Cant login to data server - No login server to service request

[TwistedHelixis]

Hi, I look after a few primary schools. At each school they have a DC server and a Data server. I have noticed that at just one of the schools, if the DC goes offline I am also unable to login to the Data server, with the error 'no logon servers to service the logon request' displayed. Yet at the other schools I am still able to login when the DC is offline.

 

All schools are on the same 2012R2 server versions.

 

Any ideas why this might be happening at one school?

[computer_expert]

Do you have more than one DC at this site? If not, check to see if cached credentials have been disabled via GPO.

 

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available

[TwistedHelixis]

Do you have more than one DC at this site? If not, check to see if cached credentials have been disabled via GPO.

Just one DC.

When I check the 'Local Security Policies' on the data server itself for cached credentials, it is set to remember the last 10 accounts.

 

I have also noticed a difference between this server and my other data servers with the login box.

For the other data servers, just above the box that you type the password into it displays 'domine.lan\user' but on this data server it lists 'domine\user@domain'

Might not be anything but thought I should mention it

[computer_expert]

Run "gpresult /h %userprofile%\desktop\gpresult.html" from an admin command prompt and look at the html file on the server's desktop. This should show you all the policies that are applied to the server and the name of the GPO that applies the setting(s). If you have a case where a local policy is set and a domain GPO setting overrides it, the domain GPO wins and is applied.

 

I know there is a setting to change if the UPN is displayed on the login/lock screen somewhere in GP, but I can't remember where or what the setting is called. Hopefully a GPresult should show if this is set and should answer why the username looks different.

[TwistedHelixis]

I have done that. I am not sure the report is 100% OK. The first half looks how I would expect (looks like group policy editor) but the last half is just a mish mash.

 

Any chance I can send the report over to you so you can see if it looks how it should?

[TwistedHelixis]

Its OK. text looks as expected when opened in IE

[TwistedHelixis]

Run "gpresult /h %userprofile%\desktop\gpresult.html" from an admin command prompt and look at the html file on the server's desktop.

 

Just checked the html file and nothing listed that looks like it might be causing this issue. There are only a few policies being applied to the data servers, mapped drives, proxy settings, local admin policy, security certificate, default domain policy and that's about it.

[computer_expert]

How are you trying to access the server when the DC is offline? via RDP or with a KB/mouse/monitor attached to the server?

 

If you are using a locally attached KB/monitor, you don't have this setting enabled do you? https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation

I'm not sure if the setting above applies to RDP connections though.

 

I realise there may be constraints (budgets, lack of hardware, software licensing, maintenance etc) but I highly recommend that all AD domains have at least 2 DCs for redundancy.

[TwistedHelixis]

Interactive logon: Require Domain Controller authentication to unlock workstation = Disabled

 

How are you trying to access the server when the DC is offline? = Via the Hyper-V Gui

Hyper-V host is not domain joined. The host has both the DC and Data servers running on it.

 

I highly recommend that all AD domains have at least 2 DCs for redundancy.

Almost all the primary schools in the entire county are setup like this by the LA. All our files are now cloud based anyway and next year I might look at utility based DNS / DHCP and remove the MS server.

[TwistedHelixis]

OHHH might have worked out part of the issue. Ill do some more testing and report back

[TwistedHelixis]

So I created a new user in AD, logged onto the data server, logged off, shut down the DC and managed to log into the Data server using this new account. So there is something about the old account I was given by the LA that seems to be blocking the details being cached.

 

Would be handy to workout why this is happening, but at least I have narrowed down the issue to a user based issue.

[TwistedHelixis]

hmmmmm, just tried using the old account and now that just lets me log in without the DC turned on.

 

More testing needed to see if there is something else going on.

[TwistedHelixis]

Now I can't recreate the original issue. Not sure why its now working, Gremlins?

 

Thanks for your help @computer_expert

[johnathanadams]

Worth adding the AD role to the 2nd server for replication/backup/redundancy anyway