Can't connect new computers to my domain?

[Blind]

I need some troubleshooting suggestions.

 

This morning my domain controller (win 2003 standard) decided not to allow new members (all win xp). When I attempt to connect a new pc to the domain, I receive an error about how it can't be contacted.

 

All the existing computers and connections work fine and I can access shared drives and the internet with computers that are not connecting. It just does not seem to want to add new machines to the domain.

 

Any obvious tips and tricks that I might be overlooking?

 

 

The only new configuration that has been done recently was setting up a new DHCP scope, which I have since removed.

[FN-GM]

have you tried making the computer account in AD first?

[meastaugh1]

Does dcdiag throw anything up?

[FN-GM]

Might sound basic but try re-booting the DC if you havn't alredy done

[User3204]

Windows AD is heavily dependent upon DNS.

 

If you changed the DHCP, did you make any erroneous changes to the DNS settings that were being sent out ? I would expect the DNS to be the Domain Controllers.

 

The obvious question to ask, is "Can these machines see the servers ?", can you ping the DCs or DNS servers ?

 

 

I've had difficulties with some workstations not loading network drivers ('cause they're not microsoft signed) until after the initial setup, which means they won't join in until we've logged in as the local admin.

[FN-GM]

is the firewall blocking you from connecting?

[Blind]

Thanks for the ideas, but it's still wonky.

 

The only one I had not tried was putting the computer in the ad first.

 

The first thing I did was restart. The DC passes all the tests in dcdiag. I can see it just fine with an nslookup.

 

 

EDIT:

firewalls were disabled on both ends.

 

This was the first time DHCP was put on this server. I just added the role with the windows wizard. I later removed DHCP entirely. I can ping the server and connect to the internet, just not join the domain.

 

 

 

I'm being vague on what I've done so far to get more ideas and maybe some obvious things I would have overlooked.

[FN-GM]

are you trying to connect them over a wireless or ethernet connection? Can you ping the DC, Other PCs & the internet from the computer you are trying to connect?

[Guest]

i would also try adding the pc to the FULL dns name (FQDN) of the domain, rather then the usual short version,

has helped with our issues, also try setting a static ip address on the pc then add it,

[Blind]

None of the computers I've tried have been over wireless.

 

The ip's are now all static. DHCP has been removed. Running the dhcp wizard was just a test and may be the root of my problems.

 

EDIT:

log of the error message:

 

The domain name stjoe might be a NetBIOS domain name. If this is the case, verify that the domain name is properly registered with WINS.

 

If you are certain that the name is not a NetBIOS domain name, then the following information can help you troubleshoot your DNS configuration.

DNS was successfully queried for the service location (SRV) resource record used to locate a domain controller for domain stjoe:

 

The query was for the SRV record for _ldap._tcp.dc._msdcs.stjoe

The following domain controllers were identified by the query:

 

stjoe_nt.stjoe

 

Common causes of this error include:

- Host (A) records that map the name of the domain controller to its IP addresses are missing or contain incorrect addresses.

- Domain controllers registered in DNS are not connected to the network or are not running.

[User3204]

Have you added or removed or in any way changed the roles of the Domain servers ?

 

There's something bad in your AD.

 

There's a AD cleanup _somewhere_ in windows, and I think you need to run it. Or you could look in the ADSIEdit tool, and if you're feeling brave start, deleting the "wrong" stuff.

[Blind]

With the assistance of this and another forum, I was able to track down the culprit.

 

 

single-label domain name

 

Each computer on the domain apparently needs its registry hacked to dynamically allow our screwed up DC. The odd thing is that it worked fine without the registry edit until this morning when I had 50 computers I wanted to add to the domain.

[User3204]

What ?

 

It's complaining cause your domain is just stjoe not stjoe.com ?

 

So you have a FQDN for the server of "stjoe_nt.stjoe", and it doesn't like this ? Oh, this is amazingly crappy.... Microsoft/Windows needs a smack in the head.

 

 

Would it not be easier to change the domain name to something else, maybe "stjoe.ads" ? I reckon you'll get other issues coming up....

[Blind]

For the curious, here's the fix from Microsoft.

http://support.microsoft.com/kb/300684

[ChrisH]

Thanks for posting that. Too many people get a solution and dont share ending up with another dead end post !