?
Solved

User cannot login to new Win2KPro box

Posted on 2003-03-14
20
Medium Priority
?
571 Views
Last Modified: 2011-10-03
Brand new Win2KPro box.
Local Administrator can login, do all functions...
Domain Administrator can login, do all functions...
Regular Domain Users can login on this machine and a local profile is created.

However, there is ONE domain user who cannot login to this machine.
As luck would have it, it is the person who is supposed to be getting this new PC.
It doesn't matter if they are logged on or off their current workstation.

I've looked, and nothing is different with her account.
She can logon to the domain from other machines OK.
Even more strange is that after the 3 tries (and failures), the account is locked out, but the failures are not audited in the log as they should be.  I even get the "locked out" message when this happens.

Other than the account being corrupt in some bizarre way, what could be causing this to happen with only ONE user out of many?  I'm very curious since I've not seen this happen before.  I wonder if anyone else has seen this happen.  Thanks in advance for any information.

Obviously, I'm just going to delete and recreate the user account to "fix" this.  If THAT doesn't work, then I'll be really confused :)


0
Comment
Question by:McBud
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
  • 4
  • +3
20 Comments
 
LVL 10

Expert Comment

by:pcbrat
ID: 8138853
go for it!! Delete the user account and create a new one. Your right if that dont fix it I will be boggled too!!

Dawne aka Pcbrat
0
 
LVL 8

Accepted Solution

by:
heskyttberg earned 200 total points
ID: 8139179
Hi!

Before deleteing recreating the account I would try the following.

Make her logout from her workstation, login as admin.
Backup her profile on her current workstation.
Delete the profile from her current workstation, new workstation if she got one first login and form the server.

Now let her login, if it dosen't work now there is most likely something wrong with her account.

I have never seen that happen though, but corrupted profiles happens frequently.

Regards
/Hans - Erik Skyttberg
0
 

Expert Comment

by:jwirth
ID: 8140148
what error do you get when she tries to log in
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 

Expert Comment

by:jwirth
ID: 8140153
are the other systems she login from win2k
0
 

Expert Comment

by:JDMeister
ID: 8141234
On any NTFS system and a domain, if the password is different on the domain controllor than the one on the workstation, havoc ensues.

Log on as admin on the server, change password.
Log on as admin on the workstation, change password to the same as on server.

It's possible to log on to the workstatiuon and not log on to the domain.

Please don't confuse the two types of log on.

Jerry
0
 
LVL 12

Expert Comment

by:trywaredk
ID: 8142083
MCBUD... I don't think it's this one, but You can give it a try: http://support.microsoft.com/default.aspx?scid=kb;EN-US;278299



HESKYTTBERG... remember to tell, that copying a profile must NEVER be done with explorer, ALWAYS use MyComputer/Properties/UserProfiles



JDMEISTER... Not a good idea. Having just one of Your users being able to logon as local administrator, he's getting unlimited power of Your entire domain

Did You ever had a workstation, where a thirdparty technician (that You ordered) has to troubleshoot their own program on the workstation? Yes - You could temporary create a local user being member of the local admin group, but did You?

Did You or one of the other Global domain admins ever solve a problem telling the local administrators password?

Do You assure, when doing a unattended automatic install of W2k, that the answer-file ...
[GuiUnattended]
AdminPassword = xxxxx
... was deleted from the workstation, after install, and that Your server-copy of this is secured from Domain Users?

My advice is NEVER NEVER using the same password for local admin and domain admin, and by the way, NEVER having the same local admin password on each workstation on Your network.
0
 
LVL 8

Expert Comment

by:heskyttberg
ID: 8142307
Hi!

3rd party cosultants always only get access to local admin group or sometimes only enough rights so they can do what they need to do.

They never get Domain Admin rights.

We have never solved a problem by telling local admin account, but we have solved problems using the local admin account ourselves and that would be a pain if all local admin accounts would have diffrent pass on every box.

Of course the answer file is delted.

I agree that domain admin pass should never be the same as local admin pass.

Regards
/Hans - Erik Skyttberg
0
 
LVL 12

Expert Comment

by:trywaredk
ID: 8142330
:o) HESKYTTBERG... My comment about local admin password was for JDMEISTER.

My comment to You was about copying user profiles.

:o) Glad to know, that You don't take any risks about security.

Many Regards
Jorgen Malmgren
IT-Supervisor
Denmark
0
 

Expert Comment

by:JDMeister
ID: 8143827
I was implying the admin do the work. I would never log on a user as admin.

I've seen users change p/w while not connected, and hilarity ensues.
0
 

Author Comment

by:McBud
ID: 8151932
All very good points made :)
Unfortunately, I had left out one important piece of information...  The user currently works from a Win98 workstation, not a Win2K.

JWIRTH: Thanks for pointing out that oversight on my part.  D'oh! :)  So, do you have the super-solution? ;)  The login message is the standard "unable to login to domain, check password, caps lock, etc..."

HESKYTTBERG: Obviously the profile idea doesn't apply here.  Would be nice, though :)

JDMEISTER:  Again, not applicable, but you make a good point for newbie admins.  I can't tell you how many times I've had people using NT3.5->2K make that mistake.  That's a real hard one to explain to the end-user as well :)

TRYWAREDK: That MS KB is not applicable here, unfortunately.  I trolled there for a while before bringing my quandry here. ;)

EVERYONE:  Thanks for the responses.  I've been meaning to try out EE for a while now, and when I ran into this, I figured it would be a great question with which to test the waters.  (It _is_ an actual problem I am having, though).

-Derek
0
 

Expert Comment

by:jwirth
ID: 8152531
Well on the workstation make sure that her domain user has rights locally (just for testing I would go with Local Admin the turn down)
0
 
LVL 12

Expert Comment

by:trywaredk
ID: 8154649
Working with W2k for some years now means that I cant remember everything about W98, but as far as I can remember, forget all about w2k-local admin group problem here, because w98 does not run NTFS.

But try this one about Windows 98:

http://support.microsoft.com/?kbid=271496

0
 

Expert Comment

by:jwirth
ID: 8154705
trywaredk
Maybe I miss understood the question but I thought the user was able to login to win98 system but not the new win2k system. If so you the kb artical you linked does not apply or does it?
 
0
 
LVL 12

Expert Comment

by:trywaredk
ID: 8154779
JWIRTH... I don't know

MCBUD... whats Your answer?

"Brand new Win2KPro box."

"Unfortunately, I had left out one important piece of information...  The user currently works from a Win98 workstation, not a Win2K."
0
 

Author Comment

by:McBud
ID: 8159009
Well, she was using an old Win98 workstation that was working fine as far as domain login and access went.

It was the new Win2K box that would not let her log on.

After having the same result on another user's Win2k machine, I just deleted and recreated the account.

That fixed the problem, like I was 99.9% sure it would :)  Obviously there was something in her profile that Win2k did not like, for lack of a better term...

I was just wondering if it was something anyone had seen before.  I hadn't run into that problem on any of the other users who have received new PCs with Win2K on them.  

*sigh*  I only wish that the whole company would upgrade at the same time to the same standard hardware and software... Ah well, that proposal was already rejected :(

Everybody had good responses, but none of them answered my question.  So, who gets the points? :)

0
 

Expert Comment

by:JDMeister
ID: 8159365
Perhaps the security profile for a Win 98 box clashed with what was needed for the Win2k box.

I know on a NT 4.0 system, a machine account is required for NT Workstation, but not Win 9x

Just guessin'

Jerry
0
 

Author Comment

by:McBud
ID: 8160233
I suppose I'll never know what was "corrupt" about that user's profile.  At least now if I run into it again we all know to just delete it, recreate it and go.

The strange thing is that I was able to login both current Win9x and Win2K domain users to the new box, but not just the one account.  Heh... I should have expected as much since the really weird things always seem to happen to me. :)

Anybody noticed that some of the advertisers on here are, how can I put this, less than generally-accepted mainstream corporate America?  Check this line from one of their ads from a freeware(spyware) company, "Spice up your computer with SexyBuddy. SexyBuddy will definitely make your hard-drive, harder! Your computer never did sexy things like this before! Check out the free demo now!"

Ah well... Anything for the almighty dollar I suppose. ;)

I have to say that I am pleased with the response to my post here, so I may stick around and start answering questions for other people.  Decent collaboration tool.

-Derek
0
 
LVL 8

Expert Comment

by:heskyttberg
ID: 8178052
Hi!

I don't quite understand the problem, but you didn't by any chance call the new w2k box the same as the old win98 one ?

If so that might also cause some problems.
Well I also said you need to delete her profile, even a win98 machine should have some sort of profile, I never used win98 in a domain so I have no idea how they behave.

Regards
/Hans - Erik Skyttberg
0
 

Author Comment

by:McBud
ID: 8181789
Hi Hans :)

Heh... no, nothing as simple as a name conflict...

I'll tell you how Win98 behaves in a domain... Sometimes quite badly. :)  Be lucky you don't deal with it much, as it is not as nice as having solid workstation desktops.

It's somewhat like Windows 3.1 was in an NT 3.5 environment, only completely different problems, but the same overall lack of security and decent manageability.  LOL! :)

-Derek
0
 

Author Comment

by:McBud
ID: 8196101
Although I had fixed the problem by creating a new domain account for the user, I was still wondering what could have caused this problem.

In the interest of closing this question, I felt that heskyttberg provided the information that most closely resembled my own troubleshooting and conclusion.  

Also, I was at fault for not specifying originally that the user's OS was Win98.

I'd split the points among all respondents if I could ;)

-Derek
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
New style of hardware planning for Microsoft Exchange server.
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …
Suggested Courses
Course of the Month9 days, 11 hours left to enroll

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question