Topic: "Windows cannot connect to domain . . . "

[RF_Guy]

Hi,

I've had a problem with an older version of SME Server 6.0.1 running out of disk space, I've been advised to upgrade to a current version of SME Server so I've purchased an entire new server platform, a Dell, PowerEdge T100 with the idea that I can keep the old server working till I get the new server running.  On the new platform I've installed SME Server 7.4, and configured it as best as I've been able to figure out the same as the 6.0.1 server.

I'm not the person who set up the 6.0.1, he passed away about a year and half ago, and as far as I can tell the last change to the server was about 2 years ago.  I'm also not an IT guru, but I am the go to guy for computers and software. I have some unix experience mostly as a user and have been been involved in PC hardware, software, OS etc since the DOS days.  My small company has grown accustomed to the features the SME Server has provided, have our office PC's networked for file storage/sharing, network printing, email forwarding.  We currently have 5 XPpro Client machines and a couple of Win98 machines, some printers and other periphials on our network,  The 6.0.1 server is connected to the outside world via a DSL modem.

For testing of the new 7.4 server I've connected the it to an isolated network hub and connected one of the xp Pro Client machines.  When I boot up the XP pro Client machine I get a windows Login screen, that asks for User name, password, and shows the domain.  When I enter the username and password, I get a Windows Login Message:
  "Windows cannot connect to the domain, either because the domain controller is down or otherwise unavailable, or because your computer account was not found.  Please try again later.  If this message continues to appear, conact your System Adminstrator for assistance."

This is disturbing because I have become the System Adminstrator, and have been trying for days to fix this problem.

I have searched the forums on contribs.org, online manual, and FAQ.  I've found quite a bit of information, tried several things but still have the problem.

If I power up the client PC with out it connected to the network hub, I can login.  Then I connect it to the network hub with the new 7.4 server and I can open Internet Explorer and login as admin to Server-Manager.  Using Server-Manager I can review the configuration, and see the users.  I've assigned new secure passwords to all users, and changed the password on the xp Client I've been testing to match the new secure password.

I have screen capture comparisons of the old and new server configurations at:
  http://www.ztechnology.com/download/SME/SME-Server-6-0-1-Review-Configuration.png
  http://www.ztechnology.com/download/SME/SME-Server-7-4-Review-Configuration.png

and a list of users at:
  http://www.ztechnology.com/download/SME/SME-Server-6-0-1-Users.png
  http://www.ztechnology.com/download/SME/SME-Server-7-4-Users.png

I've installed fewer users on the new server as some of the users on the old server are no longer with the company.

In this forum I found entries from jimgoode saying on his xp clients he  . . .
"had to disable three settings:
Start-->Control Panel-->Administrative Tools-->Local Security Policy-->Local Policies-->Security Options:
Domain member: Digitally encrypt or sign secure channel data (always)
Domain member: Digitally encrypt secure channel data (when possible)
Domain member: Digitally sign secure channel data (when possible)"

Also found other entries that said this was a known problem and you had to . . .
 Greg says - run reg file at http://yourserver/server-resources
which I did, and Marcyh refers to a link http://forums.contribs.org/index.php?topic=41900.0 which has more detail about doing what Greg suggests.

Okay so I've done all that and I still get the same "Cannot connect to domain . . . "

So how do I find out what is wrong and how do I fix it?  Any help would be much appreciated.

Thanks

John Purdy
RF_guy.

[Stefano]

hi

the problem is that the new server has a different SID (search google) than the old one..
to solve this problem, you could:
- reinstall new server
- install affa contrib on it
- use affa to move your server from a server to another.

more info here

Stefano

p.s. read carefully the howto
p.s.2 I've upgraded several servers with Affa without a problem

[RF_Guy]

Stefano-
Thanks for the reply.  Have you used Affa to move SME version 6 to new hardware running SME version 7.4?

I've reviewed the instructions at
 http://wiki.contribs.org/Moving_SME_to_new_Hardware
is running yum update necessary on the 'prodIP' box? 
when I run 'yum update' it fails . . .  see below

"Welcome to SME Server 6.0.1-01
[root@ztserver root]# yum update
Gathering package information from servers
Getting headers from: SME Server 6.0.1 os
Traceback (innermost last):
  File "/usr/bin/yum", line 44, in ?
    yummain.main(sys.argv[1:])
  File "yummain.py", line 144, in main
  File "clientStuff.py", line 688, in get_package_info_from_servers
  File "clientStuff.py", line 128, in HeaderInfoNevralLoad
ValueError: unpack list of wrong size
[root@ztserver root]#"

Thanks

John Purdy
RF_Guy

[janet]

RF_Guy

Yum support was not in sme 6.x, it was added with early versions of sme 7.x, so forget trying to "yum update" your sme6 install.

The correct way to upgrade it to sme 7.4 is using a CD, and running the upgrade option rather than the new install option. You can download the CD iso image and burn a disk from the image.

The CD upgrade is supported for base installs of sme server and even those with many & various add on applications installed, but you may run into problems depending what versions etc are currently installed. Some add on  applications are also not compatible at all with sme 7.x as their functionality has been replaced with standard features that are included in a base install of sme 7.x. Review any installed add on contribs and ensure there are compatible versions available or be prepared to stop using any that are no longer needed.

If you do choose to upgrade your sme 6.x, then try a test run first, and make sure you have proven good backups.

It may be better off (easier) to follow this procedure for restoring directly from a sme 6.x mounted disk, to your new sme 7.4 installed OS.
http://wiki.contribs.org/UpgradeDisk

It does work OK, but you MUST follow the procedures exactly and heed the warnings or you will have problems. It's worth reading the long forum thread referenced for background information. Also there is the minor possibility that your machine accounts do not get transferred correctly (see bugzilla), which happened with some sme 6.x to sme 7.x upgrades, so you may need to unjoin and rejoin all your workstations to the domain anyway.

Again a trial run, will indicate if you are likely to experience any problems.

If you currently have a 2 drive software RAID1 array in your sme 6.x server, then you can remove a drive and use that for testing the upgrade process.


Having said all that though, rather than upgrading the old sme6.x server to sme 7.4, there are good reasons to build a new server with new hardware and install the OS from a sme 7.4 CD eg the partition configuration is different and supports semi auto repair of broken RAID arrays etc.
Then restore your data using the restore from disk method.

Good luck, proceed with care, and read everything first.

[Stefano]

mary, I agree with you, but if the OP needs to minimize the downtime, Affa is absolutely the best option

my 2c
Stefano

[janet]

Stefano

....if the OP needs to minimize the downtime, Affa is absolutely the best option

Affa does not install on sme6.x (no yum support for a start), so OP will need to upgrade his production server to sme7.4 first, which may introduce significant issues.

Then there will still be the Affa installation and transfer to the new sme 7.4 box.

Given that there are a few steps involved that may put the existing sme6.x server "out of action", then it seems to me that the restore from mounted disk method may well be faster & easier (ie no need to perform a backup, which saves a lot of time).

[Stefano]

no, mary, you are wrong here

Affa must be installed on the new hw, then a new job must be configured..

Affa will then take all the files from the production machine end, finally, "rise" the server..

as I said, I used it many times without problems to migrate old 6.x servers to new hw..

I suggest you to read the doc. about it and, possibily, to test: it's amazing

Ciao
Stefano

[janet]

Stefano

Affa must be installed on the new hw, then a new job must be configured..
Affa will then take all the files from the production machine end, finally, "rise" the server..

Yes I see that now, refer:
http://wiki.contribs.org/Moving_SME_to_new_Hardware
(and at the end a section re sme 6)
I had read that article some time ago and forgot/overlooked the method to come from sme6 to 7 (it's just an rsync job essentially that will run on whatever OS version).

I stopped using sme6.x over two years ago so never had used Affa to upgrade (as Affa was not around then).

I note the comment:
"Depending on the amount of data and the speed of hardware and network this first job run can take a really long time."

This is the backup process from sme 6 to the sme 7 machine, so OP could still be in for a long wait while the backup runs, but of course a much quicker "rise" eg 20 minutes.
I do use Affa, and a server with a lot of data can still take a long time to backup the first time (a few/many hours even on a LAN connection).

PS I believe the same issues referred to in the restore from mounted disk method (ie incompatibilities and custom templates etc), will still apply to any sme 6 to sme 7 upgrade, an Affa backup/rise procedure does not avoid those issues, so they still need to be addressed.

[RF_Guy]

Stefano,

Thanks again for your input on this subject.

After carefully reading the exchange between you and Mary, and the "Moving SME to new Hardware" using affa doc at http://wiki.contribs.org/Moving_SME_to_new_Hardware
I've decided that using affa is the way to go.

There are more than one reason I don't want to try to update the production 6.0.1 server to 7.4, the first of which it is already indicating it is low on inodes and diskspace.  Seems like using affa is the way to go with the caveats regarding moving SME 6 to a SME 7 platform.

I don't believe that there are custom RPMs on the SME 6 Server, I had the idea that it was pretty stock.  But I will find out as I go through the process.

So my plan is to scrub the new hardware, and start over.  Install SME 7.4 from the CD, on the new hardware then start following the instructions in the above doc.

Under the "SME 6 Server" section of the doc, it says . . .
   You must set rsync--inplace to no:
then gives a command line example . . .
  db affa setprop prodserv rsync--inplace no

Question: where in the process does this have to be done?  In the "Configure Affa" section of the doc?

Thanks for your time and input.

John Purdy
RF_Guy

[Stefano]

Under the "SME 6 Server" section of the doc, it says . . .
   You must set rsync--inplace to no:
then gives a command line example . . .
  db affa setprop prodserv rsync--inplace no

Question: where in the process does this have to be done?  In the "Configure Affa" section of the doc?

John, to migrate your SME 6 to your new SME 7.4, configure Affa this way:

Code: [Select]

db affa set AffaGlobalDisable yes
db affa set prodserv job
db affa setprop prodserv remoteHostName prodIP
db affa setprop prodserv rsync--inplace no
affa --make-cronjobs

that's all you need.. then follow the remaining steps..

HTH
Ciao
Stefano

[janet]

RF_Guy

I don't believe that there are custom RPMs on the SME 6 Server, I had the idea that it was pretty stock.  But I will find out as I go through the process.

You should investigate this and follow the suggestions in the UpgradeDisk method, as they could be a source of problems later, if they do exist.
This issue is really custom templates and custom user templates, as any rpms will not be transferred.
These steps fix these if they exist, which you would do on the restored server after the backup rise.
#  cd /etc/e-smith
# mv templates-custom templates-custom.old
# mkdir templates-custom
# mv templates-user-custom templates-user-custom.old
# mkdir templates-user-custom

...where in the process does this have to be done?  In the "Configure Affa" section of the doc?

Yes, you install Affa on the newly built (but not configured) sme 7.4 server. Then run the db commands Stefano mentions, and any other ones deemed necessary for your situation, generally following the steps outlined earlier in
http://wiki.contribs.org/Moving_SME_to_new_Hardware

Also read the main Affa document for full details.
http://wiki.contribs.org/Affa

[RF_Guy]

Okay, so I've followed the instructions, and found a couple of analomies.

1. after I ran 'affa --run prodserver' it took 5 or 6 hours to complete.  I looked at /var/affa/prodserv directory and there was no "rpms-missing.txt' file  I assumed that means that there were no missing RPMs.

2. under Final Data Synchonization the
the old 6.0.1 machine didn't like  . . .

SVC='qpsmtpd sqpsmtpd crond imap pop3 ...etc' line
so I stopped each of the service individually using the command syntax
  'Service xxxxx stop'
The first two services qpsmtpd, and sqpsmtpd the system reported there were no such services, but the others stopped okay.

Ran 'affa --run prodserver'  again this time took only about 10 minutes

powered off the prodIP box.

on the newIP box ran 'affa --rise --all prodserv' then rebooted.

after the reboot on the newIP console I get screen full after screen full of the following message:
'(99) Cannot assign requested address: make_sock: Couldnot bind to address 192.168.100.9:443
no listeing sockets available, shutting down
unable to open logs'

Since this keeps filling the screen it is difficult to see whats going on.

I did re-boot again and carefully watched the start-up messages, something interesting I saw was . . .

Bringing up interface eth0:via-rhine device eth0 does not seem to be present, delaying initialization.
Starting wan:                                 [Failed]
.
.
.
Starting nmbd:                                [OK]
Starting smbd:                                [OK]
Starting System message bus:(99) Cannot assign requested address: make_sock: Couldnot bind to address 192.168.100.9:443
no listeing sockets available, shutting down
unable to open logs'                          [OK]
Starting HAL daemon:                          [OK]
.
.
.
followed by more of the (99) etc messages . . .

So when I login as root to the new hardware it takes the prodIP servers password, so I have to believe that much of the transfer has occured successfully.  Because of the continual (99) ... messages I can't really run the server-manager from the console because it runs in a text mode and the text keeps scrolling with new messages.

It looks to me like the new hardware is looking for the network interface from the old hard ware and not finding it.  192.168.100.9 is the IP address of the local lan on the old hardware. 

Is there a way I can stop the messages so that I can use the server-manager to get the system to recognize the Lan interface that is in the new hardware and use it for the local lan interface?

I've had to put the old hardware back in service so when I get this sorted out I may have to start all over on the new hardware with a fresh SME 7.4 install, I hope not, I'd like to just fix the problem and not have to start over, I have a couple of days before any users need to sign in (ie no users till tuesday, monday is a day off for our office.)

Thanks for any pointers you may be able to give.

This affa was working so slick!  I feel like I'm very close . . .

John Purdy
RF_Guy.

[janet]

RF_Guy

At a guess, you need to log in as admin, select Configure this server, and select the correct NICs/drivers, and do any other configuration changes considered necessary.
I would also run through ALL server manager settings to ensure they are appropriate. Remember too that sme7 also has built in virus, spam, executable content and RBL filtering, which will all need setting up.

The first two services qpsmtpd, and sqpsmtpd the system reported there were no such services, but the others stopped okay.

Understandable as they did not exist on sme6 eg it was using smtpfront-qmail

Have you checked in
/etc/esmith/templates-custom
and
/etc/e-smith/templates-user-custom

You can boot up in rescue mode to the install CD to get to a usable command prompt, see
http://wiki.contribs.org/Booting

Also if your sme6 is acting as a mail server, there may be new emails arrived that are not part of the backup, so you may need to manually transfer those.

[RF_Guy]

Mary,
Using the rescue mode I've been able to check
    /etc/e-smith/templates-custom
    and
    /etc/e-smith/templates-user-custom
both these directories are empty.

I don't see how I can get to an admin login in the rescue mode to run the server-manager to configure eth0.

So in the mean time I'm seeing if there is another way to stop the error messages that keep scrolling the console screen.

every few seconds I see . . .
'(99) Cannot assign requested address: make_sock: Could not bind to address 192.168.100.9:443
no listing sockets available, shutting down
unable to open logs'

Maybe then I can get into server-manager to configure the eth0.
Thanks,
John Purdy
RF-Guy

[Stefano]

John:

you have to log in into local console (i.e. from a keyboard and a monitor physically connected to your server) with user admin and root's password

[janet]

RF_Guy

You could run a CD install but select upgrade, and you will be stepped through the Configure this server process and NIC drivers should be auto determined or manually requested

[RF_Guy]

Mary, Stefano,

I've got the new server hardware live with all the transfered data and user accounts.
I was able to stop the error messages scrolling on the console by stopping httpd-e-smith.  Once the messages stopped scrolling on the console I was able to login as admin and configure the network interfaces, set the local network to use DHCP, and check all the other settings.  I also ran the "Cleaning up" instructions for cleaning up after affa.
Now all the networked PCs can login, share files, print to network printers etc.
I still have one big issue though.  The two desktop PC's I used for testing with the new server still get the . . .


 "Windows cannot connect to the domain, either because the domain controller is down or otherwise unavailable, or because your computer account was not found.  Please try again later.  If this message continues to appear, conact your System Adminstrator for assistance."

The strange thing is that if I disconnect the network connection on either of those two PCs wait a couple of minutes, then login, it will login okay, then connect the network cable, wait a couple more minutes, then the PC sees all the network drives, can print, browse the web, send recieve email all looks normal, just is a bizare that have to login with the Network cable disconnected.  All the other desktops (that I didn't use for testing) don't exihibit this issue.

I've looked at the registry entries for "RequireSignOrSeal" and they all appear to be correct (disabled).
I've run the .reg file at Server-resouces for windowsxp boxes (which I believe just sets the RequiresSignOrSeal parameter.

I'm concerned that I some how got the SID from the server before I did the affa transfer intertwined on these two PC accounts.

I'll be doing more research to see if I can figure out how to fix this, but in the mean time the new server is live and folks coming in tomorrow on tuesday will be using the new SME-server 7.4.

If you have any ideas about this last issue I'd appreciate your comments or ideas.

Thanks for helping me get this far, you help has been indespensible.

John Purdy
RF_Guy

[janet]

RF_Guy

The two desktop PC's I used for testing with the new server still get the . . .
 "Windows cannot connect to the domain, either because the domain controller is down or otherwise unavailable, or because your computer account was not found.....
I'm concerned that I some how got the SID from the server before I did the affa transfer intertwined on these two PC accounts.

If these machines joined the domain on the "new" server you initially built (before restore), then the machine accounts will be different.
A domain is "trusted", you cannot connect a workstation from one domain to another domain even if it has the same "name".
Machine accounts are unique to an iteration of a workstation & domain controller, that's why you needed to restore all those machine accounts.

I'm guessing you have to unjoin those 2 workstations, and then rejoin them to the current "real" domain.

The strange thing is that if I disconnect the network connection on either of those two PCs wait a couple of minutes, then login, it will login okay...

In that case it seems that you are not logging in to the domain, but you are logging in to the workstation.

....then connect the network cable, wait a couple more minutes, then the PC sees all the network drives, can print, browse the web, send recieve email all looks normal, just is a bizare that have to login with the Network cable disconnected.

Bizarre maybe to you, but not necessarily a sign that you are part of the "trusted" domain.
Seeing them is one thing, but can you actually access & open & save files on those shares, and are those shares on the domain controller ?
Also are the workstations configured to allow access to only "authenticated domain users", or not ?
 
As I understand it, access to other services is to be expected, whether you are a member of the domain or not. They depend on your gateway & DNS & mail server settings on your workstation browser & email clients.

[RF_Guy]

I'm trying to fix the 2 PC's that still won't login and give the "Windows cannot connect to the domain either because the domain controller is down or unavailable. . ."

I've tried to unjoin the domain from the PC by logging into the PC as adminstrator, going into the Control Panel:System:Computer Name Tab and clicking "Change" and changing from "Domain" to "Workgroup", then rebooting the PC.  Now my user account on the PC that connects to the domain is gone.  I can still log into the PC as administrator and go into Control Panel:Users and look at the users.  The users that use the domain are not listed, though all their files are still in C:\documents and settings.

I've logged into the PC as adminstrator, and tried to join the domain but did not work.  So then I logged into the SME server as admin, using Server-Manager and I deleted the user for the PC I was working on.  The Server-Manager warned there was an error deleting the user. I've put a copy of the log file from SME Server at:
 http://www.ztechnology.com/download/SME/SME_Log_delete_johnp.txt

When I tried to add the user back it said there was already an undeleted user by that name, however the user does not show up in Server-Manager:User page.

I did back up the PC before I started all this, but I'm afraid I've really goofed things up.

Is there way to try to un-do the Delete user on the the SME Server?

What do I have to do to get the PC to be able to join a domain again?

Thanks again for any pointers

John Purdy
RF_Guy

[janet]

RF_Guy

Is there way to try to un-do the Delete user on the the SME Server?
What do I have to do to get the PC to be able to join a domain again?

You need to fully delete the user.
See the FAQ re forcing user deletion when things go wrong.
By the look of your log file, you should delete the user johnp first).
http://wiki.contribs.org/SME_Server:Documentation:FAQ#Deletion_of_Users_Ibays_Groups

To be sure (due to Windows issues) you should also temporarily change the Windows workgroup name to some other arbitrary name ie not the same as the domain name (if not already done), then reboot, and then rejoin the domain.

Note the old profiles (on the workstation) will not be accessible once you rejoin the domain. New ones will be automatically created.

[axessit]

Hi RF_Guy

The profiles stored on the XP machine are local to that PC - just delete all the user folders under C:\Documents and Settings\userxxx (assuming you don't need to save any of their data). DONT create any users on the XP machine using the control panel User Accounts. Delete any created there except the local machine's administrator (the Domain is the name of the PC).

I'm not sure how "new" the install of XP is on the machine, but you need to install the registry patch by opening a webbrowser and going to http://server/server-resources/regedit and click on the winxplogon reg patch.

Then add your computer to the domain - when it asks for the username to add to the domain, use "root" and put in your SME admin password. That should then join the PC to the domain. After a reboot, you can log on using your SME user/pass and it will download any stored profile from the server or create a new one if it didn't exist.

You don't need to add a user to the XP machine when using domain logins. The machine will however keep a local copy of the users profile under C:\Documents and settings if they've logged on on that machine. And it is possible to salvage a users information from there.

[RF_Guy]

Here's a followup to my problem of not being able to successfully login to a domain from a couple of WinXPpro PCs that were connected to a new SME Server then re-connected to the same new SME Server after it has successfully been updated with data and settings from an existing SME Server that has now been retired (migrated from SME 6.0.1 to SME 7.4). 

I read that inorder to be able to connect to the updated new server, those PC's had to un-join the domain, then re-join the domain.  Directions on that were unclear.  Just join a workgroup to un-join the domain, then re-join the domain.

I also got an additional hints from Axessit, 1st login as administrator on the local PC, then go to Start:Control Panel:System:Computer Name tab. Click on the Change button.  Click Workgroup.  When it asks for a user and password to join the workgroup use the root user and password for the SME server.
So I did that and was able to un-join the domain and join a workgroup. The PC re-boots, again login on the local PC as Adminstrator. 

When I tried to re-join the domain I Clicked Start:Control Panel:System:Computer Name tab, then clicked the Change button, the Domain button, entered in the domain name.  When it asked for a user and password, I entered the root user and password for the SME server again, I was not allowed to join the domain.  I tried the admin user and password for the SME server and was successful.  Then the local PC rebooted.

When I logged in at the local PC into the domain using the former profile name, in this case /ZTECHNOLOGY/johnp the computer created a new profile, C:\docs&settings\johnp.ztechnology.000

I wanted to use the old profile C:\docs&settings\johnp.ztechnology which I could see was still on the PC's drive.

Thinking that I would have to start all over, I did a system restore on the PC to a time before I un-joined the domain.  The local PC re-booted, then just for grins I tried loging into the domain as the user johnp, and voila the system let me in, and all my previous profile files and settings were present.

I did the same procedure on the other PC and successfully un-joined, re-joined the domain, logged in as the old user got a new profile, then did a system restore to a time before the un-join/re-join, then was able to login to the old profile.

So I'm all operational now.  Thanks to those who offered guidence Sefano, Mary, and Axessit.

John Purdy
RF_Guy

[steveblackman]

Sometimes, after extended periods of time when a computer which is a member of an Active Directory domain was taken offline and then brought online, or when some sort of cloning or imaging method or even a virtualization software snapshot mechanism was used on a domain member, you may get an error similar to this
http://www.techyv.com/questions/domain-computers