Solved

Member server behind F/W joining Domain but no SPN created on object  and cant log on

Posted on 2014-02-11
4
888 Views
Last Modified: 2014-02-12
Hi

We have put two servers behind a Firewall and joined them to the domain, they joined ok without error but noticed they took a long time to startup at applying computer settings and then when I logged on got the below message.

the security database on the server does not have a computer account for this workstation trust relationship

Looking on the object i see that the SPN was empty, I tried dropping it from domain deleting the AD object and rejoining but the same issue. I got the network team to change rule to permit all and it worked fine.  The list of ports we had opened are below

TCP 135 : MS-RPC
TCP 1025 & 1026 : AD Login & replication
TCP 389 : LDAP
TCP & UDP 53 : DNS
TCP 445 : Microsoft-ds
TCP 139 : SMB
UDP 137 & 138 : NetBIOS related
UDP 88 : Kerberos v5
We also opened 49155 as we see connections on that

Are there any ports we have missied.

A 2nd thing that was noticed was even though the Subnet these servers are in has been added to the AD site that they are located at (HongKong), the servers where trying to connect to domain controllers in New York, London and Singapore on port 389

My understanding is that if you have accocoated the subnet to a site it then they should not need to contact DC's outside that site

Our domain is a Windows 2008 single domain / forest model, as this is the case all DC's are global catolog's too.

Thanks
0
Comment
Question by:ncomper
  • 2
4 Comments
 
LVL 18

Expert Comment

by:Sushil Sonawane
ID: 39850104
If you associated the subnet to site still your dc should be contact with other DC for replication AD and group policy.
0
 
LVL 35

Accepted Solution

by:
Mahesh earned 500 total points
ID: 39850414
You need to open entire 49152 - 65535 high TCP and UDP ports from all client subnets to domain controllers IP
It is primary requirements in case of 2008 and above DCs
List of all ports
•      TCP and UDP 53 – DNS
•      UDP 137, 138, 139 – NetBIOS
•      TCP 3268, 3269 – GC
•      TCP and UDP 445 – SMB
•      TCP and UDP 88, 464 – Kerberos
•      TCP and UDP 389, 636 – LDAP
•      TCP and UDP 42 – WINS (Optional)
•      TCP and UDP 135 – RPC
•      TCP 5722 – DFSR
•      UDP 123 – Windows Time
•      Ping protocol (Optional)
•      TCP and UDP (1024 – 5000) in case of windows 2003 & (49152 - 65535) in case of  2008 and above– High RPC ports

Above port range need to be opened between DC to DC bidirectional (Two way) and from client to DC one way

I saw that most of the time even if you restrict AD traffic to specific static ports, still it required minimum 255 high TCP ports to communicate properly

if you have DR site and DR DCs, then you need to open ports from your clients to DR DC as well in case of DR invoke

http://support.microsoft.com/kb/832017 - AD port requirements
http://technet.microsoft.com/en-us/library/dd772723(v=ws.10).aspx
http://support.microsoft.com/kb/929851 - dynamic port range change with Vista and above

Mahesh
0
 
LVL 5

Author Comment

by:ncomper
ID: 39850865
Thanks for the responses

Sushil - Correct i would expect the DC acting as the Bridgehead for that site would replicate with DC's in other sites, however i would not expect workstations / member servers to try and authenticate with remote DC's when the subnet they are in is specified on their AD site which was what we were seeing.

Mahesh - I will take a look at those links, Thanks
0
 
LVL 5

Author Closing Comment

by:ncomper
ID: 39852734
Thanks
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now