First 2008 DC kills logins!

[GoldenWonder]

I've just put in my first 2008 server into my 2003 DC domain and promoted it to a DC. (After all of the forestprep etc) and all seemed to go ok.

 

A day or so later we notice various random XP machines fail to login, hanging at a blank blue desktop (the same colour as the one we use in the group policy). You can still logoff using CTRL+ALT+DEL to get the dialogue though.

 

Also, we also have a batch of Windows 7 machines, most of these hang at the 'Preparing your desktop' stage, before staying at a blank black desktop (you can still logoff as above though)

 

This is only happening for Staff and Student users, i.e not admins like me so I thought it might be our software restriction policies. We use whitelists and all DCs are listed in there (i.e \\server\sysvol and \\server\netlogon are Allowed. Also allowed is \\domain.name\sysvol and \\domain.name\netlogon)

 

It seems to hit the Windows 7 machines a lot more, presumably because they will 'favour' the 2008 DC over the 2003 DCs (1 2008, 4 2003)

 

Nothing shows in the logs of the failing machines (the last message is that folder redirection was successful) so its tricky to work out whats going wrong. It has to be something to do with the new 2008 DC, because as soon as I demoted it, the logins all started to work ok (Windows 7 and XP clients)

 

Anyone any ideas? Is there another path I need to whitelist for 2008 DCs?

[MatthewL]

Create a user and move a computer account into a brand new OU and block all policies on it and see that is any quicker.

[GoldenWonder]

The fact any admin user (who has limited policies and no SRP) can login with no issues proves it must be a policy setting, but only when theres a 2008 DC available! I still think it might be the SRP blocking staff/students from running something at login - but I thought 2008 server only need the usual sysvol and netlogon whitelisting

[leco]

Couple of things to try:

Are there any events on the 2008 DC that might indicate authentication or replication errors?

What about checking which DC the machines/users are logging on to?

[GoldenWonder]

I'm going to try and promote again - not sure how to check which server a user is logged onto as they have no access to cmd etc, and I would normally use SET to find this

 

Edit: Checked the logs an replication seems to be OK. I think the whole promotion is working fine - its just clients are hanging when they are using it as their logon server, which brings me to the SRP idea.

 

I run a program at login to log when a users has logged in - this is running ok, so login scripts are being processed by the look of it

Edited August 3, 2010 by GoldenWonder

[GoldenWonder]

Well I've found out what was causing this, and its a bit of an odd one.

 

It wasn't any policy settings, it was a drive mapping in the login script that pointed to a DFS share (ie net use w: \\domain\share) - only when the user had the new 2008 DC as their login server did this hang. By using a derestricted user I could see the login script hung on the 'net use' mapping command with a prompt saying 'Enter user name for:' which was why the desktop never appeared.

 

Odd thing is this drive mapping to the DFS share has been in use for months (there are 2 2008 servers on our domain with the DFS share on) and the problem only happens since we promoted one 2008 server to DC, and even then it only occurs when the user gets that DC as their login server (and they aren't an admin, as the admins have the same mapping and it works every time, no matter what logon server you get!)

 

So its such a convoluted set of circumstances I'm baffled:

- You have to be connected to the 2008 DC as logon server

- You have to be a non-admin user

- You have a 'net user \\domain\share' statement in your login script

 

Match those three and your desktop will hang - whether its XP, W7 or Vista!

 

Anyone know why it is asking for a username for the mapping statement?