"Goob" <G***@discussions.microsoft.com> wrote in message
news:9EA955E0-98D5-4789-B116-6F94FF931350@microsoft.com...
> Facts:
> Win2K3 Domain - about 70 Users
> Approx. 5 Users have this issue.  All Clients are XP Pro either SP2 or SP3
> All Mapped Drives are done on the Client Side (Except Home Folder) - All
> Working
> Home Folder is Created/Permissioned using ADUC/Profile
>
> I have some users that Periodically received a "Access Denied" when
> attempting to open thier Home Folder (H:). This does not happen all the
> time.
>
> More know facts:
> When this happens to these users:
> - I am able to attempt to open the folder 50 times and NOT lock the user
> account
> - I am able to use the UNC path to open the Home Folder with no problem
> - On one individual that I am working with, She did NOT have this issue
> before replacing her pc.  I had replaced her pc for performance reasons
> and
> it started with the new pc (Dell Optiplex)
> - On one other individual, she has had this issue since she started
> working
> here (new employee) - MPC Laptop
>
> I am leaning toward an issue with the Domain Account, because if I manuall
> map the drive from the client - this does not happen; however at the same
> time, all users are created equally.  So why these few people are having
> this
> issue.
>
> On another note (not sure if it is related) - I have a few Users that when
> they do open thier Home Folder, its opened at the "Share" and not thier
> personal folder.  Again this doesn't happen all the time.
>
> Any thoughts?

"Ace Fekay [Microsoft Certified Trainer]" wrote:

> "Goob" <G***@discussions.microsoft.com> wrote in message
> news:9EA955E0-98D5-4789-B116-6F94FF931350@microsoft.com...
> > Facts:
> > Win2K3 Domain - about 70 Users
> > Approx. 5 Users have this issue.  All Clients are XP Pro either SP2 or SP3
> > All Mapped Drives are done on the Client Side (Except Home Folder) - All
> > Working
> > Home Folder is Created/Permissioned using ADUC/Profile
> >
> > I have some users that Periodically received a "Access Denied" when
> > attempting to open thier Home Folder (H:). This does not happen all the
> > time.
> >
> > More know facts:
> > When this happens to these users:
> > - I am able to attempt to open the folder 50 times and NOT lock the user
> > account
> > - I am able to use the UNC path to open the Home Folder with no problem
> > - On one individual that I am working with, She did NOT have this issue
> > before replacing her pc.  I had replaced her pc for performance reasons
> > and
> > it started with the new pc (Dell Optiplex)
> > - On one other individual, she has had this issue since she started
> > working
> > here (new employee) - MPC Laptop
> >
> > I am leaning toward an issue with the Domain Account, because if I manuall
> > map the drive from the client - this does not happen; however at the same
> > time, all users are created equally.  So why these few people are having
> > this
> > issue.
> >
> > On another note (not sure if it is related) - I have a few Users that when
> > they do open thier Home Folder, its opened at the "Share" and not thier
> > personal folder.  Again this doesn't happen all the time.
> >
> > Any thoughts?
>
>
> This first thing that comes to mind is a DNS mis-config, but this is only a
> guess since you haven't provided any detailed configuration info to provide
> an accurate diagnosis, or at least to eliminate possible configuration
> issues.
>
> Please provide the following to better help figure this out:
>
> 1. Unedited ipconfig /all from two of your DCs
> 2. Unedited ipconfig /all from a working desktop, and one with the problem.
> 3. Are any of your DCs multihomed? (more than one NIC), and/or have RRAS
> installed?
> 4. Is this occuring all in one site, or do you have multiple Sites, with
> Sites defined in AD?
>
> Thanks,
>
> --
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Please reply back to the newsgroup/forum to benefit from collaboration among
> responding engineers, as well as to help others benefit from your
> resolution.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
> Microsoft Certified Trainer
> ace***@mvps.RemoveThisPart.org
> http://twitter.com/acefekay
>
> For urgent issues, you may want to contact Microsoft PSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
>

"Goob" <G***@discussions.microsoft.com> wrote in message
news:217E4A27-FAD6-4116-9CF8-4AA5D13ED834@microsoft.com...
> DC1
> Host Name: dc1
> Pri DNS Suffix: company.org
> Node Type: Hybrid
> Ip Routing Enabled: No
> Wins Proxy Enabled: No
> DNS Suffix Search List: company.org
> Ethernet Adapter 1
> Connection-Specific DNS Suffix:
> Description: Broadcom BCM5708C NetXtreme II
> Physical Address: AA-BB-CC-DD-EE-FF
> DHCP Enabled: No
> IP Address: 192.149.115.12
> Subnet Mask: 255.255.255.0
> Defaut Gateway: 192.149.115.121
> DNS Servers: 192.149.115.12
>                     192.149.115.71
> Wins Servers: 192.149.115.12
>                      192.149.115.71
>
> DC2
> Host Name: dc2
> Pri DNS Suffix: company.org
> Node Type: Hybrid
> Ip Routing Enabled: Yes
> Wins Proxy Enabled: Yes
> DNS Suffix Search List: company.org
> PPP Adapter RAS Server
> Connection-specific DNS Suffix:
> Description: WAN (PPP/SLIP) Interface
> Physical Address: AA-BB-CC-DD-EE-FF
> DHCP Enabled: No
> IP Address: 192.149.115.34
> Subnet Mask: 255.255.255.255
> Default Gateway:
> Ethernet Adapter 1
> Connection-Specific DNS Suffix: company.org
> Description: Broadcom BCM5708C NetXtreme
> Physical Address: AA-BB-CC-DD-EE-FF
> DHCP Enabled: No
> IP Address: 192.149.115.73
> Subnet Mask: 255.255.255.0
> IP Address: 192.149.115.71
> Subnet Mask: 192.149.115.71
> Connection-Specific DNS Suffix:
> Description: Broadcom BCM5708C NetXtreme II
> Physical Address: AA-BB-CC-DD-EE-FF
> DHCP Enabled: No
> IP Address: 192.149.115.12
> Subnet Mask: 255.255.255.0
> Defaut Gateway: 192.149.115.121
> DNS Servers: 192.149.115.12
>                     192.149.115.71
> Wins Servers: 192.149.115.12
>                      192.149.115.71
>
> Working Wkst
> Host Name: computer1
> Primary DNS Suffix: company.org
> Node Type: Hybrid
> IP Routing Enabled: No
> Wins Proxy Enabled: No
> DNS Suffix Search List: company.org
>                                  company.org
> Ethernet Adapter 1
> Connection-specific DNS Suffix: company.org
> Description: Intel 82566DM-2
> Physical Address: AA-BB-CC-DD-EE-FF
> IP Address: 192.149.115.216
> Subnet Mask: 255.255.255.0
> Defaut Gateway: 192.149.115.121
> DNS Servers: 192.149.115.12
>                     192.149.115.71
> Wins Servers: 192.149.115.12
>                      192.149.115.71
>
>
> Broken Wkst
> Host Name: computer2
> Primary DNS Suffix: company.org
> Node Type: Hybrid
> IP Routing Enabled: No
> Wins Proxy Enabled: No
> DNS Suffix Search List: company.org
>                                  company.org
> Ethernet Adapter 1
> Connection-specific DNS Suffix: company.org
> Description: Broadcom NetXtreme 57xx
> Physical Address: AA-BB-CC-DD-EE-FF
> IP Address: 192.149.115.127
> Subnet Mask: 255.255.255.0
> Defaut Gateway: 192.149.115.121
> DNS Servers: 192.149.115.12
>                     192.149.115.71
> Wins Servers: 192.149.115.12
>                      192.149.115.71
>

"Ace Fekay [Microsoft Certified Trainer]" wrote:

> "Goob" <G***@discussions.microsoft.com> wrote in message
> news:217E4A27-FAD6-4116-9CF8-4AA5D13ED834@microsoft.com...
> > DC1
> > Host Name: dc1
> > Pri DNS Suffix: company.org
> > Node Type: Hybrid
> > Ip Routing Enabled: No
> > Wins Proxy Enabled: No
> > DNS Suffix Search List: company.org
> > Ethernet Adapter 1
> > Connection-Specific DNS Suffix:
> > Description: Broadcom BCM5708C NetXtreme II
> > Physical Address: AA-BB-CC-DD-EE-FF
> > DHCP Enabled: No
> > IP Address: 192.149.115.12
> > Subnet Mask: 255.255.255.0
> > Defaut Gateway: 192.149.115.121
> > DNS Servers: 192.149.115.12
> >                     192.149.115.71
> > Wins Servers: 192.149.115.12
> >                      192.149.115.71
> >
> > DC2
> > Host Name: dc2
> > Pri DNS Suffix: company.org
> > Node Type: Hybrid
> > Ip Routing Enabled: Yes
> > Wins Proxy Enabled: Yes
> > DNS Suffix Search List: company.org
> > PPP Adapter RAS Server
> > Connection-specific DNS Suffix:
> > Description: WAN (PPP/SLIP) Interface
> > Physical Address: AA-BB-CC-DD-EE-FF
> > DHCP Enabled: No
> > IP Address: 192.149.115.34
> > Subnet Mask: 255.255.255.255
> > Default Gateway:
> > Ethernet Adapter 1
> > Connection-Specific DNS Suffix: company.org
> > Description: Broadcom BCM5708C NetXtreme
> > Physical Address: AA-BB-CC-DD-EE-FF
> > DHCP Enabled: No
> > IP Address: 192.149.115.73
> > Subnet Mask: 255.255.255.0
> > IP Address: 192.149.115.71
> > Subnet Mask: 192.149.115.71
> > Connection-Specific DNS Suffix:
> > Description: Broadcom BCM5708C NetXtreme II
> > Physical Address: AA-BB-CC-DD-EE-FF
> > DHCP Enabled: No
> > IP Address: 192.149.115.12
> > Subnet Mask: 255.255.255.0
> > Defaut Gateway: 192.149.115.121
> > DNS Servers: 192.149.115.12
> >                     192.149.115.71
> > Wins Servers: 192.149.115.12
> >                      192.149.115.71
> >
> > Working Wkst
> > Host Name: computer1
> > Primary DNS Suffix: company.org
> > Node Type: Hybrid
> > IP Routing Enabled: No
> > Wins Proxy Enabled: No
> > DNS Suffix Search List: company.org
> >                                  company.org
> > Ethernet Adapter 1
> > Connection-specific DNS Suffix: company.org
> > Description: Intel 82566DM-2
> > Physical Address: AA-BB-CC-DD-EE-FF
> > IP Address: 192.149.115.216
> > Subnet Mask: 255.255.255.0
> > Defaut Gateway: 192.149.115.121
> > DNS Servers: 192.149.115.12
> >                     192.149.115.71
> > Wins Servers: 192.149.115.12
> >                      192.149.115.71
> >
> >
> > Broken Wkst
> > Host Name: computer2
> > Primary DNS Suffix: company.org
> > Node Type: Hybrid
> > IP Routing Enabled: No
> > Wins Proxy Enabled: No
> > DNS Suffix Search List: company.org
> >                                  company.org
> > Ethernet Adapter 1
> > Connection-specific DNS Suffix: company.org
> > Description: Broadcom NetXtreme 57xx
> > Physical Address: AA-BB-CC-DD-EE-FF
> > IP Address: 192.149.115.127
> > Subnet Mask: 255.255.255.0
> > Defaut Gateway: 192.149.115.121
> > DNS Servers: 192.149.115.12
> >                     192.149.115.71
> > Wins Servers: 192.149.115.12
> >                      192.149.115.71
> >
>
>
> Hello Goob,
>
> Thank you for posting this info. I think it would have been much easier on
> you if you simply copied and pasted from the command prompt to your reply.
>
> First, for any WINS server, it must only point to itself, and no other WINS
> server. This is because of the way WINS registers itself as a WINS server
> and self -registers. So please make sure this is changed accordingly on both
> DCs.
>
> Second, DC2 is multihomed, but worse, there are multiple interfaces on the
> same subnet, and additionally, RRAS is installed.
>
> May I ask it's role and function for having more than one NIC and RRAS,
> especially why multple IPs on the same subnet?
>
> Multihomed DCs are not recommended, and highly advised to either team the
> NICs or disable all but one, as well as move RRAS to a non-domain
> controller. Multihomed DCs are a major cause of AD problems, as you;ve
> encountered.
>
> However, if you feel you should need to keep the DC multihomed, I would
> suggest to alter it's default functionality so to make it work for you.
> Please read the following as to why it is problematic, and how to change the
> default settings on a domain controller to force it to work with multiple
> interfaces. There aer also links to Microsoft and other sites that you can
> read up that provide additional explanations.
>
> Let me know what you think and how you would like to proceed.
>
> ======================================================================================================
> Multihomed DCs, DNS, RRAS servers.
> By Ace Fekay, MCSE, MCT
> First published: January, 2003, revised accordingly
> ==============================================
>
> Multihomed DCs WILL cause numerous issues. It's highly recommended to single
> home all DCs and use a non-DC for the multihoming purposes. If it is the
> internet gateway, it is recommended to purchase an inexpensive, or cable/DLS
> router, or even better, a Cisco or similar firewall to perform the task,
> which if it is compromised by an internet attacker remotely, can further
> compromise the rest of the internal network.
>
> Also if attempting to use ICS on a DC, this further complicates matters with
> DC functionality, and cannot be fixed with the following steps outlined in
> this article.
>
> To explain why will require a little background on AD and DNS:
>
> First, just to get this out of the way, if you have your ISP's DNS addresses
> in your IP configuration (DCs and clients), they need to be REMOVED. If the
> ISP's DNS is in there, this will cause additional problems. I usually see
> errors (GPOs not working, can't find the domain, RPC issues, etc), when the
> ISP's DNS servers are listed on a client, DCs and/or member servers, or with
> multihomed DCs. If you have an ISP's (or some other outside DNS server or
> even using your router as a DNS server) DNS addresses in your IP
> configuration (all DCs, member servers and clients), they need to be REMOVED
> and ONLY use the internal DNS server(s). This can be very problematic.
>
> Basically, AD requires DNS. DNS stores AD's resource and service locations
> in the form of SRV records, hence how everything that is part of the domain
> will find resources in the domain. If the ISP's DNS is configured in the any
> of the internal AD member machines' IP properties, (including all client
> machines and DCs), the machines will be asking the ISP's DNS 'where is the
> domain controller for my domain?", whenever it needs to perform a function,
> (such as a logon request, replication request, querying and applying GPOs,
> etc). Unfortunately, the ISP's DNS does not have that info and they reply
> with an "I dunno know", and things just fail. Unfortunately, the ISP's (or
> your router as a DNS server) DNS doesn't have information or records about
> your internal private AD domain, and they shouldn't have that sort of
> information.
>
> Also, AD registers certain records in DNS in the form of SRV records that
> signify AD's resource and service locations. When there are multiple NICs,
> each NIC registers. IF a client, or another DC queries DNS for this DC, it
> may get the wrong record. One factor controlling this is Round Robin. If a
> DC or client on another subnet that the DC is not configured on queries for
> it, Round Robin will kick in offering one or the other. If the wrong one
> gets offered, it may not have a route to it. On the other hand, Subnetmask
> Priortization will ensure a querying client will get an IP that corresponds
> to the subnet it's on, which will work. To insure everything works, stick
> with one NIC.
>
> Since this DC is multi-homed, it requires additional configuration to
> prevent the public interface addresses from being registered in DNS. This
> creates a problem for internal clients locating AD to authenticate and find
> other services and resources such as the Global Catalog, file sharing  and
> the SYSVOL DFS share and can cause GPO errors with Userenv 1000 events to be
> logged, authenticating to shares and printers, logging on takes forever,
> among numerous other issues.
>
> But if you like, there are some registry changes to eliminate the
> registration of the external NIC or simply use the internal networking
> routing to allow access. Here's the whole list of manual steps to follow.
>
> Another problem is the DC now becomes part of two Sites. This is another
> issue that can be problematic.
>
> But believe me, it's much easier to just get a separate NAT device or
> multihome a non-DC then having to alter the DC. If the both NICs are
> internal, I would suggest to pick a subnet, team the NICs and allow your
> internal routers handle the traffic between subnets - Good luck!
>
> 1. Insure that all the NICS only point to your internal DNS server(s) only
> and none others, such as your ISP’s DNS servers’ IP addresses.
>
> 2. In Network & Dialup properties, Advanced Menu item, Advanced Settings,
> move the internal NIC (the network that AD is on) to the top of the binding
> order (top of the list).
>
> 3. Disable the ability for the outer NIC to register. The procedure, as
> mentioned, involves identifying the outer NIC’s GUID number. This link will
> show you how:
> 246804 - How to Enable-Disable Windows 2000 Dynamic DNS Registrations (per
> NIC too):
> http://support.microsoft.com/?id=246804
>
> 4. Disable NetBIOS on the outside NIC. That is performed by choosing to
> disable NetBIOS in IP Properties, Advanced, and you will find that under the
> “WINS” tab. You may want to look at step #3 in the article to show you how
> to disable NetBIOS on the RRAS interfaces if this is a RRAS server.
> 296379 - How to Disable NetBIOS on an Incoming Remote Access Interface
> [Registry Entry]:
> http://support.microsoft.com/?id=296379
>
> Note: A standard Windows service, called the “Browser service”, provides the
> list of machines, workgroup and domain names that you see in “My Network
> Places” (or the legacy term “Network Neighborhood”). The Browser service
> relies on the NetBIOS service. One major requirement of NetBIOS service is a
> machine can only have one name to one IP address. It’s sort of a
> fingerprint. You can’t have two brothers named Darrell. A multihomed machine
> will cause duplicate name errors on itself because Windows sees itself with
> the same name in the Browse List (My Network Places), but with different
> IPs. You can only have one, hence the error generated.
>
> 5. Disable the “File and Print Service” and disable the “MS Client Service”
> on the outer NIC. That is done in NIC properties by unchecking the
> respective service under the general properties page. If you need these
> services on the outside NIC (which is unlikely), which allow other machines
> to connect to your machine for accessing resource on your machine (shared
> folders, printers, etc.), then you will probably need to keep them enabled.
>
> 6. Uncheck “Register this connection” under IP properties, Advanced
> settings, “DNS” tab.
>
> 7. Delete the outer NIC IP address, disable Netlogon registration, and
> manually create the required records
>
>      a. In DNS under the zone name, (your DNS domain name), delete the outer
> NIC’s IP references for the “LdapIpAddress”.  If this is a GC, you will need
> to delete the GC IP record as well (the “GcIpAddress”). To do that, in the
> DNS console, under the zone name, you will see the _msdcs folder.
>
> Under that, you will see the _gc folder. To the right, you will see the IP
> address referencing the GC address. That is called the GcIpAddress. Delete
> the IP addresses referencing the outer NIC.
>           i. To stop these two records from registering that information,
> use the steps provided in the links below:
> Private Network Interfaces on a Domain Controller Are Registered in DNS
> http://support.microsoft.com/?id=295328
>
>           ii. The one section of the article that disables these records is
> done with this registry entry:
>
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
> (Create this Multi-String Value under it):
> Registry value: DnsAvoidRegisterRecords
> Data type: REG_MULTI_SZ
> Values: LdapIpAddress
>             GcIpAddress
>
> iii. Here is more information on these and other Netlogon Service records:
> Restrict the DNS SRV resource records updated by the Netlogon service
> [including GC]:
> http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/proddocs/standard/sag_dns_pro_no_rr_in_ad.asp
>
>      b. Then you will need to manually create these two records in DNS with
> the IP addresses that you need for the DC. To create the LdapIpAddress,
> create a new host under the domain, but leave the “hostname” field blank,
> and provide the internal IP of the DC, which results in a record that looks
> like:
> (same as parent) A 192.168.5.200   (192.168.5.200 is used for illustrative
> purposes)
>
>           i. You need to also manually create the GcIpAddress as well, if
> this is a GC. That would be under the _msdcs._gc SRV record under the zone.
> It is created in the same fashion as the LdapIpAddress mentioned above.
>
> 8. In the DNS console, right click the server name, choose properties, then
> under the “Interfaces” tab, force it only to listen to the internal NIC’s IP
> address, and not the IP address of the outer NIC.
>
> 9. Since this is also a DNS server, the IPs from all NICs will register,
> even if you tell it not to in the NIC properties. See this to show you how
> to stop that behavior (this procedure is for Windows 2000, but will also
> work for Windows 2003):
> 275554 - The Host's A Record Is Registered in DNS After You Choose Not to
> Register the Connection's Address:
> http://support.microsoft.com/?id=275554

"Goob" <G***@discussions.microsoft.com> wrote in message
news:2EBA8A21-FCA1-4BFF-BEFF-49D96418A8DC@microsoft.com...
>I have reconfigured the WINS as suggested - Done
> As for DC2 (the elder of 3) - it was inherited.  I personally did DC1.
> We are getting rid of DC3 because of age and performance.
>
> The 2nd NIC on DC2 is disabled; however the box is used for VPN purposes.
> I am not sure why it was configured this way, I only know that this DC
> (DC2)
> has gone through 3 in-place upgrades.
> NT 4 to Win2K to now Win2K3.
>
> And I absolutely do not understand the two IP's on the the single NIC.
> I didn't want to fix it because I don't know where/how that IP plays into
> other network services/apps somewhere I don't know about.
>
> My End goal is to:
>     1. demote DC3 - decommision it. (it not only was a DC but some
> installed Exchange on it - we have move it already)
>     2. Have a Clean new DC1 (pretty much in place)
>     3. build a new DC2 - then demote/decommision old DC2
>
> I have scripted to all the Clients to reconfigure thier DNS/Wins to DC1
> and
> DC2.
> So no wkst now have DC3 in its configs.
>
> I suspect that the in-place upgrade did not necessary go well.
> I notice just stupid odd/ins that just seem flaky.  Not that I am an
> expert
> (I do have my MCITP);
> But I feel the 1st and 2nd generation did not have much windows
> experience;
> they were more unix folks.
>
> I am in the process of doing some serious AD Clean up as well.
>
> Any other suggestion would definitely be helpfu.

> Facts:
> Win2K3 Domain - about 70 Users
> Approx. 5 Users have this issue.  All Clients are XP Pro either SP2
> or SP3 All Mapped Drives are done on the Client Side (Except Home
> Folder) - All Working
> Home Folder is Created/Permissioned using ADUC/Profile
>
> I have some users that Periodically received a "Access Denied" when
> attempting to open thier Home Folder (H:). This does not happen all
> the time.
>
> More know facts:
> When this happens to these users:
> - I am able to attempt to open the folder 50 times and NOT lock the
> user account
> - I am able to use the UNC path to open the Home Folder with no
> problem
> - On one individual that I am working with, She did NOT have this
> issue before replacing her pc.  I had replaced her pc for performance
> reasons and it started with the new pc (Dell Optiplex)
> - On one other individual, she has had this issue since she started
> working here (new employee) - MPC Laptop
>
> I am leaning toward an issue with the Domain Account, because if I
> manuall map the drive from the client - this does not happen; however
> at the same time, all users are created equally.  So why these few
> people are having this issue.
>
> On another note (not sure if it is related) - I have a few Users that
> when they do open thier Home Folder, its opened at the "Share" and
> not thier personal folder.  Again this doesn't happen all the time.
>
> Any thoughts?