Why domain-joined server was assigned with "guest or public network" profile?
This is a newly-setup MS Windows 2012 R2 AD Domain. There are 2 DCs, both W2K12 R2. However, found that one of the DC and few other W2K12 R2 member servers (all are VMs) was assigned with "guest or public network" profile, instead of Domain network. On the network and connection center, it was shown with "unidentified network". Even logging on with a domain user (or admin), this seems like a local user account profile. for example, a domain user account logged on affected DC was given the user path of "c:\users\administrator folder. While the correct ones should be "c:\users\administrator.TS
I heard that may have to delay-start the NLA service? is that true?
Appreciate for your help, many thanks.
EE---DC01-firewall-shows-public-netw.jpg
EE---DC01---Network.jpg
EE---set-on-DC01.txt
EE---set-on-TSserver01.txt
I heard that may have to delay-start the NLA service? is that true?
Appreciate for your help, many thanks.
EE---DC01-firewall-shows-public-netw.jpg
EE---DC01---Network.jpg
EE---set-on-DC01.txt
EE---set-on-TSserver01.txt
What are the two servers configured with for DNS? Both should be configured to look at the DC for DNS as the primary DNS server. If they have anything else, the firewall profile would reconfigure itself as being in an unknown network (because it isn't technically on the domain).
ASKER
Hi Joseph,
Normally, none of the dns suffix is assigned. I shall assign it when on site 2 days to go.
Thanks for the prompted suggestion.
Normally, none of the dns suffix is assigned. I shall assign it when on site 2 days to go.
Thanks for the prompted suggestion.
ASKER
Hi Adam,
Now I recall that there are 2 DCs, one located at site a, and another one at site b. Both sites are connected in WAN infra. The affected DC and few servers are located at site a, while the second DC located at site b.
All these servers and DCs are located behind a "local firewall", to a pair or routers, and then a "remote firewall" to the other site. On site a, there could be few updates on the local firewall that does not allow all the servers and DC access to site b.
Let's me confirm this and get back to you in 2 days' time.
thanks,
Now I recall that there are 2 DCs, one located at site a, and another one at site b. Both sites are connected in WAN infra. The affected DC and few servers are located at site a, while the second DC located at site b.
All these servers and DCs are located behind a "local firewall", to a pair or routers, and then a "remote firewall" to the other site. On site a, there could be few updates on the local firewall that does not allow all the servers and DC access to site b.
Let's me confirm this and get back to you in 2 days' time.
thanks,
You've already often some good advice but as an aside, your profile folder names are not an indication or a proble,m.
Windows will always try to create a profile folder based on the username first, even for domain accounts. So "administrator" instead of "administrator.ts" is perfectly normal and NOT an indication of a problem.
It will append a dot-domain only if another folder with the same name already exists and has a mismatched ACL and isn't in the registry.
And if a username.domain folder already exists, it'll start appending numbers.... such as username.000 and username.001
All in the name of preventing data loss. This is normal and expecfed.
Windows will always try to create a profile folder based on the username first, even for domain accounts. So "administrator" instead of "administrator.ts" is perfectly normal and NOT an indication of a problem.
It will append a dot-domain only if another folder with the same name already exists and has a mismatched ACL and isn't in the registry.
And if a username.domain folder already exists, it'll start appending numbers.... such as username.000 and username.001
All in the name of preventing data loss. This is normal and expecfed.
ASKER CERTIFIED SOLUTION
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
ASKER
By restarting the nla service, problem no more
If you don't have a suffix, assign one.