Windows 7 Machine can't join 2003 R2 Domain

Here's a problem I've been having with joining a W7Pro Sp1 box to a 2003 R2 Sp2 Domain:


I've gone through the DNS info and cannot find where I've gone wrong.  XP boxes can join the domain with no problems.  I've disabled the CA RTM 8x antivirus when trying to join, but with no luck.
There are only a handful of security updates that haven't been applied to this machine, and none of them seem to have any bearing on the problem I am having.
The two errors are when I try to join the W7 machine with the domain name "EAGLE" and with the domain name "EAGLE.LOCAL".  You can see a more detailed error message when I try with the .LOCAL suffix.
I followed the KB article 241515 and was able to get SRV records.
I've tried to join 3 different W7 machines and the same result.
The server reports no issues with DNS, the DHCP server is giving the correct info out regarding DNS.  I verified my DNS settings on the NIC, and they are the same as other 2k3 R2 servers we have running that w7 boxes could join to--in that the dns servers actual IP was listed along with the ISP's addr.
I've restarted both DNS & luck w/ joining after.
I have not run any net diags or other diags...if anyone has suggestions on what's best to run, I'd like to hear them or another comments or advice.  I'm not at pulling my hair out yet, but if I can't do this sometime soon, either I'll pull my hair out or it'll have already fallen off my head.
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

did you try to set static ip address and dns on the windows7 ?
It is unclear to me whether you are setting the IP for DNS in the client. If you are, then make sure to leave out the ISP DNS servers while joining the domain.

Hope that helps....
Lee W, MVPTechnology and Business Process AdvisorCommented:
> verified my DNS settings on the NIC, and they are the same as other 2k3 R2
> servers we have running that w7 boxes could join to--in that the dns servers
> actual IP was listed along with the ISP's addr.
This is wrong - it may not be your problem, but it definitely wrong.  Your ISP doesn't give a rat's behind where your network services are, but Windows locates things through DNS lookups.  If Windows decides to use the ISP servers and says "where's my global catalog", your ISP's DNS servers say "I don't know (and I don't care)"

Run IPCONFIG /ALL on BOTH your server and your problem workstation and post screen shots here.

Also, try joining the DNS domain name - meaning if your domain is mydomain and mydomain.local, try joining mydomain.local.
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

Enter your domain DNS server (probably domain controller IP) as your client DNS - not ISP DNS.
Can you ping eagle.local?
stubeans007Author Commented:
I may have been unclear in regards to the Server's NIC info:  under the DNS info on the SERVER's NIC, I have the DNS server for the domain listed 1st (same server for DNS, DHCP, AD), then I have the ISP's info.

On the DHCP server, I have only the DNS SERVER's IP address to be handed out as DNS server.

I have tried to join both mydomain and mydomain.local, the error screenshots show the respective outcomes when I try that.

I will have to post the workstation a bit later.

Ok, forget about DNS settings you get form DHCP for a moment. Just type your domain controller IP as your Windows 7  IPv4 Preferred DNS Server.
Then IPCONFIG /FLUSHDNS and then try to join the client to the domain.
stubeans007Author Commented:
Have already tried that.  I tried it both with ipv6 enabled and disabled, but putting the DNS server info in under the ipv4 properties.

The W7 machines can see and connect to the server shares by logging on w/ domain credentials when mapping a drive.

Several months ago, we had to downgrade a w7 box to xp to get it to join this domain as the machine HAD to be on the domain.  These machines are going to be on and off-site, however, we'd like to get them in AD.

I haven't taken one of these machines and tried to join them to a different domain, but I can try that if I absolutely have to.....they are not being put into production just yet, but I'd prefer if i didn't have to.

Ok. Then focus on this:
Yoyr Windows 7 client is asking his DNS server about domain controller.
And this DNS server tells your client that your 2003 R2 domain controller is called new_server_2008_eagle.local.
Looks strange to me. Check your _ldap._tcp.dc._ SRV record. unless your 2003 domain contoller is called "2008".
Have you tried to remove the ISP DNS info from your DNS server, flush DNS and then see if you can join?

Kevin HaysIT AnalystCommented:
I'm with leew, your ISP doesn't care at all.

In a nutshell, take out the ISP dns servers in your DC servers tcp entry and only have the local dns servers IP.  You can add a forwarder in the dns applet and put the ISP dns servers ip in there to translate any name resolves out on the net. (provided your DC has AD, DHCP, DNS installed on the server and nothing else)

Run dcdiag /v > c:\dnstest.txt on the server.
Look at the file and see if everything passes.
Look through your DNS records and make sure they are intact, but I would think the dcdiag will tell if anythings wrong.
stubeans007Author Commented:
Ok, I'll follow TAWpower & kshays advice and follow those steps and post back what I find as well as the dnstest.txt file that I create.
Appreciate the feedback, we're all over worked here and need some unbiased, possibly less-worked brains to help out with this.
I'm not overworked :)
I'm just curious why your 2003 server has name "new_server_2008" :)
stubeans007Author Commented:
I found the problem(s).
Apparently this machine was renamed after it was set up as a PDC. It was changed from the "new_server_2008" to "newserver2008" as whoever named it previously didn't realize the underscores would cause issues.
After it was renamed, the DNS zones were never properly edited/updated, so what i ended up dealing with was two DNS zones that had mixed information pointing to both old and new server names, in both of them.
What I need to do, is remove the 'old' DNS zone with the underscored name, and update the actual domain local zone that everyone is in.  I've gottent the name resolution to work properly, so it's just now getting rid of the bad zone and making sure the zone I'm working with is pointing to the correct locations/servers.....
Thanks for the help, it certainly made a difference in figuring out the problem.
stubeans007Author Commented:
I actually figured out the real reason why the DNS had problems:

Disjointed NameSpace

Went to:  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters

and changed the Domain value from 'mydomain' to 'mydomain.local'
Changed the NV Domain from 'mydomain' to 'mydomain.local'
Added the value 'myserver' to the Name Server entry as it was blank

Restarted the Net Logon service as well as DNS Server & Client services after changes---in that order.

Went into NIC DNS binding, removed external DNS servers from DNS tab and external DNS server from static IP/DNS box on general tab of NIC properties.

Ran Netdiag /fix (the 5.2.3xxx version, not the 5.0 version, as .dll references don't match on 2003 servers) and then ran Dcdiag /fix.

By changing those registry values, the full computer name in the 'Computer Name' tab of 'system' changed from 'myserver.mydomain' to 'myserver.mydomain.local'

By running the netdiag /fix, all DNS entries were changed/updated or added to the proper locations.

What a horror show, but now the W7 PC's join the domain w/ no problems and logon times are actually quicker for all users.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
stubeans007Author Commented:
Entered correct solution.
stubeans007Author Commented:
Gave myself an 'attaboy'
Thanks for all the help everyone and hope this helps someone out there.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Applications

From novice to tech pro — start learning today.