We help IT Professionals succeed at work.

I can mapped a drive by IP but cannot by hostame

Drew Ferguson
Drew Ferguson used Ask the Experts™
on
Getting this error on my windows 20012 r2 server.
I can mapped a drive by IP but cannot by hostame

This error I"m getting is:

\\servername is not accessible.  You might not have permission to use the network resource.  Contact the administrator of the server to find out if you have access permissions

See DCDIAG attached below.

Please help

Thanks
Drew
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Distinguished Expert 2017

Commented:
Possible issues deal with stale record on the server, issues with referential ..

Dfsutils to clear cache...

It is unrelated to dcdiag/AD

Is this a server based share?
I would do two things on the "server":
Assure that the Service: Function Discovery Resource Pulication is set to start Automatically and is Running.
Set the NIC setting, WINS tab to Enable NetBIOS over TCP/IP.

Author

Commented:
Yes, It's a server based share
Just trying to map a drive by hostname; it only can be mapped using the IP Address

Author

Commented:
Ok Fred, will try that too
Thanks
Distinguished Expert 2017

Commented:
Check the server's share sessions and see whether your user has two current session. Look at idle time, close the session with longest idle. Then U map and see if you can map to the server name.  Often the issue is a stale session, or a change issue.
I a command line
Net use X: \\servername
See if you get error 53, 85 etc.

Author

Commented:
Didn't work Fred

Author

Commented:
Arnold
Looking into share session

Author

Commented:
Didn't work Arnold
Any other ideas
Distinguished Expert 2017

Commented:
You have an issue with caching on the system

Which error does net use X: \\servername\sharename return?
53 or 85?

Author

Commented:
Arnold
The error is 1396
The target account name is incorrect

That's the error I get
Distinguished Expert 2017

Commented:
try
Net use X: \\servername\sharename /user:domain\username

...

Author

Commented:
same error
System error 1396
the target account name is incorrect

Author

Commented:
Here's eventvwr info.  This might help

Log Name:      System
Source:        Microsoft-Windows-Security-Kerberos
Date:          11/26/2019 12:51:42 PM
Event ID:      4

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dcserver01$. The target name used was ldap/DCSERVER01.domain.COM. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (domain.COM) is different from the client domain (domain.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
>
Distinguished Expert 2017

Commented:
See if the following helps
is this 2012took over from a prior system with the same name?
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731241(v=ws.11)

Author

Commented:
is this 2012took over from a prior system with the same name?
 Not sure, I inherited this issue
Distinguished Expert 2017

Commented:
one option is to try and reset the SPN record.
Do other users run into this issue as well or is it an issue on your computer only?

Author

Commented:
Everyone is having issues with mapping drives to this server by hostname
Distinguished Expert 2017

Commented:
Then you should try the SPN reset
See the following:
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731241(v=ws.11)?redirectedfrom=MSDN

see if the SPN for the host record ...
has a guide the complaint deals with a mismatch. since you are able to access by IP, it is not your credential something else is interferring.

Author

Commented:
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\Windows\system32>setspn -r dcserver01
Registering ServicePrincipalNames for CN=DCSERVER01,OU=Domain Controllers,DC=DOMAIN,DC=COM
        HOST/dcserver01.domain.COM
        HOST/dcserver01
Updated object

This is the result
Distinguished Expert 2017

Commented:
see if you can access via hostname? setspn -l and see whether there are foreign records ...
Though the initial reference was to test whether the listing included "foreign"

Author

Commented:
C:\Windows\system32>setspn -L dcserver01
Registered ServicePrincipalNames for CN=DCSERVER01,OU=Domain Controllers,DC=C
ERSF,DC=COM:
        NtFrs-88f5d2bd-b646-11d2-a6d3-00c04fc9b232/DCSERVER01.CANCERSF.COM
        HOST/DCSERVER01.CANCERSF.COM/CANCERSF
        RPC/33abcfe9-e383-40ca-9fd9-e3b5ee48d2fb._msdcs.CANCERSF.COM
        GC/DCSERVER01.CANCERSF.COM/CANCERSF.COM
        HOST/DCSERVER01.CANCERSF.COM/CANCERSF.COM
        HOST/DCSERVER01/CANCERSF
        ldap/DCSERVER01/CANCERSF
        ldap/33abcfe9-e383-40ca-9fd9-e3b5ee48d2fb._msdcs.CANCERSF.COM
        ldap/DCSERVER01.CANCERSF.COM/CANCERSF
        ldap/DCSERVER01
        ldap/DCSERVER01.CANCERSF.COM
        ldap/DCSERVER01.CANCERSF.COM/ForestDnsZones.CANCERSF.COM
        ldap/DCSERVER01.CANCERSF.COM/DomainDnsZones.CANCERSF.COM
        ldap/DCSERVER01.CANCERSF.COM/CANCERSF.COM
        DNS/DCSERVER01.CANCERSF.COM
        WSMAN/DCSERVER01.CANCERSF.COM
        WSMAN/DCSERVER01
        E3514235-4B06-11D1-AB04-00C04FC2DCD2/33abcfe9-e383-40ca-9fd9-e3b5ee48
b/CANCERSF.COM
        Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/DCSERVER01.CANCERSF.COM
        TERMSRV/DCSERVER01
        TERMSRV/DCSERVER01.CANCERSF.COM
        RestrictedKrbHost/DCSERVER01
        HOST/DCSERVER01
        RestrictedKrbHost/DCSERVER01.CANCERSF.COM
        HOST/DCSERVER01.CANCERSF.COM
Distinguished Expert 2017

Commented:
potentially you may have to reboot the server, but see if you still are having issues with mapping by name.
run nslookup hostname and see whether it gives you an IPV4 ip on IPV6 ip?
presumably the mapping you do do is by ipv4 try the ipv6 ip.

Author

Commented:
It shows me my dns ipaddress
Top Expert 2014

Commented:
Just to verify, I would try using the FQDN vs. just the hostname when trying to reach the share.

Does nslookup DCSERVER01.CANCERSF.COM. return the same IP (and only one), as the one you can successfully use to map a drive?  The majority of the time I see this error is from an incorrect DNS record.

Author

Commented:
Hi footech

nslookup return to the same ip as the one use to map the drive
FQDN doesn't work either...
Any other ideas
Distinguished Expert 2017

Commented:
Is this server also a dfs target for something including this share?
\\cabcersf.com\sharename? Is it accessible?

Author

Commented:
WOW...that worked
The shares came up
Distinguished Expert 2017

Commented:
This server is a DC, look at dfsutilsit runs into referential loops in DFS.

Author

Commented:
Yes it is.
How do I do this...see below
 dfsutilsit runs into referential loops in DFS.
Distinguished Expert 2017

Commented:
Unfortunately, can not locate a useful link that does not error out on the next link within
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh875644(v=ws.11)

Dfsutils /cache /?
dfssutils /domain /?
There a few to try in the cache to reset the different options there.
Distinguished Expert 2017

Commented:
Any deployed updates, how often or whether the DC has been recently rebooted?
Mike SunSenior Systems Engineer (IBM - retired)

Commented:
Just another thought - try "ping hostname" and see if it returns other than the correct IP address. Also look in hosts file in case there is an entry in there that overrides the IP address for that hostname.

Author

Commented:
Good Morning
Arnold, I rebooted the server
Mike Sun, I tried that already
Footech, I tried what you said also
Distinguished Expert 2017

Commented:
did it let you access through the hostname?

are you able to access by \\servername\sharename?

I think I had a similar conversation here at EE on a similar topic where the shares on the server were not being listed, though I do not remember whether that situation also included a DC.

The person found a link that references a fix, can not locate the thread..

See if the following helps in trying to determine
Disregard suggetion rejoining domain as this is a DC....
presumably when you ran dcdiag /v it did not report errors between/among your DCs for the domain...
I ended up having to setup another Server, move the shares and roles and configure it.  This took a lot of time but ultimately fixed all my issues