Getting kerberos error when trying to explore client PC

[graemec]

Hello people

A friend has asked me if I could resolve a problem he has with
his small office network.

He has a server running Windows 2003 Small Business Server and two clients PC's using XP.

He has a fax program on one of the clients that he used to route his information from the server from to the client as the server does not have a built in modem.

It used to work fine but after installing updates approx 8 months, he has to print out reports and fax them manually.

I have logged into the server remotelty and noticed in the event log he is getting lots of kerberos errors: the message being:
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server ACER-WS1$. The target name used was cifs/Acer-ws1. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (*******), and the client realm. Please contact your system administrator.

Also when I try and explore the client from the server in Micorsoft networks I get the error.

\\Acer-ws1 is not accessible. You might not have permission to use this network resource.Contact the administrator of this server to find out if you have permission.

Logon failure: The target account name is incorrect.

I am logged in as administrator and I can ping the client by name and ip.
I have looked into kerberos online and understand it is an authentication service, but I am not too sure where to look to find the names that are held within the kerberos service.

Any help wouldbe greatly apprieciated.

Graeme

 

[ShackDaddy]

Two things you might try:

1) Make sure that the time zone on the workstation is set to the exact same one as on the server, and that the DST settings are the same. Kerberos can fail when times are not in sync.

2) Next, you might try removing the workstation from the domain, rebooting. Then rename the workstation to something different, reboot. Then add the computer to the domain again (using the new name) and reboot. See if the problems persist. Doing what I described should resolve the general Kerberos issue above if there is anything weird about the SID/name of the computer in the AD that is creating the problem.

Dave Shackelford
Shackelford Consulting

 

[graemec]

Hi ShackDaddy

Thanks for the tips, on the option of the removing/renaming workstation where you say about rebooting after renaming and rebooting then adding the newly named workstation to the domain then rebooting. Do you mean rebooting the workstation or the server?

Thank you again for your advice.

Graeme

 

[ShackDaddy]

The WORKSTATION!

Ha ha.

Dave Shackelford
Shackelford Consulting

 

[graemec]

Thank you for the quick reply ShackDaddy

One final question, sorry to be nuisance

Is it just a case of renaming and re-adding the newly named workstation to the domain. Will I have to alter the static IP that is currently set up on the workstation or will it be OK using the current IP if so will their be any conflict with the old named workstation or will this be OK as long as it removed from the domain?

Thanks Graeme

 

[ShackDaddy]

Using the same IP is fine. Worst case scenario, it conflicts with a name registered in WINS (if you are using WINS) or with a dynamic name in DNS, but neither should be much of an issue, even if that happens.

Dave Shackelford
Shackelford Consulting

 

[graemec]

hello again

I checked the time everything ok. So I tried option two:
Heres where it went wrong firstly I removed the computer from the domain, reboot, renamed, rebooted now it will not let me log on to windows with the username......
any ideas how I can resolve this please without having to reinstall windows xp.
Thanks again for your help.

 

[ShackDaddy]

You have to know the local administrator password to successfully go through this process. If you don't know the local admin password, there are several tools that you can use to get it.

http://www.lostpassword.com/windows.htm?utm_source=petri&utm_medium=banner&utm_content=v1

http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html

Hopefully you still have it though.

Dave Shackelford
Shackelford Consulting

 

[graemec]

Hi Shackdaddy

I didnt have the local admin, but the

http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html

worked a treat.

I did still have some problems rejoining to the domain though.
The only way it would join was by adding a new computer object in AD. And deleting the old object I now think this may have been a big mistake....the computer is showing up in the domain in Microsoft networks on the server and the initial problem of the fax not connecting has been resolved.
But know the local machine cannot connect to the domain.

When trying to use the network id wizard on the xp client I get the following message...
The domain name FLEXICON might be a NetBIOS domain name. If this is the case, verify that the domain name is properly registered with WINS.

If you are certain that the name is not a NetBIOS domain name, then the following information can help you troubleshoot your DNS configuration.

The following error occurred when DNS was queried for the service location (SRV) resource record used to locate a domain controller for domain FLEXICON:

The error was: "DNS name does not exist."
(error code 0x0000232B RCODE_NAME_ERROR)

The query was for the SRV record for _ldap._tcp.dc._msdcs.FLEXICON

Common causes of this error include the following:

- The DNS SRV record is not registered in DNS.

- One or more of the following zones do not include delegation to its child zone:

FLEXICON
. (the root zone)

I have checked the DNS on the server and I am 80% certain that prior to adding the new computer the DNS had no root folder is it this that is causing the problem.

Thanks Graeme

 

[ShackDaddy]

Both the client and the server should be pointing at the SBS server's internal IP for DNS, and not to ANYWHERE else. The only place you would configure your ISP's DNS servers is in the DNS Admin tool on the server, where you would populate your server's Forwarding tab with the ISP's DNS server IPs.

When you open up DNS Admin on the server you should see two forward lookup zones, one for your internal domain name, and then a subdomain. If the subdomain is missing, you have problems.

My guess is that the client isn't pointed to the server exclusively for DNS.

Dave Shackelford
Shackelford Consulting