IFMEMBER for WinXP Workstations in Windows 2003 Server domain works intermittently

In our Server 2003 domain, my login script that uses the IFMEMBER command to look at group membership to map drives does not always work.  
We have 3 servers acting as DC's


During login, the XP client will see the login script.  One of the first lines is the script is to show the list of groups that user is a part of
---
set DomainController=THETA
net use M: \\%DomainController%\NETLOGON /persistent:no
echo Setting Drive Mappings ...
m:\IfMember /List
---
This ALWAYS show the local groups, but intermittently does not read which domain group the user is a member of.  When this happens, the rest of the session doesn't get set properly.

Sometimes, the user just logs off and back on and it works.  Sometimes, they have to logoff and back on more than once until the domain is recognized.  I've found that if they restart their computer it will find the domain the next time it boots up.

When I map the drives using the net use command, I have /persistent:no at the end each time.

My Win2k workstations do not have this problem.

-------
Key Steps I've taken
1) net config server /autodisconnect:-1 command run on my DC's
2) Name space registry entry deleted on the workstations
3) Enabled the Group Policy entry to 'Always wait for the network at computer startup and logon'

I know I can see the Domain Controller because the script is running, but it doesn't seem to be communicating properly with the AD to determine group membership.
JohnG316Asked:
Who is Participating?
 
Big5250Connect With a Mentor Commented:
File has been sent
0
 
deriickmuCommented:
You are running this from a mapped drive?  Have you tried:

%logonserver%\netlogon\ifmember



0
 
JohnG316Author Commented:
I haven't done it that way.  Why would it make a difference?
0
Cloud Class® Course: C++ 11 Fundamentals

This course will introduce you to C++ 11 and teach you about syntax fundamentals.

 
deriickmuCommented:
It would force IFMEMBER to run from a server that the client has used to authenticate.  Every documentation I have seen on IFMEMBER (granted, I have not used it very much) has stated to run from the this path.
0
 
JohnG316Author Commented:
To add one piece of information, I also tried to use VBScript and it also intermittently was not recognizing the groups either.  Below is the beginning part of the script I had developed.  Thus, I don't think the issue is related to using a hard location.  Plus, the command is running, it's just not always connecting the userID to the ActiveDirectory group the person is a part of.


' LoginScript.vbs
' VBScript to map network environment
' Version 1.3 - March 2005
' -----------------------------------------------------------------'
Option Explicit
Dim strDriveLetter, strRemotePath
Dim strLogonServer, strDataServer, strPrintServer1, strPrintServer2
Dim MWIDomain, AcctServer, DomainController
Dim objNetwork, objUser, CurrentUser, strGroup, tstGroup
Set objNetwork = WScript.CreateObject("WScript.Network")


'Identify Current user
      Dim objNet, strUserName
      set objNet = CreateObject("Wscript.Network")
      strUserName = objNet.UserName

'Identify Current User Groups
      set objUser = CreateObject("ADSystemInfo")
      set CurrentUser = GetObject("LDAP://" & objUser.UserName)
      strGroup = LCase(Join(CurrentUser.MemberOf))                  'List of all groups this user is a member of
      WScript.Echo strUserName & vbCRLF & strGroup

tstGroup = "domain admins"                                                'Group to Test
      WScript.Echo "Testing Group: " & tstGroup
0
 
Big5250Commented:
How many DC's do you have in the domain?
0
 
JohnG316Author Commented:
3
0
 
Big5250Commented:
Have you verified that all your scripts have been copied to all the DC's.  Sometimes the DC's can get out of synch, and cause symptoms that you are describing.
0
 
Big5250Commented:
Also, I apologize with not seeing the number of DC's in your original question.
0
 
Big5250Commented:
Also, what is the date of your ifmember.exe
0
 
JohnG316Author Commented:
ifmember.exe - 4/18/2003

I will make sure the scripts are synch'd up

however, as i mentioned to deriickmu, I get the same problem using VBScript as well.
0
 
Big5250Commented:
That's why it kind of tipped me off about the synch
0
 
JohnG316Author Commented:
The VBScript I was running on my desktop and not during the login process.  I wrote the script and was testing it throughout the day.  At first it worked just fine, then it stopped working for a while, then started working again.
0
 
Big5250Commented:
There's an updated ifmember.exe on the SP4 CD.  There were some GetTokenInformation calls that were failing on ifmember.  Have you tried different versions?
If you have the Service Pack 3 or Service Pack 4 CD, you can use the Expand.exe tool to expand Ifmember.ex_ and then use the Ifmember.exe

hth
0
 
JohnG316Author Commented:
I don't have the Server 2003 SP4 CD and a search of MS Knowledge Base turns up the version I have.  Do you have a newer version you can send me?  But again, I get back to the similar problems I had running the VBScript and it seems to me the problem is somehow related to AD or AD Synchronization and not the ifmember tool.  
0
 
Big5250Commented:
I have one date 6/19/2003

I do however see your point about the AD potentially being the blame.  Can you log the output of the login to a file and see if there are any errors occurring during the session?
0
 
JohnG316Author Commented:
Can you send that file to me?

I'm not seeing any errors and none show up in the server error logs either.  That's why I've been searching for something related to AD timeouts or some type of workstation setting.
0
 
Big5250Commented:
Can you build the logic into your scripts for logging?

Where do you want the file sent?
0
 
JohnG316Author Commented:
here's a temporary email address XFerMailbox@yahoo.com
0
 
LAGONZALESCommented:
PDF
0
 
JohnG316Author Commented:
LAGonzales - Don't understand your post
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.