Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 535
  • Last Modified:

Bring a computer to a domain preserving documents and settings or Reestablish the trust relationship.

Situation:
----------

1) Customer with a w2k server domain (with exchange) with about 10 client PCs (W98, W2K Pro, WXP).

2) Customer decided to reinstall the w2k server from scratch. He decided to manually create users and computers directly in the server, mantaining previous names hopping that all be quite transparent.

3) Here is when I come to this customer.

4) When turning on the PCs I noticed that they could log on the user (i.e. the server actually granted access to the server to this user) although the PC is not recognized (computer asset in AD ?)

5) I tried to "demote" this client PC to a workgroup and afterwards joined the domain. It worked but I noticed that it created a new profile, thus losing documents and settings etc.. In fact I even noticed that the name of the new domain is not quite the same as it were.

6) If I do not do step 5) almost everything works although the client workstations don't see each other. By the way the event viewer found a netlogon error 5513 that says:

The computer PCNAME tried to connect to the server \\SERVERNAME using the trust relationship established by the SERVER_SRV domain. However, the computer lost the correct security identifier (SID) when the domain was reconfigured. Reestablish the trust relationship.

7) How to Reestablish the trust relationship.

Thanks in advance
0
pfsilva
Asked:
pfsilva
  • 3
  • 2
1 Solution
 
oBdACommented:
The reinstallation created a completely new domain with completely new users; it doesn't matter if the names are still the same.
Your users are currently logging in with locally cached credentials.
You will have to rejoin all W2k/XP machines to the domain (your step 5); that will take care of the "lost trust relationship" On your Win98 clients, you only have to adjust the NetBIOS domain name to validate against  (if that name was changed).
For the old profiles to work, it is not enough to simply copy the old profile over the new ones; the new user will not have access to the old registry. Do the following:
Logon as the new domain user whose profile you want to restore; that will create the new profile folder.
Log off, log back on as administrator.
Open Explorer, go to the user's new profile; back up any new files that might have been created, then delete everything in the user's new profile folder, but leave the folder.
If necessary, take ownership of the user's old profile folder.

HOW TO: Take Ownership of a File or Folder in Windows XP
http://support.microsoft.com/?kbid=308421

Copy everything from the old profile folder into the new profile folder using Explorer. Then use "Method III" (editing the registry) in the article below to give the new domain user full access to the registry (ntuser.dat). You can remove the old user's SID entry there as well.

How to Update Permissions for User Profiles
http://support.microsoft.com/?kbid=156697
0
 
VinnnnieCommented:
Create a Trust for each PC by doing the following. This works for me everytime!

Go to Active Directory Sites and Users
Go to Computers and Delete all the ones in question. Don't delete the ones that are currently in use.
Logon to one of the PCs as Admin for the local PC
Right-click my computer and then click Properties
Go to Network Identification and click Properties where it says "To rename this computer or join a domain, click properties."
When you do that, Type the name of the PC (Make sure they are unique) and type the name of the domain.
When you click okay, it should ask for a domain name and password. Use the one for the person using the PC.
When you click okay, it should say, "Welcome to XXX Domain"

That is the way to re-eastablish the trust between the domain and client PCs.
0
 
VinnnnieCommented:
Oh, Make sure all the Client PCs are in the same workgroup
0
Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

 
pfsilvaAuthor Commented:
Vinnnnie,
Do you mean that when I join the local PC to a domain and if I use name/password for the person using the PC instead of Domain Admin Name/password I should recover all "Documents and Settings"? Including OUTLOOK.OST / .PST files? Should this user be given special rights (domain admin, ...) or domain user is sufficient ?

Thanks in advance,

Pedro
0
 
VinnnnieCommented:
Yes, login as the local user and then see if all their settings are there. If they are make sure the user has Admin Rights (I would do it temporarily) and then take it off when you re-join the domain. Domain User will not be suffecient unless you add Admin to Domain Users (somehow) but I would just add them to Domain Admins for now. I just did this yesterday and it worked for me.
0
 
pfsilvaAuthor Commented:
Sorry for the delay in closing this item.
Thanks Vinnnnie
0

Featured Post

Vote for the Most Valuable Expert

It’s time to recognize experts that go above and beyond with helpful solutions and engagement on site. Choose from the top experts in the Hall of Fame or on the right rail of your favorite topic page. Look for the blue “Nominate” button on their profile to vote.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now