Ошибка при присоединении в домен windows xp

Ответы

• Ещё раз убедитесь, что SMBv1 у вас точно включен, т.к. XP не может работать с более новыми версиями протокола.

  Также есть подозрение, что последние апдейты на 2012R2 включали в себя изменения Kerberos Security. которые не совместимы с XP. Поэтому как вариант следующий — это откатить последние апдейты с КД, затем попробовать ввести в
  домен и снова накатить апдейты в случае успеха. Но и в этом случае нет гарантий, что клиент будет себя нормально «чувствовать» в доменной архитектуре.

  А копать нужно собственно в сторону переноса сервисов с XP на современные ОС, т.к. дальше проблем будет ещё больше.

  • Предложено в качестве ответа

    6 августа 2019 г. 8:52

  • Помечено в качестве ответа
    Vector BCO
    6 августа 2019 г. 9:10

• Всё заработало. Банально отключил и потом снова включил поддержку SMB1.

  В моём случае так-как в диспетчере серверов галочку на против этого пункта снять нельзя было (были неактивны), сделал через powershell:

  Обнаружение:

  Get-WindowsFeature FS-SMB1

  Отключение:

  Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol

  Включение:

  Enable-WindowsOptionalFeature -Online -FeatureName smb1protocol

  Всем спасибо за помощь. 

  • Предложено в качестве ответа
    Dmitriy VereshchakMicrosoft contingent staff
    6 августа 2019 г. 8:52
  • Изменено
    ArgSerYoga
    6 августа 2019 г. 8:54
  • Отменено предложение в качестве ответа
    ArgSerYoga
    6 августа 2019 г. 8:54
  • Помечено в качестве ответа
    Vector BCO
    6 августа 2019 г. 9:10

• Remove From My Forums

All replies

• «Is windows XP still supported to join the domain«

  No.  Windows XP is out of support.  No testing for compatibility/usability with 2019 has been performed by Microsoft because Windows XP is not supported.  As intimated by Clement, you might be able to get it to join by downgrading the domain,
  but that does not change the fact that it is still unsupported, even when the domain is at a lower level.  Not only does lower the settings in the domain lower the overall security of the domain, just having a Windows XP system in your environment lowers
  the overall security of your environment.

  ---

  tim

• Windows XP is generally unsupported — you might be able to arrange a custom support contract with Microsoft, but keep in mind that this is an expensive proposition and includes only support for security updates.

  hth
  Marcin

• It is not supported. You may be able to make it work but you should not be surprised if future updates will break it again.

  ---

• Hello,
  We can try the following common ways to troubleshoot the issue:

  1. Check if we can ping domain or domain controller.

  2. Check whether the Windows XP points to the correct DNS server.

  3. Check whether all the Windows XP clients can not be added to the same domain.

  4. Check whether we use correct domain administrator credentials when we join Windows XP to domain.

  5. Check if we try to create the Windows XP computer name in the domain first, then if we can add it to domain.

  If all the above is OK and all the Windows XP clients can not be added to the domain. I am sorry, please understand because Windows XP is out of support. We don’t have such an environment to test. It may have potential and incompatible
  problems. It is recommended that we use the new version of Windows client.

  Thank you for your understanding and support.

  Best Regards,
  Daisy Zhou

  ---

  Please remember to mark the replies as answers if they help.
  If you have feedback for TechNet Subscriber Support, contact
  tnmff@microsoft.com.

  • Edited by

    Tuesday, February 12, 2019 2:49 AM

  • Proposed as answer by
    Daisy ZhouMicrosoft contingent staff
    Thursday, February 28, 2019 2:30 AM

• Hi,
  If this question has any update or is this issue solved? Also, for the question, is there any other assistance we could provide?

  Best Regards,
  Daisy Zhou

  ---

  Please remember to mark the replies as answers if they help.
  If you have feedback for TechNet Subscriber Support, contact
  tnmff@microsoft.com.

• Hi Daisy Zhou,

  Please see the comments below:

  1. Check if we can ping domain or domain controller.
   — Yes….

  2. Check whether the Windows XP points to the correct DNS server.
   — Yes, it’s correct..

  3. Check whether all the Windows XP clients can not be added to the same domain.
   — Unfortunately, all windows XP clients are failed to join to the domain.

  4. Check whether we use correct domain administrator credentials when we join Windows XP to domain.
   — The domain admin credentials are correct.

  5. Check if we try to create the Windows XP computer name in the domain first, then if we can add it to domain.

   — Thanks for the suggestion. However, this method is not work either. But surprisingly that, I found the computers membership is
  been disabled when I join the win p client to the domain. It’s strange!

  Btw, thanks all for your feedback, suggestion and answer, appreciate it. Anyway, i think i need to find a plan for the win XP client.

  Thanks.

  Scriven Tan.

• Hi,
  You are welcome!

  Thanks for your understanding and time. Have a nice day!

  Best Regards,
  Daisy Zhou

  ---

  Please remember to mark the replies as answers if they help.
  If you have feedback for TechNet Subscriber Support, contact
  tnmff@microsoft.com.

• Hello

  I have the same problem and same error.

  According to my investigation , it seems that Windows 2019 AD controller supplies kerberos ticket to the Windows XP client  with AES encryption despite the fact that Windows XP asks and supports RC4 encryption only.

  The RC4 encryption support is enabled in policies for DC but it still doesn’t work and DC ignores this setting when 2016 and 2012 r2 and even 2008 r2 works correctly.

  I think that MS got decision to block RC4 support but no documentation about that was found. I hope that this is a bug and it will fixed whenever because this also affects other RC4 kerberos clients as various old Linux implementations being joined to AD
  domain.

• I seriously doubt that Microsoft enforcing a higher level of security in a domain would be considered a ‘bug’ by Microsoft.  They did the same thing many years ago when they stopped supporting NT4 security in a domain out of the box.  They did
  provide a way to ‘downgrade’ the environment to allow the NT4 security.  I would hazard a guess (I have not tried it) that if you downgraded your domain to something prior to 2019 functional level, you could get by the outdated security.  But you
  are sacrificing security in order to include operating systems that most likely do not have support anymore.  The OP was asking about Windows XP.  That is definitely not supported.  So downgrading security level to add an unsupported and security
  vulnerable operating system to the environment seems counter-intuitive.

  ---

  tim

• Hi

  Personally, I have no problem with nonsupporting of old protocols by default.  Moreover , DES and RC4 in Kerberos are not supported by default even in Win2008 R2 unless a administrator defines their supporting in policies.

  So, it is definitely OK to not support it by default but still let to admins the option to enable it on their own risk in case they do want to support old clients such as XP or old Linux. 

  But this is not the same case because theoretically Microsoft still  has left the option to enable DES and RC4 support in policies in Windows 2019 but despite this it isn’t working and no glue in MS documentations has been found about this limitation.
  So, my conclusion this is a bug or some undocumented design change.

• If you do believe it is a bug, then you should report it to Microsoft.  Microsoft does not charge for support cases that are determined to be bugs.

  ---

  tim