?
Solved

IFMEMBER for WinXP Workstations in Windows 2003 Server domain works intermittently

Posted on 2005-04-12
22
Medium Priority
?
2,386 Views
Last Modified: 2012-06-27
In our Server 2003 domain, my login script that uses the IFMEMBER command to look at group membership to map drives does not always work.  
We have 3 servers acting as DC's


During login, the XP client will see the login script.  One of the first lines is the script is to show the list of groups that user is a part of
---
set DomainController=THETA
net use M: \\%DomainController%\NETLOGON /persistent:no
echo Setting Drive Mappings ...
m:\IfMember /List
---
This ALWAYS show the local groups, but intermittently does not read which domain group the user is a member of.  When this happens, the rest of the session doesn't get set properly.

Sometimes, the user just logs off and back on and it works.  Sometimes, they have to logoff and back on more than once until the domain is recognized.  I've found that if they restart their computer it will find the domain the next time it boots up.

When I map the drives using the net use command, I have /persistent:no at the end each time.

My Win2k workstations do not have this problem.

-------
Key Steps I've taken
1) net config server /autodisconnect:-1 command run on my DC's
2) Name space registry entry deleted on the workstations
3) Enabled the Group Policy entry to 'Always wait for the network at computer startup and logon'

I know I can see the Domain Controller because the script is running, but it doesn't seem to be communicating properly with the AD to determine group membership.
0
Comment
Question by:JohnG316
  • 9
  • 9
  • 2
  • +1
21 Comments
 
LVL 1

Expert Comment

by:deriickmu
ID: 13764430
You are running this from a mapped drive?  Have you tried:

%logonserver%\netlogon\ifmember



0
 

Author Comment

by:JohnG316
ID: 13764667
I haven't done it that way.  Why would it make a difference?
0
 
LVL 1

Expert Comment

by:deriickmu
ID: 13764757
It would force IFMEMBER to run from a server that the client has used to authenticate.  Every documentation I have seen on IFMEMBER (granted, I have not used it very much) has stated to run from the this path.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 

Author Comment

by:JohnG316
ID: 13764975
To add one piece of information, I also tried to use VBScript and it also intermittently was not recognizing the groups either.  Below is the beginning part of the script I had developed.  Thus, I don't think the issue is related to using a hard location.  Plus, the command is running, it's just not always connecting the userID to the ActiveDirectory group the person is a part of.


' LoginScript.vbs
' VBScript to map network environment
' Version 1.3 - March 2005
' -----------------------------------------------------------------'
Option Explicit
Dim strDriveLetter, strRemotePath
Dim strLogonServer, strDataServer, strPrintServer1, strPrintServer2
Dim MWIDomain, AcctServer, DomainController
Dim objNetwork, objUser, CurrentUser, strGroup, tstGroup
Set objNetwork = WScript.CreateObject("WScript.Network")


'Identify Current user
      Dim objNet, strUserName
      set objNet = CreateObject("Wscript.Network")
      strUserName = objNet.UserName

'Identify Current User Groups
      set objUser = CreateObject("ADSystemInfo")
      set CurrentUser = GetObject("LDAP://" & objUser.UserName)
      strGroup = LCase(Join(CurrentUser.MemberOf))                  'List of all groups this user is a member of
      WScript.Echo strUserName & vbCRLF & strGroup

tstGroup = "domain admins"                                                'Group to Test
      WScript.Echo "Testing Group: " & tstGroup
0
 
LVL 5

Expert Comment

by:Big5250
ID: 13765542
How many DC's do you have in the domain?
0
 

Author Comment

by:JohnG316
ID: 13765700
3
0
 
LVL 5

Expert Comment

by:Big5250
ID: 13765798
Have you verified that all your scripts have been copied to all the DC's.  Sometimes the DC's can get out of synch, and cause symptoms that you are describing.
0
 
LVL 5

Expert Comment

by:Big5250
ID: 13765805
Also, I apologize with not seeing the number of DC's in your original question.
0
 
LVL 5

Expert Comment

by:Big5250
ID: 13765813
Also, what is the date of your ifmember.exe
0
 

Author Comment

by:JohnG316
ID: 13766135
ifmember.exe - 4/18/2003

I will make sure the scripts are synch'd up

however, as i mentioned to deriickmu, I get the same problem using VBScript as well.
0
 
LVL 5

Expert Comment

by:Big5250
ID: 13766143
That's why it kind of tipped me off about the synch
0
 

Author Comment

by:JohnG316
ID: 13766181
The VBScript I was running on my desktop and not during the login process.  I wrote the script and was testing it throughout the day.  At first it worked just fine, then it stopped working for a while, then started working again.
0
 
LVL 5

Expert Comment

by:Big5250
ID: 13766212
There's an updated ifmember.exe on the SP4 CD.  There were some GetTokenInformation calls that were failing on ifmember.  Have you tried different versions?
If you have the Service Pack 3 or Service Pack 4 CD, you can use the Expand.exe tool to expand Ifmember.ex_ and then use the Ifmember.exe

hth
0
 

Author Comment

by:JohnG316
ID: 13766352
I don't have the Server 2003 SP4 CD and a search of MS Knowledge Base turns up the version I have.  Do you have a newer version you can send me?  But again, I get back to the similar problems I had running the VBScript and it seems to me the problem is somehow related to AD or AD Synchronization and not the ifmember tool.  
0
 
LVL 5

Expert Comment

by:Big5250
ID: 13766393
I have one date 6/19/2003

I do however see your point about the AD potentially being the blame.  Can you log the output of the login to a file and see if there are any errors occurring during the session?
0
 

Author Comment

by:JohnG316
ID: 13766640
Can you send that file to me?

I'm not seeing any errors and none show up in the server error logs either.  That's why I've been searching for something related to AD timeouts or some type of workstation setting.
0
 
LVL 5

Expert Comment

by:Big5250
ID: 13766656
Can you build the logic into your scripts for logging?

Where do you want the file sent?
0
 

Author Comment

by:JohnG316
ID: 13767054
here's a temporary email address XFerMailbox@yahoo.com
0
 
LVL 5

Accepted Solution

by:
Big5250 earned 1500 total points
ID: 13767095
File has been sent
0
 

Expert Comment

by:LAGONZALES
ID: 13769876
PDF
0
 

Author Comment

by:JohnG316
ID: 13771114
LAGonzales - Don't understand your post
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Occasionally Windows/Microsoft Updates will fail to update. We have found a code that will delete all temporary files and re-register all dll's related to Windows/Microsoft Updates! This works 99% of the time to get the updates working again! The…
Windows 10 is here and for most admins this means frustration and challenges getting that first working Windows 10 image. As in my previous sysprep articles, I've put together a simple help guide to get you through this process. The aim is to achiev…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question