Windows Domain AD problems

I have a domain with only 1 site and two subnets. One subnet is for an office in the USA and the other subnet is for an office in the UK. Both Domain controllers are located in the US office. The two offices are connected by a PPTP VPN with a netscreen frewall at each end, the tunnels allow "any" service in both directions. You can ping all computers in either network from both locations and name resolution (DNS) is working at both locations as well. The problem is that I can not add a computer to our domain from the UK office, I get unable to find a domain controller or if I remove a computer from the domain in the UK office and then try to add it back in, I get "The trust relationship between this workstation and the primary domain failed", so basically the machines over in the UK seem to be unable to communicate with the domain controller in this regard. However the other machines that are already part of the domain are still authenticating every morning when clients login for the day...

Additionally the UK office only has 5 computers total and they won't allow me to put a domain controller over there. The domaiin itself is in 2000 mixed mode and, all workstations are XP, I checked under "AD sites and services" and as I stated at the beginning we have one site (default-site) and both subnets are listed under the subnet folder. I've run DCDiag on our domain controllers and and everything checks out good...

Any thoughts on how I can get the ability to add machines in the UK office to the domain or even some diagnotstic tools I can use the isolate the problem further?

Who is Participating?
cdnq8Connect With a Mentor Commented:
In your tcp ip settings put the Primary dns server address of your Domain, and than try hope fully it will authenticate with it, it seems to be a DNS ip address problem.

Netman66Connect With a Mentor Commented:
It's definitely DNS.

Make sure you are handing out the DNS address of your own server - not the Netscreen.
dsc18Author Commented:
That was the first thing I checked and yes all UK machines have the right primary and secondary DNS server listed when you do a ipconfig /all. However manually entering the DNS servers in the properties of TCP\IP seemd to do the trick for the workstation I was troubleshooting in the UK.

Additionally after manually entering the DNS entries I needed to delete the workstation computer account from the DC, then moved the workstation to a workgroup and rebooted, then reanmed it and rebooted again. When it came backup I was able to add the workstation from the UK office to our domain here in the US. So maybe there was a problem with the sid too. Thanks for the help!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.