Solved

Member server behind F/W joining Domain but no SPN created on object  and cant log on

Posted on 2014-02-11
4
912 Views
Last Modified: 2014-02-12
Hi

We have put two servers behind a Firewall and joined them to the domain, they joined ok without error but noticed they took a long time to startup at applying computer settings and then when I logged on got the below message.

the security database on the server does not have a computer account for this workstation trust relationship

Looking on the object i see that the SPN was empty, I tried dropping it from domain deleting the AD object and rejoining but the same issue. I got the network team to change rule to permit all and it worked fine.  The list of ports we had opened are below

TCP 135 : MS-RPC
TCP 1025 & 1026 : AD Login & replication
TCP 389 : LDAP
TCP & UDP 53 : DNS
TCP 445 : Microsoft-ds
TCP 139 : SMB
UDP 137 & 138 : NetBIOS related
UDP 88 : Kerberos v5
We also opened 49155 as we see connections on that

Are there any ports we have missied.

A 2nd thing that was noticed was even though the Subnet these servers are in has been added to the AD site that they are located at (HongKong), the servers where trying to connect to domain controllers in New York, London and Singapore on port 389

My understanding is that if you have accocoated the subnet to a site it then they should not need to contact DC's outside that site

Our domain is a Windows 2008 single domain / forest model, as this is the case all DC's are global catolog's too.

Thanks
0
Comment
Question by:ncomper
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 18

Expert Comment

by:Sushil Sonawane
ID: 39850104
If you associated the subnet to site still your dc should be contact with other DC for replication AD and group policy.
0
 
LVL 37

Accepted Solution

by:
Mahesh earned 500 total points
ID: 39850414
You need to open entire 49152 - 65535 high TCP and UDP ports from all client subnets to domain controllers IP
It is primary requirements in case of 2008 and above DCs
List of all ports
•      TCP and UDP 53 – DNS
•      UDP 137, 138, 139 – NetBIOS
•      TCP 3268, 3269 – GC
•      TCP and UDP 445 – SMB
•      TCP and UDP 88, 464 – Kerberos
•      TCP and UDP 389, 636 – LDAP
•      TCP and UDP 42 – WINS (Optional)
•      TCP and UDP 135 – RPC
•      TCP 5722 – DFSR
•      UDP 123 – Windows Time
•      Ping protocol (Optional)
•      TCP and UDP (1024 – 5000) in case of windows 2003 & (49152 - 65535) in case of  2008 and above– High RPC ports

Above port range need to be opened between DC to DC bidirectional (Two way) and from client to DC one way

I saw that most of the time even if you restrict AD traffic to specific static ports, still it required minimum 255 high TCP ports to communicate properly

if you have DR site and DR DCs, then you need to open ports from your clients to DR DC as well in case of DR invoke

http://support.microsoft.com/kb/832017 - AD port requirements
http://technet.microsoft.com/en-us/library/dd772723(v=ws.10).aspx
http://support.microsoft.com/kb/929851 - dynamic port range change with Vista and above

Mahesh
0
 
LVL 5

Author Comment

by:ncomper
ID: 39850865
Thanks for the responses

Sushil - Correct i would expect the DC acting as the Bridgehead for that site would replicate with DC's in other sites, however i would not expect workstations / member servers to try and authenticate with remote DC's when the subnet they are in is specified on their AD site which was what we were seeing.

Mahesh - I will take a look at those links, Thanks
0
 
LVL 5

Author Closing Comment

by:ncomper
ID: 39852734
Thanks
0

Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article outlines the process to identify and resolve account lockout in an Active Directory environment.
This article explains the steps required to use the default Photos screensaver to display branding/corporate images
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question