Solved

Member server behind F/W joining Domain but no SPN created on object  and cant log on

Posted on 2014-02-11
4
903 Views
Last Modified: 2014-02-12
Hi

We have put two servers behind a Firewall and joined them to the domain, they joined ok without error but noticed they took a long time to startup at applying computer settings and then when I logged on got the below message.

the security database on the server does not have a computer account for this workstation trust relationship

Looking on the object i see that the SPN was empty, I tried dropping it from domain deleting the AD object and rejoining but the same issue. I got the network team to change rule to permit all and it worked fine.  The list of ports we had opened are below

TCP 135 : MS-RPC
TCP 1025 & 1026 : AD Login & replication
TCP 389 : LDAP
TCP & UDP 53 : DNS
TCP 445 : Microsoft-ds
TCP 139 : SMB
UDP 137 & 138 : NetBIOS related
UDP 88 : Kerberos v5
We also opened 49155 as we see connections on that

Are there any ports we have missied.

A 2nd thing that was noticed was even though the Subnet these servers are in has been added to the AD site that they are located at (HongKong), the servers where trying to connect to domain controllers in New York, London and Singapore on port 389

My understanding is that if you have accocoated the subnet to a site it then they should not need to contact DC's outside that site

Our domain is a Windows 2008 single domain / forest model, as this is the case all DC's are global catolog's too.

Thanks
0
Comment
Question by:ncomper
  • 2
4 Comments
 
LVL 18

Expert Comment

by:Sushil Sonawane
ID: 39850104
If you associated the subnet to site still your dc should be contact with other DC for replication AD and group policy.
0
 
LVL 36

Accepted Solution

by:
Mahesh earned 500 total points
ID: 39850414
You need to open entire 49152 - 65535 high TCP and UDP ports from all client subnets to domain controllers IP
It is primary requirements in case of 2008 and above DCs
List of all ports
•      TCP and UDP 53 – DNS
•      UDP 137, 138, 139 – NetBIOS
•      TCP 3268, 3269 – GC
•      TCP and UDP 445 – SMB
•      TCP and UDP 88, 464 – Kerberos
•      TCP and UDP 389, 636 – LDAP
•      TCP and UDP 42 – WINS (Optional)
•      TCP and UDP 135 – RPC
•      TCP 5722 – DFSR
•      UDP 123 – Windows Time
•      Ping protocol (Optional)
•      TCP and UDP (1024 – 5000) in case of windows 2003 & (49152 - 65535) in case of  2008 and above– High RPC ports

Above port range need to be opened between DC to DC bidirectional (Two way) and from client to DC one way

I saw that most of the time even if you restrict AD traffic to specific static ports, still it required minimum 255 high TCP ports to communicate properly

if you have DR site and DR DCs, then you need to open ports from your clients to DR DC as well in case of DR invoke

http://support.microsoft.com/kb/832017 - AD port requirements
http://technet.microsoft.com/en-us/library/dd772723(v=ws.10).aspx
http://support.microsoft.com/kb/929851 - dynamic port range change with Vista and above

Mahesh
0
 
LVL 5

Author Comment

by:ncomper
ID: 39850865
Thanks for the responses

Sushil - Correct i would expect the DC acting as the Bridgehead for that site would replicate with DC's in other sites, however i would not expect workstations / member servers to try and authenticate with remote DC's when the subnet they are in is specified on their AD site which was what we were seeing.

Mahesh - I will take a look at those links, Thanks
0
 
LVL 5

Author Closing Comment

by:ncomper
ID: 39852734
Thanks
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
This article runs through the process of deploying a single EXE application selectively to a group of user.
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question