Solved

Windows Domain AD problems

Posted on 2007-04-04
3
220 Views
Last Modified: 2010-04-18
I have a domain with only 1 site and two subnets. One subnet is for an office in the USA and the other subnet is for an office in the UK. Both Domain controllers are located in the US office. The two offices are connected by a PPTP VPN with a netscreen frewall at each end, the tunnels allow "any" service in both directions. You can ping all computers in either network from both locations and name resolution (DNS) is working at both locations as well. The problem is that I can not add a computer to our domain from the UK office, I get unable to find a domain controller or if I remove a computer from the domain in the UK office and then try to add it back in, I get "The trust relationship between this workstation and the primary domain failed", so basically the machines over in the UK seem to be unable to communicate with the domain controller in this regard. However the other machines that are already part of the domain are still authenticating every morning when clients login for the day...

Additionally the UK office only has 5 computers total and they won't allow me to put a domain controller over there. The domaiin itself is in 2000 mixed mode and, all workstations are XP, I checked under "AD sites and services" and as I stated at the beginning we have one site (default-site) and both subnets are listed under the subnet folder. I've run DCDiag on our domain controllers and and everything checks out good...

Any thoughts on how I can get the ability to add machines in the UK office to the domain or even some diagnotstic tools I can use the isolate the problem further?

0
Comment
Question by:dsc18
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 1

Accepted Solution

by:
cdnq8 earned 250 total points
ID: 18850415
Hi,
In your tcp ip settings put the Primary dns server address of your Domain, and than try hope fully it will authenticate with it, it seems to be a DNS ip address problem.

Taher
0
 
LVL 51

Assisted Solution

by:Netman66
Netman66 earned 250 total points
ID: 18850722
It's definitely DNS.

Make sure you are handing out the DNS address of your own server - not the Netscreen.
0
 
LVL 1

Author Comment

by:dsc18
ID: 18851738
That was the first thing I checked and yes all UK machines have the right primary and secondary DNS server listed when you do a ipconfig /all. However manually entering the DNS servers in the properties of TCP\IP seemd to do the trick for the workstation I was troubleshooting in the UK.

Additionally after manually entering the DNS entries I needed to delete the workstation computer account from the DC, then moved the workstation to a workgroup and rebooted, then reanmed it and rebooted again. When it came backup I was able to add the workstation from the UK office to our domain here in the US. So maybe there was a problem with the sid too. Thanks for the help!
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A project that enables an administrator to perform actions within a user session context not just at the time of login but any time later on day(s) or week(s) later.
Active Directory security has been a hot topic of late, and for good reason. With 90% of the world’s organization using this system to manage access to all parts of their IT infrastructure, knowing how to protect against threats and keep vulnerabil…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question