gas_bugs
asked on
Re-establish trust relationship between NT 4.0 & Active Directory Server 2003
Pre-existing condition. An NT 4.0 Server was replaced with Small Business Server 2003 and Active Directory. Server 2003 indicates trust relationship is broken. NT 4.0 Server NET LOGON service is set to Automatic but won't start. When attempting to start NET LOGON on NT 4.0 Server, the following error appears:
Could not start the NET LOGON service on\\servername
error 1787: The SAM database on the Windows NT Server does not have a computer account for this workstation trust relationship.
How do I resolve on tthis error on the NT 4.0 Server in an Active Directory Server 2003 environment?
Could not start the NET LOGON service on\\servername
error 1787: The SAM database on the Windows NT Server does not have a computer account for this workstation trust relationship.
How do I resolve on tthis error on the NT 4.0 Server in an Active Directory Server 2003 environment?
ASKER
NT 4.0 Server NET LOGON service is set to Automatic but won't start. When attempting to start NET LOGON on NT 4.0 Server, the following error appears:
Could not start the NET LOGON service on\\servername
error 1787: The SAM database on the Windows NT Server does not have a computer account for this workstation trust relationship.
Maybe this issue is best resolved by first addressing the error 1787. It seems the servers can't talk if NET LOGON is broken.
W2k3 is PDC running AD. NT40 was DC, but AD is running on W2k3 PDC. It is unclear what the role of the NT40 server is assuming at this time.
Could not start the NET LOGON service on\\servername
error 1787: The SAM database on the Windows NT Server does not have a computer account for this workstation trust relationship.
Maybe this issue is best resolved by first addressing the error 1787. It seems the servers can't talk if NET LOGON is broken.
W2k3 is PDC running AD. NT40 was DC, but AD is running on W2k3 PDC. It is unclear what the role of the NT40 server is assuming at this time.
Your domain setup is still not clear. You need to be way more precise in your description if you want someone who is not familiar with your network (and that means just about everybody on this site) to be able to help you.
Did you do an *upgrade* of the NT4 domain to AD, and the NT4 DC is now a BDC of the AD domain, or did you do a *migration* from NT4 to AD, with two independent DCs and a trust established between them?
Did you do an *upgrade* of the NT4 domain to AD, and the NT4 DC is now a BDC of the AD domain, or did you do a *migration* from NT4 to AD, with two independent DCs and a trust established between them?
ASKER
I'm a new hire, so I'm trying to figure out how the NT40 server fits into the network. My understanding is that dcpromo was used to demote the NT40 server from DC role, the w2k3 server became the PDC, & AD was implemented.
Here is 1 Event ID error being generated on the w2k3 PDC:
Source: NETLOGON
Category: None
Type: Error
Event ID: 5723
The session setup from computer 'servername' failed because the security database does not contain a trust account 'sername$' referenced by the specified computer.
USER ACTION
If this is the first occurrence of this event for the specified computer and account, this may be a transient issue that doesn't require any action at this time. Otherwise, the following steps may be taken to resolve this problem:
If 'SERVERNAME$' is a legitimate machine account for the computer 'SERVERNAME', then 'SERVERNAME' should be rejoined to the domain.
If 'SERVERNAME$' is a legitimate interdomain trust account, then the trust should be recreated.
Otherwise, assuming that 'SERVERNAME$' is not a legitimate account, the following action should be taken on 'SERVERNAME':
If 'SERVERNAME' is a Domain Controller, then the trust associated with 'SERVERNAME$' should be deleted.
If 'SERVERNAME' is not a Domain Controller, it should be disjoined from the domain.
- - - - - - - - - - - - - - - -
On the w2k3 PDC, the "Help and Support" Service is not listed in "Services" (separate issue). Attempts to click the Microsoft url fails bec. "Help and Support" Service does not exist on w2k3 PDC.
Plus the NT40 computer or SERVERNAME is not found in the AD structure. The w2k3 PDC server can see the NT40 computer & open, map and access its folders & files. but no one else can.
Here is 1 Event ID error being generated on the w2k3 PDC:
Source: NETLOGON
Category: None
Type: Error
Event ID: 5723
The session setup from computer 'servername' failed because the security database does not contain a trust account 'sername$' referenced by the specified computer.
USER ACTION
If this is the first occurrence of this event for the specified computer and account, this may be a transient issue that doesn't require any action at this time. Otherwise, the following steps may be taken to resolve this problem:
If 'SERVERNAME$' is a legitimate machine account for the computer 'SERVERNAME', then 'SERVERNAME' should be rejoined to the domain.
If 'SERVERNAME$' is a legitimate interdomain trust account, then the trust should be recreated.
Otherwise, assuming that 'SERVERNAME$' is not a legitimate account, the following action should be taken on 'SERVERNAME':
If 'SERVERNAME' is a Domain Controller, then the trust associated with 'SERVERNAME$' should be deleted.
If 'SERVERNAME' is not a Domain Controller, it should be disjoined from the domain.
- - - - - - - - - - - - - - - -
On the w2k3 PDC, the "Help and Support" Service is not listed in "Services" (separate issue). Attempts to click the Microsoft url fails bec. "Help and Support" Service does not exist on w2k3 PDC.
Plus the NT40 computer or SERVERNAME is not found in the AD structure. The w2k3 PDC server can see the NT40 computer & open, map and access its folders & files. but no one else can.
It sounds like and looks like your NT4 server is trying to authenticate using NTLMhash. If the 2k3 server is set up to not allow NTLMhash to authenticate with, the netlogon service may be stopped by your 2k3 server. However, I find this to be interesting because the NT server was demoted and is only a member server on a workgroup at this point in time. Since you are trying to use the netlogon service to authenticate with the 2003 DC, you will have to make the 2k3 server backwards compatible by allowing NTLMhash authentication.
NTLMhash is a very hackable security protocol. So, it is a security breach to make NTLMhash authentication allowed on your domain. If you are looking for information on NTLMhash and how to make these compatible, then, please look at the following article:
I definately recommend taking what you need off of the NT computer and decommision it, then go back to kerberos.
https://www.experts-exchange.com/questions/23132123/Computer-failed-to-join-or-logon-to-domain-days-later-after-reboot.html
NTLMhash is a very hackable security protocol. So, it is a security breach to make NTLMhash authentication allowed on your domain. If you are looking for information on NTLMhash and how to make these compatible, then, please look at the following article:
I definately recommend taking what you need off of the NT computer and decommision it, then go back to kerberos.
https://www.experts-exchange.com/questions/23132123/Computer-failed-to-join-or-logon-to-domain-days-later-after-reboot.html
ASKER
Thanks a bunch for the input. It's a Monday, so I'm working through your suggestions as time allows. I'll post updates regarding issues already discussed.
Resolved the following:
On the w2k3 PDC, the "Help and Support" Service is not listed in "Services" (separate issue). Attempts to click the Microsoft url fails bec. "Help and Support" Service does not exist on w2k3 PDC.
Resolution is (my thanks to Justin Crosby):
Type "cmd" in "Run"
Type "cd %windidr%\PCHealth\HelpCtr
Type "start /w helpsvc /svchost netsvcs /reserver /install"
Goto "Services"
Start "Help and Support" service.
http://blogs.technet.com/sbs/archive/2007/03/20/help-and-support-service-missing-after-installing-windows-2003-service-pack-2.aspx
Next, continue dealing with NT40 issue.
Resolved the following:
On the w2k3 PDC, the "Help and Support" Service is not listed in "Services" (separate issue). Attempts to click the Microsoft url fails bec. "Help and Support" Service does not exist on w2k3 PDC.
Resolution is (my thanks to Justin Crosby):
Type "cmd" in "Run"
Type "cd %windidr%\PCHealth\HelpCtr
Type "start /w helpsvc /svchost netsvcs /reserver /install"
Goto "Services"
Start "Help and Support" service.
http://blogs.technet.com/sbs/archive/2007/03/20/help-and-support-service-missing-after-installing-windows-2003-service-pack-2.aspx
Next, continue dealing with NT40 issue.
How goes the battle?
ASKER
ChiefIT,
I've printed your suggestion, followed the links and read the articles. It's a unique situation, that I've been unable to resolve. As an alternatative solution, we're attempting to move an old Borland database off the NT40 Server. The issue with that process is, the Borland product is copyrighted 1996, and is using Interbase in ODBC. Getting it to run on an XP Pro workstation hasn't worked yet. Whenever the database issue is resolved, the NT40 Server will be taken out of service.
If anyone has any experience with Borland and Interbase, your comments would be appreciated as well.
Thanks.
I've printed your suggestion, followed the links and read the articles. It's a unique situation, that I've been unable to resolve. As an alternatative solution, we're attempting to move an old Borland database off the NT40 Server. The issue with that process is, the Borland product is copyrighted 1996, and is using Interbase in ODBC. Getting it to run on an XP Pro workstation hasn't worked yet. Whenever the database issue is resolved, the NT40 Server will be taken out of service.
If anyone has any experience with Borland and Interbase, your comments would be appreciated as well.
Thanks.
http://soft.softoogle.com/ap/borland-database-engine-download-145.shtml
What version are you using. This site says 5.2 Borland engine works with XP. It's a free download. You know what that means.
You know what the term "Free" means on the internet, right?
What version are you using. This site says 5.2 Borland engine works with XP. It's a free download. You know what that means.
You know what the term "Free" means on the internet, right?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
What exactly do you mean with "replaced", what is this NT4 server that won't start the netlogon service (the 'replaced' one?), and what relation exists/should exist between this NT4 server and the W2k3 server: are these two different domains with a trust relationship, is the NT4 a member in the AD domain, is it a BDC in the AD?