Windows 7 clients dropping off the domain

[slugshead]

Hey guys, first post and all..

 

Ok it's happening in plenty of schools and its been happening since we started the rollout of windows 7, we havnt yet found a resolution for this...

 

We setup a new IT suite, Windows 7 and Server 2003/2008.. A week later we'll get a call saying that the users cannot log in..

 

So, off we go and come across a PC just sat there with our username as the only user account on the Pc and it looks like it was never joined to the domain..

 

All of the software that the server had pushed out is still there, the AV software is still there... The computer account is still in AD, yet the computer is not on the domain..

 

We have static IPs, No DHCP leases from the servers

Computers are OEM Dell windows 7 pro (Never imaged)

 

Has anyone else seen anything like this?

Ive tried searching all over the net but nothing at all on this happening anywhere

[sted]

do the pcs have realtek network cards by any chance and do you get a trust related error upon trying to logon

 

other than that if its oem dell is someone running the restore to factory option they sometimes have on the boot screens ive had that with hps i just diddnt notice the option myself

[Michael]

Are you running Windows 7 SP1?

 

Why haven't you imaged the machines out of curiosity? It's a known fact all OEMs install rubbish you do not want or need.

 

Is the problem restricted to just these Dell workstations?

 

Can your users access the context menu on 'Computer'?

[sted]

infact whats the event log look like (might be worth just looking at dates see if there are any suspicios gaps oor evern any obvious errors or another possibility some kid has got hold of the local admin password and is using that to take them off the domain (which can be done quite happily without ad credentials and that would leave the account still there)

[Michael]

You don't need any username or password to leave the domain and join a workgroup. If your users can access the context menu on 'Computer', I suspect this is the problem.

[slugshead]

Thankyou for the responses

do the pcs have realtek network cards by any chance and do you get a trust related error upon trying to logon

 

 

All the new Dells appear to come with broadcom cards and the trust error has occasionally happened but its not actually that issue..

 

Are you running Windows 7 SP1?

 

Why haven't you imaged the machines out of curiosity? It's a known fact all OEMs install rubbish you do not want or need.

 

Is the problem restricted to just these Dell workstations?

 

Can your users access the context menu on 'Computer'?

 

Yes we do have SP1, its preinstalled and we allow for WSUS to update to SP1

The reason we havn't imaged is due to the variety of hardware we have, we are still evaluating viable imaging solutions.

And yes, we only use Dell systems

 

whats the event log look like

In every instance, the event viewer has had literally nothing. I suspect it would be system restore, but there is nothing in the eventviewer at all about this.. We also have a GPO that disables system restore, but this was initially inteded for XP..

 

If your users can access the context menu on 'Computer'

Pupil accounts do not have access to the context menu's but the teacher accounts do.. I can see how this is possible if a pupil has gained access to a teacher account. But they wouldn't just do it to one computer would they? they would do it to every PC they could log into..

 

This one seems to have got us all stumped as it is happening so randomly, always one pc at a time, they never fall over in waves..

[Michael]

The reason we havn't imaged is due to the variety of hardware we have, we are still evaluating viable imaging solutions.

 

Windows 7 is pretty good when it comes to imaging. I've used the same image on many different types of hardware, so gone are the days when you need to create an image per make/model. Windows 7 also has an excellent driver database and detects most hardware automatically.

 

Back to your problem, I can only speculate someone is doing this deliberately as I've not come across this problem before. Staff also shouldn't need to access to the context menu on 'Computer'. I would explore this and then see if the problem magically stops.

[iadubber]

Windows 7 is pretty good when it comes to imaging. I've used the same image on many different types of hardware, so gone are the days when you need to create an image per make/model. Windows 7 also has an excellent driver database and detects most hardware automatically.

 

Back to your problem, I can only speculate someone is doing this deliberately as I've not come across this problem before. Staff also shouldn't need to access to the context menu on 'Computer'. I would explore this and then see if the problem magically stops.

 

Same here. We are using WinPe and ImageX to create images and deploy them.

[slugshead]

We have used winPE and imageX to image multiple computers of an identical specification in the past, it works well. But it does drag the network down so dramatically..

Doing that opened up a whole can of worms that I wont go into, but none of those PC's did the issue of what I am originally describing.

 

It's a very strange problem, its 1/30 new PC's setup and always happens within the first week of them being installed. It's a simple fix, just re join them to the domain..

But trying to find out a reason as to why is somewhat difficult, it just seems to be us with the problem?

[sted]

We have used winPE and imageX to image multiple computers of an identical specification in the past, it works well. But it does drag the network down so dramatically..

Doing that opened up a whole can of worms that I wont go into, but none of those PC's did the issue of what I am originally describing.

 

It's a very strange problem, its 1/30 new PC's setup and always happens within the first week of them being installed. It's a simple fix, just re join them to the domain..

But trying to find out a reason as to why is somewhat difficult, it just seems to be us with the problem?

 

if you have 08r2 server you can decrease the network load and use multicast to deploy images

[iadubber]

Try disabling IPV6? Is reverse DNS working?

[slugshead]

Try disabling IPV6? Is reverse DNS working?

 

Yes IPv6 is disabled in our build instructons

Yes reverse DNS works in each school this has happened

[mopey85]

I have had the same issue and it turns out this was caused by windows recovery or repair.

 

Cause

Students power off eachothers machines as a joke or the battery's get pulled off causing windows to shutdown unexpectedly. Windows then decises it needs to run a repair and restores old files from a restore point.

 

When windows restores some of these files it restores and old machine account password. Machine account passwords are changed every 30 days by the client not the server. So when the computer is finished repairing and tries to join the domain with an old machine account password and windows then rejects the client and its all over.

 

Solution

To fix it you can disable automatic machine account password changes on all machines in the network. Note this will not be an instant fix if the machine has been on the domain for 30 days without a restore point set.

 

Instructions

Start Registry Editor. To do so, click Start, click Run, type regedit in the Open box, and then click OK.

Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

In the right pane, click the

DisablePasswordChange

entry.

On the Edit menu, click Modify.

In the Value data box, type a value of 1, and then click OK.

Quit Registry Editor.

 

Thats from microsoft but its my first post so i cant post the link. Just google it.

 

Hope this helps.

[Duke5A]

If that's the problem (which it probably is), I'd be more inclined to disable System Restore instead of changing the default inner workings of AD. Machine accounts changing their passwords every 30 days is for security.

[Jollity]

You don't need any username or password to leave the domain and join a workgroup.

They would need to be a local admin as well, wouldn't they?

[huxley]

Are you running DeepFreeze? When we saw this, it was because we were using DeepFreeze for our lab computers and when AD would periodically change the machine account password, the machine would reboot and loose the password change, consequently have a different machine account password than what AD had assigned and could no longer authenticate with AD.

To fix that issue, in our GPO's for machines that ran Deep Freeze we enabled Computer Configuration-Windows Settings-Security Settings-Local Policies-Security Options-Domain Member-"Disable Machine Account Password Changes"

[K.C.Leblanc]

We've had a similar issue, it was caused by connecting an old machine with the same name and then renaming it.

[Duke5A]

Are you running DeepFreeze? When we saw this, it was because we were using DeepFreeze for our lab computers and when AD would periodically change the machine account password, the machine would reboot and loose the password change, consequently have a different machine account password than what AD had assigned and could no longer authenticate with AD.

To fix that issue, in our GPO's for machines that ran Deep Freeze we enabled Computer Configuration-Windows Settings-Security Settings-Local Policies-Security Options-Domain Member-"Disable Machine Account Password Changes"

 

FYI, DO NOT implement this policy with the machines still frozen as they will immediately request a new machine password when this happens. Once they reboot, they'll revert to the old password and the machine account will be borked. Don't ask how I came to find this out.

[Michael]

They would need to be a local admin as well, wouldn't they?

 

Logically I'd say yes, but you could argue there's no security risk leaving a domain, only joining a domain.

[Andie]

Did anyone come up with a definitive network wide fix for this? Preferably one that I can understand too! As this is now happening here, and the cause would seem to be that laptops are not powered down properly, go into sleep mode when lid is shut, then the charger plug is turned off to the trolley and the laptop runs out of juice. I kept being told that folks couldn't log in on some laptops, then finding the laptop looking as if I forgot to add it to the domain. I cought one or two machines running Windows repair when I powered up plugged in. There are only 12 laptops to deal with, so if I have to edit registry on each, so be it, and I can do future edits before imaging. But help would be very much appreciated!

[sted]

 bcdedit /set {default} bootstatuspolicy ignoreallfailures 

 

will disable it and works as a startup script so

 

if exist c:\suroff.txt goto end
bcdedit /set {default} bootstatuspolicy ignoreallfailures
copy \\server\share\suroff.bat c:\suroff.txt 
:end

[Andie]

 bcdedit /set {default} bootstatuspolicy ignoreallfailures 

 

will disable it and works as a startup script so

 

if exist c:\suroff.txt goto end
bcdedit /set {default} bootstatuspolicy ignoreallfailures
copy \\server\share\suroff.bat c:\suroff.txt 
:end

 

Thanks, but I'm going to need a bit more help. I've also found this which says it disables Startup Repair from running as default:

 

bcdedit /set {default} recoveryenabled No

 

What's the difference? And is the second bit meant to be the startup script or a way of creating a startup script? Sorry, but I'm learning as I go along....

[sted]

the difference by the looks mine just stops it running automatically the other kills it so you cant run it manually either. yes the 2nd bti is a startup script so you can set it on a group of pcs and it will run once then not again

[Andie]

Brilliant, thanks. I'll give it a go.

[alemanyorks]

do the pcs have realtek network cards by any chance and do you get a trust related error upon trying to logon

 

 

We have a few machines that drop off with trust error issue quite regularly, got any more insights re. this?