - Applying computer settings

Zone: SBS Small Business Server

Tags: computer, settings, applying, 2003, sbs

Domain computer/user authentication is slow on SBS 2003 R2. It takes too long for domain clients to log on. They take >8 minutes after powering up waiting with the message Applying computer settings then take >5 minutes more waiting with the message Applying your personal settings.

Ive taken Jeffs, TechSoEasy, advise to RTFM, use the wizards (especially CEICW and connectcomputer), and put my enterprise notions of administration to rest. Even so, Im not sure Ive made the best decisions for the wizard options.

Im feel confident the DNS/DHCP works but here is an obligatory dump of a clients IPCONFIG /all:

Windows IP Configuration

Host Name . . . . . . . . . . . . : JACK01
Primary Dns Suffix . . . . . . . : Business.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : Business.local
Business.local

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : Business.local
Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated Cont
roller
Physical Address. . . . . . . . . : 00-15-C5-59-15-97
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.16.19
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.16.2
DHCP Server . . . . . . . . . . . : 192.168.16.2
DNS Servers . . . . . . . . . . . : 192.168.16.2
Primary WINS Server . . . . . . . : 192.168.16.2
Lease Obtained. . . . . . . . . . : Friday, February 09, 2007 7:37:55 AM

Lease Expires . . . . . . . . . . : Saturday, February 17, 2007 7:37:55 AM

Start your free trial to view this solution

Question Stats

Zone: OS

Question Asked By: Barnabus2006

Solution Provided By: TechSoEasy

Participating Experts: 7

Solution Grade: A

Translate:

Loading Advertisement...

Microsoft

Internet Protocols
Applications

Development
OS

Hardware
Windows Security

Apple

Operating Systems
Hardware

Programming
Networking

Software

Internet

Search Engines
File Sharing
WebTrends / Stats
Spy / Ad Blockers

Web Browsers
New Net Users
Web Development
Chat / IM

Anti Spam
Web Servers
Anti-Virus
Email Clients

Gamers

Tips
Online / MMORPG
Puzzle
Emulators

Action / Adventure
Role Playing
Consoles
Game Programming

Strategy
Sports
Misc
Computer Games

Digital Living

Hardware
New Net Users
New Users

Software
Digital Music
Gaming World

Home Security
Apple
Networking Hardware

Virus & Spyware

Vulnerabilities
IDS
Encryption
Anti-Virus

Operating Systems Security
Software Firewalls
WebApplications
Cell Phones

Operating Systems
Internet
Hardware Firewalls

Hardware

Handhelds / PDAs
Displays / Monitors
Components
Networking Hardware

Peripherals
Laptops/Notebooks
Storage
Servers

Desktops
New Users
Misc
Apple

Software

System Utilities
Industry Specific
Network Management
Photos / Graphics
Page Layout
VMWare
Misc
Web Development

OS
CYGWIN
Voice Recognition
Message Queue
Quality Assurance
Security
Firewalls
MultiMedia Applications

Development
Database
Office / Productivity
Business Management
OS/2 Apps
Server Software
Internet / Email

ITPro

OS
Storage
Encryption
Operating Systems Security
Apple Hardware
Laptops & Notebooks
Servers
Networking Hardware
Peripherals

Devices
Displays / Monitors
WebTrends / Stats
Search Engines
Firewalls
WebApplications
IDS
Vulnerabilities
Email Clients

File Sharing
Spy / Ad Blockers
Web Browsers
Web Servers
Networking
Anti-Virus
Chat / IM
Anti Spam

Developer

Web Servers
Web Browsers
Game Programming
Dev Tools
Industry Specific
Office / Productivity

Database
CYGWIN
Web Development
Search Engines
File Sharing
WebTrends / Stats

Programming
Content Management
Application Servers
Protocols

Storage

Removable Backup Media
Storage Technology
Servers

Grid
Remote Access
Backup / Restore

Misc
Hard Drives

Miscellaneous
Security
Development
Linux
VMWare

MainFrame OS
Unix
Apple
OS / 2
AS / 400

BeOS
Microsoft
VMS / OpenVMS

Database

Oracle
Miscellaneous
MySQL
Software
Sybase
Contact Management
PostgreSQL
Data Manipulation
Clarion
InterSystems Cache

Siebel
MUMPS
OLAP
SQLBase
SAS
GIS & GPS
4GL
Berkeley DB
DB2
Informix

Interbase / Firebird
FoxPro
Reporting
LDAP
Filemaker Pro
MS SQL Server
dBase
MS Access

Security

Misc
Web Browsers
Software Firewalls
Operating Systems Security
File Sharing

Spy / Ad Blockers
Vulnerabilities
WebApplications
IDS
Anti-Virus

Encryption
Anti Spam
Email Clients
VPN
Chat / IM

Programming

Editors IDEs
Installation
Handhelds / PDAs
Multimedia Programming
System / Kernel

Algorithms
Game
Signal Processing
Project Management
Open Source

Database
Misc
Languages
Processor Platforms
Theory

Web Development

Scripting
Blogs
Web Servers
Software
Search Engines
Web Graphics
Images

Internet Marketing
Images and Photos
Components
Document Imaging
Web Languages/Standards
Illustration
WebApplications

Fonts
WebTrends / Stats
Authoring
Digital Camera Software
Miscellaneous

Networking

Protocols
Apple Networking
Network Management
Message Queue
Application Servers
Content Management
File Servers
Email Servers
Misc
Java Editors & IDEs

Wireless
Networking Hardware
Backup / Restore
System Utilities
ISPs & Hosting
Web Servers
Storage Technology
Removable Backup Media
Servers
Broadband

Grid
OS / 2
Novell Netware
Unix Networking
Windows Networking
Security
Telecommunications
Operating Systems
Linux Networking

Other

Community Advisor
Lounge
Community Support
New Net Users

Philosophy / Religion
Math / Science
Miscellaneous
URLs

Expert Lounge
Politics
Puzzles / Riddles

Community Support

Suggestions
New to EE
New Topics
Community Advisor

CleanUp
Announcements
General

Feedback
Input
EE Bugs

02.09.2007 at 07:25AM PST, ID: 18501838

Rank: Sage

olafdc:

Did you use the connect computer wizard to join workstations to the domain? http://msmvps.com/blogs/markd/archive/2004/11/06/18095.aspx
Any other DHCP's on the network?
Are you using Roaming profiles?
Did you use the add user and add computer wizards in the Server Management console as opposed to straight in AD?
Olaf

02.09.2007 at 07:49AM PST, ID: 18502088

Barnabus2006:

Olaf:

Yes, used "the wizards (especially CEICW and connectcomputer)". BTW, your Mark Dormer link went to a MCE2005 discussion.
No, other DHCP is running (behind this switch an on this subnet).
No, not using roaming profiles (unless the wizards set them up without my knowledge).
No, didn't force anything straight into AD (only used wizards).

02.09.2007 at 08:28AM PST, ID: 18502436

Rank: Master

sguinn100:

Please post an IPCONFIG of a client.

02.09.2007 at 12:34PM PST, ID: 18504334

zane_o:

Is the SBS domain business.local?

02.09.2007 at 01:27PM PST, ID: 18504685

techflavor:

Barnabus, please review the event logs (Application/System) on a client computer.

Please paste any errors associated with the following: USERENV, LSASRV, or anything else relating to the Domain Controller not being found, DNS issues, etc.

Once you provide me with this information, I can be of more assistance.

02.09.2007 at 01:29PM PST, ID: 18504706

techflavor:

You might want to also run DCDIAG and NETDIAG (can be installed from the Support\Tools on the SBS 2003 CD) on the domain controller and paste results to www.pastebin.com and then provide us with a link to the pastebin.

02.09.2007 at 02:55PM PST, ID: 18505197

Rank: Sage

olafdc:

Hi Barnabus,
The IPconfig looks OK.
If you are using R2 means you are using wsus. How long have these workstations been going. Are they sttill updating? Are they XPSP2? (If Vista there is a different approach)
Few suggestions: Are they time sync, Is there maybe issues with network hardware, are network cards up to date
Did you install ISA.
Any GP errors?
Can you post a systeminfo of server? And the "obligatory dump" of the server?
Sorry about all the questions and the no answers ...yet.
"No, other DHCP is running (behind this switch an on this subnet)" So there is another DHCP somewhere? The Router?
"No, not using roaming profiles (unless the wizards set them up without my knowledge)" No doesn't happen automatically.
Olaf
PS What did you mean by:"BTW, your Mark Dormer link went to a MCE2005 discussion". On that note: Only works when applied to MCE2004 and than upgrade to 2005.
PS: Squinn and Zane: The answers of your questions a IN the question?

02.09.2007 at 03:15PM PST, ID: 18505278

zane_o:

There is always the possiblity of a physical layer problem as well. I didn't see a mention of network performance after the user is logged in. If it too is slow, check speed/duplex settings and cable.

02.09.2007 at 11:57PM PST, ID: 18506422

Rank: Genius

TechSoEasy:

squinn100, that is the IPCONFIG from the client.

Barnabus2006, thanks for the complete question! :-)

If you just set this up, and you ran the Configure My Documents Redirection Wizard, then the first time a user logs in it will take quite some time. But this should only be on the first login. If it's happening on subsequent times, then you may have a problem. Please advise if this has been occuring after the first logon.

Jeff
TechSoEasy

02.12.2007 at 05:39AM PST, ID: 18514690

Barnabus2006:

Reply to: TechSoEasy (Date: 02/09/2007 11:57PM PS)

I did see this after initial log ons. I've only joined 3 workstations so far (all XPSP2). One never got better. The other 2 got better now they take a long time too. Things were better, now it has gotten worse. Just got a (Monday morning) call from a user and it is taking a little longer.

Reply to: ALL OTHERS

I'm still working on gathering baseline information. ...didn't have time to work the issue this weekend. I've got users clamboring for answers so I'll have to get on top of this issue in the next couple of hours.

Thanks and stay tuned.

02.12.2007 at 09:09AM PST, ID: 18516354

Barnabus2006:

Some Event Log entries (similar on both poorly-responding XPSP2 workstations):

Application Log:
Userenv - ID 1054
Windows cannot obtain the domain controller name for your computer network. (A socket operation was attempted to an unreachable host. ). Group Policy processing aborted.

closely followed by:
AutoEnrollmentUserenv - ID 15
Automatic certificate enrollment for local system failed to contact the active directory (0x8007003a). The specified server cannot perform the requested operation.
Enrollment will not be performed.

Followed by some McAfee issues.

About 15 minuts later...

Application Log:
Userenv - ID 1006
Windows cannot bind to Business.local domain. (Timeout). Group Policy processing aborted.

Application Log:
Userenv - ID 1030
Windows cannot query for the list of Group Policy objects. A message that describes the reason for this was previously logged by the policy engine.

About the same time the System log showed it couldn't find the master browser:

System log:
BROWSER - ID: 8021
The browser was unable to retrieve a list of servers from the browser master \\SERVER1 on the network \Device\NetBT_Tcpip_{36052C80-9055-4B57-AA43-8E23C182D250}. The data is the error code.

Reply to TechSoEasy:
I haven't used the Configure My Documents Redirection Wizard.

For what it's worth:
There are 6 other machines on the old workgroup that get DHCP from this server and do just fine. So, it rather looks like something more than DNS and certainly not a basic connectivity issue.

02.12.2007 at 01:51PM PST, ID: 18518876

Rank: Sage

olafdc:

Can you remove McAfee from one off the workstsions (Uninstall it). Than check login again.
Olaf

Assisted Solution

02.12.2007 at 04:58PM PST, ID: 18519798

Rank: Genius

TechSoEasy:

I'm confused... what do you mean by: "There are 6 other machines on the old workgroup that get DHCP from this server and do just fine"??

Do you mean that those machines have not yet been joined to the domain? Or do you mean that some machines are not getting their DHCP settings from the SBS?

It would be really helpful if you'd post a complete IPCONFIG /ALL from the server as well though.

Jeff
TechSoEasy

02.12.2007 at 06:58PM PST, ID: 18520251

Barnabus2006:

Reply to: TechSoEasy

Yes, those machines have not yet been joined to the domain.
I'm migrating a workgroup of 9 XP machines to a new SBS domain. Sorry for the confusion. I've migraged 3 of the machines so far.

What I'm trying to say is, the 3 XP machines in the domain (as well as everything the workgroup) ARE getting DHCP (and their DHCP options) from SBS.

SERVER IPCONFIG /ALL follows:

Windows IP Configuration

Host Name . . . . . . . . . . . . : server1
Primary Dns Suffix . . . . . . . : Business.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : Business.local

Ethernet adapter Network Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Linksys LNE100TX Fast Ethernet Adapter(LNE100TX v4)
Physical Address. . . . . . . . . : 00-04-5A-70-8A-E1
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.222.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.222.1
DNS Servers . . . . . . . . . . . : 192.168.16.2
Primary WINS Server . . . . . . . : 192.168.16.2
NetBIOS over Tcpip. . . . . . . . : Disabled

Ethernet adapter Server Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 PM Network Connection
Physical Address. . . . . . . . . : 00-15-17-01-60-10
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.16.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 192.168.16.2
Primary WINS Server . . . . . . . : 192.168.16.2

Reply to Olafdc (Date: 02/12/2007 01:51PM PST)

I'll try the McAfee AV removal and take a look.

02.12.2007 at 07:07PM PST, ID: 18520280

Rank: Genius

TechSoEasy:

Okay... it only should take about 10 minutes per machine to migrate. I generally recommend that you do all of them at once because otherwise your users cannot access domain resources properly.

I am tending to lean towards Olaf's idea that the AV is causing the problem. What version of McAfee are you using?

Also... you do need to remove the WINS server IP from your WAN NIC. That definitely causes problems... it should not have anything in that field. After removing it, rerun the CEICW and maks sure that your ISP's DNS IP Addresses are configured on the forwarders screen.

Jeff
TechSoEasy

Accepted Solution

02.12.2007 at 07:09PM PST, ID: 18520291

Rank: Genius

TechSoEasy:

There is one other possibility and that's a faulty switch. What make/model is your switch that connects the LAN computers to your LAN-side NIC?

Jeff
TechSoEasy

02.13.2007 at 07:40AM PST, ID: 18523257

Barnabus2006:

Authentication is now working quickly, but I'm not sure why.
Here is what I did:

Removed WINS server IP reference for WAN NIC.
Removed WINS references from CheckPoint firewall (was set to automatically find WINS from ISP).
Had the ISP reset the cable modem.
Removed McAfee (latest version) on one XP workstation (a new Dell Core 2 Duo laptop).

These steps were taken and (for now) authentication works quickly (as expected).

HOWEVER, ------------------------------
One of the users experiencing this problem (a credible observer) reported that yesterday afternoon (about 15 hours before any of these steps were taken) authentication went fine. This user has an up-to-date McAfee version from 2006 (Security Center version 7.1)

<sigh>

I did not rerun CEICW to put in DNS primary/seconday.
SBS is set up with 2 NICs. The LAN goes to a Linksys EF3124 switch (now branded as Cisco Systems). The WAN goes to a CheckPoint Safe@Home 500 and which attaches to the Scientifc Atlanta DPC2100 WebStar cable modem. The cable modem has a static IP which maps to the MAC address of the CheckPoint firewall/router. The DNS server addresses are hard coded into the CheckPoint firewall/router.

I'm going to leave this question open for a couple more days to wait and see.

Jeff (TechSoEasy):
I've got other issues with Exchange Server and will probably rerun CEICW and put in the DNS servers at that time. BTW, I've read differing points of view on giving SBS DNS server the primary/seconday DNS servers.

I'll give everyone an update in a couple of days.

02.15.2007 at 10:00AM PST, ID: 18542367

Barnabus2006:

A couple of days have transpired and slow authentication has not re-occured.

I have re-run CEICW to make sure the primary and secondary DNS servers were referencing the ISP's DNS servers. They were.

My impress is that the problem was a name resolution issue I'm inclined to think a recent switch to a static IP without having the cable modem reset by the ISP cause this issue. Of course I'm still leaving room for operator error (me) and some install/configuration issue. The issue doesn't appear to be related to antivirus, although I will at least acknowledge that it could be a possibility.

I'm at a loss to explain why one user appeared to have the issue dissapear before I put any fixes in place. So, I'm going to relagate that factor to an irreproducable result and disregard it.

Thanks everyone, especially TechSoEasy and olafdc

02.21.2007 at 04:26PM PST, ID: 18583487

Rank: Genius

TechSoEasy:

I'd chalk it up to you being too cautious in deploying the network. Caution should be taken in the planning stages for sure, but honestly, the amount of time you waited to bring everyone online was way too much.

Jeff
TechSoEasy

otwelmr

11.15.2007 at 05:21AM PST, ID: 20288651

If anyone is running the Mcafee security that comes preinstalled by Dell uninstall it. This has caused this very problem on 4 computers that I recently received.

peter-h

11.22.2007 at 04:02PM PST, ID: 20336732

Though unrelated to this specific issue, I have just solved a random bluescreening problem on a Dell computer by uninstalling the pre-installed Mcafee AV. So yes, get rid of it!

20080236-EE-VQP-29