|
|
A year ago I set up server S1 as the company's new Active Directory/Exchange
Server (Windows 2003 x64 R2 , Exchange Server 2007 sp1). Later in the year I
set up another server named S2, also running Windows 2003 R2 x64. It's
primary function was to run the network backup software. I decided to add S2
as another domain controller, so I would have a backup one. I also installed
the certificate server service on it for a project I later worked on.
Some time later, I decided to demote S2 as a domain controller. S2 continued
to be used for running the office Network Backup software. All worked well.
The other week I tried to get S2 running as a print server and couldn't get
it to work. I could install the service on the box, but whenever I went to
another workstation and tried to install a shared printer residing on S2,
I'd be required to log into S2 using an account local to S2. As a test I set
up a shared folder on S2, and this too I couldn't access.
So, I decided to start from scratch. Formatted S2's hard drive and
reinstalled Windows 2003 R2 x64. Configured it as both a file server and a
print server.
When I now go to a regular user's workstation, open Windows Explorer, enter
\\S2 as the device to look for, I get \\S2 is not accessible. You might not
have permission to use this network resource... {snip}... Logon Failure: The
target account name is incorrect. If I, as the domain admin, try it at a
computer I'm logged into, Windows Explorer will display the available shared
resources. I'm still required to provide a login account if I want to access
a shared printer.
At this point I figured that it had to be something to do with AD
remembering something about permissions for the old system, so I once again
promoted S2 to a domain controller. No change.
Did some googling. Verified that DNS is ok. There are no duplicate SPN's for
server S2,
Any suggestions as to where else to look in AD to see why it thinks that
this server S2 is inaccessible?
|
|
A follow-up to my original post.
If I go to a regular users workstation and, say, run the command "net view
\\S2" I get an error. However, if I use S2's IP address, namely 10.10.10.2,
I can access the server just fine. This also works in Windows Explorer.
An NSLOOKUP on S2 and S2.mydomain.com returns the correct IP address.
So, why can I "see" a server's shared resources if I specify said server's
IP address, but not if I use the servers name(s).
Thoughts?
"Phillip Armitage" <armitagep[ at ]wzmh.com> wrote in message
news:%23%23qe2pIaJHA.1184[ at ]TK2MSFTNGP05.phx.gbl...
[Quoted Text] >A year ago I set up server S1 as the company's new Active
>Directory/Exchange Server (Windows 2003 x64 R2 , Exchange Server 2007 sp1).
>Later in the year I set up another server named S2, also running Windows
>2003 R2 x64. It's primary function was to run the network backup software.
>I decided to add S2 as another domain controller, so I would have a backup
>one. I also installed the certificate server service on it for a project I
>later worked on.
>
> Some time later, I decided to demote S2 as a domain controller. S2
> continued to be used for running the office Network Backup software. All
> worked well.
>
> The other week I tried to get S2 running as a print server and couldn't
> get it to work. I could install the service on the box, but whenever I
> went to another workstation and tried to install a shared printer residing
> on S2, I'd be required to log into S2 using an account local to S2. As a
> test I set up a shared folder on S2, and this too I couldn't access.
>
> So, I decided to start from scratch. Formatted S2's hard drive and
> reinstalled Windows 2003 R2 x64. Configured it as both a file server and a
> print server.
>
> When I now go to a regular user's workstation, open Windows Explorer,
> enter \\S2 as the device to look for, I get \\S2 is not accessible. You
> might not have permission to use this network resource... {snip}... Logon
> Failure: The target account name is incorrect. If I, as the domain admin,
> try it at a computer I'm logged into, Windows Explorer will display the
> available shared resources. I'm still required to provide a login account
> if I want to access a shared printer.
>
> At this point I figured that it had to be something to do with AD
> remembering something about permissions for the old system, so I once
> again promoted S2 to a domain controller. No change.
>
> Did some googling. Verified that DNS is ok. There are no duplicate SPN's
> for server S2,
>
> Any suggestions as to where else to look in AD to see why it thinks that
> this server S2 is inaccessible?
>
|
|
In news:eOFXO%23IaJHA.5340[ at ]TK2MSFTNGP05.phx.gbl,
Phillip Armitage <armitagep[ at ]wzmh.com> requesting assistance, typed the
following:
[Quoted Text] > A follow-up to my original post.
>
> If I go to a regular users workstation and, say, run the command "net
> view \\S2" I get an error. However, if I use S2's IP address, namely
> 10.10.10.2, I can access the server just fine. This also works in
> Windows Explorer.
> An NSLOOKUP on S2 and S2.mydomain.com returns the correct IP address.
>
> So, why can I "see" a server's shared resources if I specify said
> server's IP address, but not if I use the servers name(s).
>
> Thoughts?
I agree with Meinolf that it's possibly a DNS issue, which an ipconfig /all
of S2 will assist us to diagnose it. If you can also provide an ipconfig
/all of S1, that will also be helpful to compare. Is the Windows Firewall
enabled? Any other 3rd party security tools installed?
Curious, you said Cert services were on S2, yet you demoted it without
problems. Did you properly remove cert services from AD?
--
Ace
This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.
Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
Microsoft Certified Trainer
For urgent issues, you may want to contact Microsoft PSS directly.
Please check http://support.microsoft.com for regional support phone
numbers.
|
|
|