[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Cannot join workstation to domain.

Posted on 2010-01-07
21
Medium Priority
?
983 Views
Last Modified: 2012-05-08
I just deployed a workstation to one of my sites. When I tried to join the domain, I received the following error.

Title of error box "Computer Name Changes"

"The following error occurred attempting to join the domain "girlscouts":
The specified server cannot perform the requested operation."

I checked the computer container in AD and the account is created but it has a red X over the computer account.

Any help is appreciated. Thanks,

Justin
0
Comment
Question by:JustinGSEIWI
  • 10
  • 5
  • 2
  • +2
21 Comments
 
LVL 6

Expert Comment

by:chilids
ID: 26201779
Try removing the computer account in AD and then add the machine to the domain.  You will have the option to create a computer account as part of teh add and then you can move it to a different OU later if you desire.

0
 
LVL 6

Expert Comment

by:bank_on_it
ID: 26201803
This most likely means the workstation is disabled.
You should be able to right click the workstation and choose the option to enable.
Try to rejoin again once enabled.
0
 

Author Comment

by:JustinGSEIWI
ID: 26201892
I tried removing the computer account and then adding it to the correct AD container manually but that received the same error.

I tried enabling the workstation once it was added and restarted the workstation. It still didn't attach to the domain.

Thanks,

Justin
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
LVL 11

Expert Comment

by:enriquecadalso
ID: 26201904
Hello Justin. Chilids solution must work OK. Just keep in mind that when you join a computer to a domain and the account already exists in the domain the computer have to be named before the join, when it is still in a workgroup. In that case you receive a message "The computer already have an account in the domain. Do you want to use it?"
0
 

Author Comment

by:JustinGSEIWI
ID: 26201985
I did try to join the computer to the domain after creating the computer account in AD manually and I double checked to make sure the computer name was changed before I attempted to join the domain. While doing this, I still receive the error message that I put in the initial post.

Thanks,

Justin
0
 
LVL 6

Expert Comment

by:bank_on_it
ID: 26202048
Is the firewall enabled on the server?
If it is disable the firewall on the server and try to rejoin the workstation
0
 

Author Comment

by:JustinGSEIWI
ID: 26202100
The firewall is disabled on the server.
0
 
LVL 6

Expert Comment

by:chilids
ID: 26202168
Did you try adding it to the domain when there was no computer account in AD?
0
 
LVL 22

Expert Comment

by:Adam Leinss
ID: 26202175
You might want to try running dcdiag (http://technet.microsoft.com/en-us/library/cc776854(WS.10).aspx) from the workstation to see if it can communicate with the domain.  It's included as part of the Windows Server 2003 Support Tools Pack (http://support.microsoft.com/kb/892777).  Otherwise, try renaming to computer to something else.  If you are naming it PC1, try PC2.  PC1 might already exist on their network: PCs should not share the same NETBIOS name either in a work group or domain.
0
 

Author Comment

by:JustinGSEIWI
ID: 26202200
I tried adding the computer to the domain when their was no computer account in AD. I also tried manually creating the account and then trying to join. No luck with either.

Their are a tone of DNS error on the server event log. They are listed below. Could these be related? I think they need attention either way. If they aren't related, where might I find events specific to joining the domain?

Event Type:      Error
Event Source:      DNS
Event Category:      None
Event ID:      4015
Date:            1/6/2010
Time:            10:21:46 PM
User:            N/A
Computer:      GSCRDC1
Description:
The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is "000020EF: SvcErr: DSID-020800E0, problem 5012 (DIR_ERROR), data -1014". The event data contains the error.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 01 00 00 00               ....    

Event Type:      Error
Event Source:      DNS
Event Category:      None
Event ID:      4011
Date:            1/4/2010
Time:            10:22:00 PM
User:            N/A
Computer:      GSCRDC1
Description:
The DNS server was unable to add or write an update of domain name ad in zone ad.girlscouts-mvc.org to the Active Directory.  Check that the Active Directory is functioning properly and add or update this domain name using the DNS console. The extended error debug information (which may be empty) is "000020EF: SvcErr: DSID-02050344, problem 5012 (DIR_ERROR), data -1014". The event data contains the error.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 2a 23 00 00               *#..    


Thanks,

Justin
0
 
LVL 6

Expert Comment

by:chilids
ID: 26202239
Is this a read only Domain controller?
0
 

Author Comment

by:JustinGSEIWI
ID: 26202245
All of my DC's are read/write.
0
 
LVL 11

Expert Comment

by:enriquecadalso
ID: 26202257
When you said "I tried enabling the workstation once it was added" do you mean you added the computer account from the server? The account must be created when you join the domain, not manually from the server. Delete the account (save before the information of any field you may need, like Location, Managed by, etc). Then join the workstation again.

Do you have only one domain controller? It they are more than one check all servers are ok and that replication is working. The roles to create new accounts (RID Master) may be in a inaccessible server.
0
 

Author Comment

by:JustinGSEIWI
ID: 26202328
I tried changing the computer name to something it could not possibly be in AD already. I restarted and then tried joining the domain. I received the same error message.

I downloaded and tried to run dcdiag on the workstation and received the following error.

Domain Controller Diagnosis

Performing initial setup:
   ***Error: desktop1 is not a DC.  Must specify /s:<Domain
   /n:<Naming Context> or nothing to use the local machine.

When I said " I tried enabling the workstation once it was added," I meant that when I tried to join the computer to the domain without manually creating the computer in AD first, a computer account was created but their was a large X over it. It was suggested above that I try enabling that disabled computer account that was created. I tried that and it didn't work.

I have six domain controllers. As far as I can tell, everything is replicating. I went into ADSS and selected the DC of the site I am having trouble with and selected replicate now. I didn't receive an error. As far as I can tell, everything is replicating. How can I confirm that everything is replicating fine?

Thanks,

Justin
0
 
LVL 22

Expert Comment

by:Adam Leinss
ID: 26202358
try dcdiag /s:name_of_dc_server
For replication, try ReplMon->
http://technet.microsoft.com/en-us/library/cc772954(WS.10).aspx
0
 

Accepted Solution

by:
JustinGSEIWI earned 0 total points
ID: 26202437
I followed the directions in this post and it worked. I was able to join the domain.

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_21945065.html?sfQueryTermInfo=1+attempt+cannot+domain+error+follow+join+occur+oper+perform+request+server+specifi#a17260314

What I want to know now is why did I have to go through that special process just to join the domain? Something must be wrong if I can't join the domain normally right?

I can the DCDIAG command you suggested from the workstation after I joined the domain and everything passed.

Thanks,

Justin
0
 

Author Comment

by:JustinGSEIWI
ID: 26202478
I have also noticed that the new workstation is not listed under the reverse lookup zone on the local DC.

I have to go now but i'll be back in about an hour.

Thanks,

Justin
0
 
LVL 6

Expert Comment

by:chilids
ID: 26202754
Before you applied the fix above what was your primary DNS on the client?  In the post above it had you add the DC as the primary which is absolutely correct, that is a must.  But I have never had to add the DNS suffix in the advanced settings to join a domain.  Also to get a ptr record you can try an ipconfig /registerdns from the command prompt or go into the same advanced settings as above and make sure the check box is set to register with dns.

Make sure your DHCP server is giving out the DC as the primary DNS server if it isn't already.
0
 

Author Comment

by:JustinGSEIWI
ID: 26203354
The primary DNS on the client was set to the local DC before I applied the fix. It was set to get DNS from the DHCP server. I just checked DHCP and it is set correctly. It has itself set as the primary DNS and another off site DC as the secondary.

I checked that register DNS was set in the advanced settings and it was. Still no DNS entry. I just did a ipconfig /registerdns and we will see if it shows up in the next few minutes.

I also noticed that my DHCP server has the DNS domain name set but it is not the FQDN, such as domain.local. Instead, it is just set as domain. Should I change that?

Thanks,

Justin
0
 
LVL 6

Expert Comment

by:chilids
ID: 26203483
Are you refearing to option 015 in the DHCP Scope?  If you are then I would change that to domain.local

0
 

Author Comment

by:JustinGSEIWI
ID: 26203536
Yes I was, I just changed it. I checked my other DHCP servers and they were setup as domain.local. That may of been why but I am sure I added machines to the domain with those settings.

Also, I just checked reverse DNS and the newly added workstation is now registered.

Thanks,

Justin
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Here's a look at newsworthy articles and community happenings during the last month.
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

873 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question