Member server behind F/W joining Domain but no SPN created on object and cant log on
Posted on 2014-02-11
We have put two servers behind a Firewall and joined them to the domain, they joined ok without error but noticed they took a long time to startup at applying computer settings and then when I logged on got the below message.
the security database on the server does not have a computer account for this workstation trust relationship
Looking on the object i see that the SPN was empty, I tried dropping it from domain deleting the AD object and rejoining but the same issue. I got the network team to change rule to permit all and it worked fine. The list of ports we had opened are below
TCP 135 : MS-RPC
TCP 1025 & 1026 : AD Login & replication
TCP 389 : LDAP
TCP & UDP 53 : DNS
TCP 445 : Microsoft-ds
TCP 139 : SMB
UDP 137 & 138 : NetBIOS related
UDP 88 : Kerberos v5
We also opened 49155 as we see connections on that
Are there any ports we have missied.
A 2nd thing that was noticed was even though the Subnet these servers are in has been added to the AD site that they are located at (HongKong), the servers where trying to connect to domain controllers in New York, London and Singapore on port 389
My understanding is that if you have accocoated the subnet to a site it then they should not need to contact DC's outside that site
Our domain is a Windows 2008 single domain / forest model, as this is the case all DC's are global catolog's too.