Ошибка подключения пользователя к домену

Answers

• Hi there,

  I went though the netsetup.log that you post.

  I found these lines:

  04/29/2009 10:19:45:981 NetpDsGetDcName: found DC ‘\CHRISTINA.omniacs.com’ in the specified domain

  04/29/2009 10:19:46:300 NetUseAdd to

  \CHRISTINA.omniacs.comIPC$ returned 1326

  Note: DC CHRISTINA.omniacs.com can be located, however after the domain controller was found, an attempt was made to connect to it by using the credentials that are supplied. This attempt failed with error code 1326 (ERROR_LOGON_FAILURE), which indicates that the credentials that you use do not have sufficient access rights for connecting to the domain controller.

  Root cause:

  This is properly a domain join authentication issue

  Solution:
  
  1. Please check the user account (Account: omniacsmdaniels) that you use to join domain is valid in the domain. Also, please also verify that the password you input is correct.

  2. If possbile, please try to use omniacsadministrator user account to join the machine to the domain.

  Reference:
  http://technet.microsoft.com/en-us/library/cc961817.aspx

  10.7 » Failure to connect to a domain controller » Error Codes

  Description	Actual Error	Error Code
  Bad credentials.	ERROR_LOGON_FAILURE	1326
  Time skew that can cause failure of Kerberos authentication.	ERROR_TIME_SKEW	1398
  Failure to connect to a domain controller.	ERROR_ACESS_DENIED	5
  No domain controller found.	ERROR_NO_LOGON_SERVERS	1311

  Hope this can be helpful to resolve the issue.

  Thanks and Regards,
  Scorprio

  ---

  MCTS: Windows Vista | Exchange Server 2007 MCITP: Enterpise Support Technician | Server & Enterprise Admin

  • Proposed as answer by

    Wednesday, April 29, 2009 3:16 PM

  • Unproposed as answer by
    fyathyrio8
    Wednesday, April 29, 2009 11:06 PM
  • Marked as answer by
    Sainath IRP_MJ_CREATE
    Friday, May 1, 2009 4:37 AM

• Another suggestion for something that happened to me recently…

  If you are using the DOMAINUsername format for your credentials, make sure you are entering the Pre-Windows 2000 logon name, if it is different that the regular account logon name (Username@domain.com). I accidentally changed the Pre-Windows 2000 logon name on my account to something different than the regular logon name and Windows would not accept the credentials, while using the DOMAINUsername format. When I noticed that the Pre-Windows 2000 name was different, I entered that in and it worked. I then changed the Pre-Windows 2000 name to match the regular logon name and everything was fine.

  • Marked as answer by
    Sainath IRP_MJ_CREATE
    Friday, May 1, 2009 4:37 AM

• Ok, Here are the issues in your domain… You are using external DNS 65.32.5.111 and 65.32.5.112 but your Domain Controller does not have a valid DNS configured. You can either manually set your Domain Controller Pri and Sec DNS as 65.32.5.111 and 65.32.5.112 respectively. (Just for your info, Domain Controller MUST have a static IP configuration) OR

  The preferred and possible best option is
   to Install Active-Directory Integrated DNS on your Domain Controller (Go to Manage Server and Add DNS), Make the DC to point to itself for DNS (192.168.1.222, Pri and 65.32.5.111, sec) and have all the other Machines, Vista etc have their DNS change to 192.168.1.222 (pri) and 65.32.5.111 (sec)

  ---

  Isaac Oben MCITP:EA, MCSE

  • Marked as answer by
    Sainath IRP_MJ_CREATE
    Thursday, April 30, 2009 6:37 PM
  • Unmarked as answer by
    Sainath IRP_MJ_CREATE
    Thursday, April 30, 2009 6:37 PM
  • Marked as answer by
    fyathyrio8
    Thursday, April 30, 2009 9:13 PM

Ответы

• На контроллере домена указано

  DNS-серверы. . . . . . . . . . . : 192.168.0.1

  что из себя представляет хост 192.168.0.1 ?

  это прокси сервер 

  Тогда адресу 192,168,0,1 нечего делать на интерфейсе КД, в качестве DNS сервера. Если КД у вас один — то поставьте там 192.168.0.10 и перезапустите службу netlogon на КД, net start netlogon — net stop netlogon  затем попробуйте включить компьютер в домен
  снова.

  • Помечено в качестве ответа

    21 сентября 2012 г. 7:29

• это прокси сервер 

  дальше можно не продолжать контроллер должен в настройках DNS-клиента иметь только себя или другие контроллеры… никаких прокси — разрешение внешних имён только через forwarding или root hints

  • Изменено
    AndricoRusEditor
    21 сентября 2012 г. 7:31
  • Помечено в качестве ответа
    Nogboris
    21 сентября 2012 г. 8:16

• Проверить список доменов на экране входа — будут отображаться домены, которые пользователю не нужны.
  При попытке входа в нужный домен выводится ошибка вида:
  

• При попытке ввода компьютера в домен проверить наличие в выводе ошибки сообщения вида:

  Failed to join domain: failed to lookup DC info for domain '<имя_домена>' over rpc: The request is not supported

  CODE

Возможная причина: Запрещена NTLM-аутентификация на контроллере домена. Перейти к решению.

• Проверить наличие в выводе сообщения вида:
  

  "Couldn't get kerberos ticket for: user@xxxxxxxxxx: KDC reply did not match expectations"

  CODE

• Утилита astra-winbind при попытке присоединения к домену выдает ошибку:

  Bad SMB2 signature for message
  [0000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
  [0000] DB E7 09 DA 72 82 F9 CC D3 0E 4C 0A 11 3C 89 70 ....r... ..L..<.p
  Failed to join domain: failed to lookup DC info for domain 'win.domain' over rpc:
  {Access Denied}
  A process has requested access to an object but has not been granted those access rights.

  CODE

• Проверить наличие в выводе ошибки сообщений вида, например, в утилите astra-ad-sssd-client:

  Failed to join domain: failed to lookup DC info for domain 'windom.loc' over rpc: The transport connection has been reset.
   ! Joining the domain windom.loc failed
  realm: Не удалось присоединиться к области: Joining the domain windom.loc failed
  проблемы установки. подробности в файле /var/log/realmd-install.log

  CODE

• Запустить PowerShell на контроллере домена (КД) с правами администратора и проверить, что на КД включена поддержка протокола SMBv2-3:

  Get-SmbServerConfiguration

  CODE

   Раскрыть