Solved

windows 2003 AD issues

Posted on 2014-04-22
5
194 Views
Last Modified: 2014-06-04
users not able to log into the DC.
when i perfom a netdiag i see an entry of
kerberos authentication failed
please advise?
when a user attempts to login we get a message of a trust relationship issue?
0
Comment
Question by:schuitkds
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 

Author Comment

by:schuitkds
ID: 40015797
also get some messages stating
Naming information cannot be located  --- the server is not operational
0
 
LVL 81

Expert Comment

by:David Johnson, CD, MVP
ID: 40016170
kerebos errors usually have to do with time being off between the client and the server (>15 Minutes Difference)
0
 
LVL 14

Accepted Solution

by:
Raj-GT earned 500 total points
ID: 40017554
As David mentioned, it is usually caused by timing issues. Check the time and more importantly the timezone settings on your server and clients.
0
 

Author Comment

by:schuitkds
ID: 40018883
now i get an error message of
Windows cannot create the object <user> because: The directory service was unable to allocate a relative identifier.
I know this was a replication issue
I had 2 DC's  
I had to power off the second DC and do a system state restore to the Primary DC to reestablish the objects in AD.

can i wipe out the reference to the secondary AD and make the system think it has only the Primary DC and establish full functionality. If so how?  
 If i can i would reformat the secondary DC and reinstall the OS and rejoin to domain and once again make it DC at that point.

If i can not wipe out the secondary DC, how do i force the secondary DC to accept replication from the primary DC alone ( one way replication)  and block the replication of the secondary DC info up to the primary DC.
i believe the secondary DC may have been faulty and pushed old AD info up to the primary DC which initiated all the issues.
Thanks in advance
0
 
LVL 14

Expert Comment

by:Raj-GT
ID: 40019298
Have you transferred all the FSMO roles to this dc?
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article describes how to set permissions to allow a limited-permissions user to start and stop a particular System Service.   It is always best to give users only the permissions that they need to perform their job, so tweaking particular permi…
I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question