user rights problem

[hanumanth]

when i am adding the domain user into the adminstrator group of windows 2000 pro system i am getting error.
how i did is i logged in as a local syst admin and went to user/group and selected group and in admin group i pressed add there i see local syst and domain when i clicked for domain it prompted for domain admin ..i have given and selected the user from the users and added then its giveing error ...like...

processing of object ....(username) failed with the fallowing error: the specified domain does not exist or could not be contacted.

and i am not able to browse the domain group again ....i restarted and tried again ..but still not working....

plz suggest me to how to solve this problem or suggest me how to assign admin rights to the user( of domain with normal rights) to a perticular machine.i have to assign the syst to soft persons so that they can be adminster their system instead of entire network.....

i tried this with the other systems it worked ..but in only 2 systems it dint work ..(these syst are not fresh installed ones.. using from longtime and did like this previously)
and also i think the os(2000pro ) i have is not the original one....my company dint buy any os...so i brought from my friend.
and if u want any details i can tell u
(-:

thanks in advance

 

[snootalope]

**i logged in as a local syst admin **

Why not login as a domain admin.. the problem is, your logging into the LOCAL machine.. stress LOCAL ?? uh-huh.. log into the domain and there'll be no worries..

"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me

 

[hanumanth]

even i checked with logged in as a domain admin also ..still the same problem...
i dont see any wrong in i did at first bcz even i logged in as a local admin when i select for the domain it will ask for the authentication so anyhow i have to domain admin or eq power user id .... finally its the same result....i dont know if any diff of both.
but i did this many machines and worked too.i dont know why it is not working on those machnes only.....is it any registry changes should i make.....

 

[gt6350a]

log in as the domain admin on the SERVER. add user there. then go to computer u are trying to use and make sure u are on the domain. all should be well. piece of cake.

 

[Andreh]

You should be able to create a Terminal Server connection on your Win2k Pro box in "Remote Administration" mode to your Win2k DC. You may need to install Terminal Services on the server. This will allow this to be done remotely.

The work will need to be done in the Active Directory Users and Computers under the admin tools in control panel on the Server as the domain administrator.

Cheers.

 

[hanumanth]

hey andreh

you are totally deviated from the problem ...
i want to give the system to a noraml domain user with admin rights for that system only..not the entire domain.

so when i am adding that user in that particular system admin group i am getting this problem...

i logged in as a domain admin to that system and went to local machine admin group and fron ther i browsed the required user and when i pressed add i am getting that error
..so for temporarly i added that user in domain admin group and selected him to log on to that machine only...so that he cannot use that login any other system...
but is it possible to implement this active directory only..
like that user should be admin to a single system and should be user to the domain...?????
plz help me

 

[Andreh]

Log on to that box as the Domain Administrator. Right click "My Computer" and select "Manage". Within this select "Local Users and Computers".

In Local users and computers, add the standard user on the domain to the local "Administrators" by double clicking the "group" folder, then the "Administrators" group.

In the probelties of the Administrators group, select the "Add" button at the bottom to allow you to add the user you want. The "Look in:" focus should be on your domain name and not the local machine. Once this is changed you should be able to find the domain user you want to be a member of the administrators groups on the local PC by scrolling down. double click the user you want and then the OK button.

Cheers.

 

[Andreh]

Sorry hanumanth, just had a bad case of RTFM

Try the below article.

http://support.microsoft.com/?kbid=283133

This night help with your problem.

Also, check that the PC you are on can be pinged ("ping xxx.xxx.xxx.xxx" using it's IP and host name) from another PC. It may be that this PC doesn't have a host entry in the forward lookup zone on the DNS server. If you can't do this simple operation as the Domain Administrator, then it is a connection problem.

Cheers.

 

[hanumanth]

thanks for reply andreh
but i will allways check those before posting .. i felt it is a complecated one ..but everybody is thinking in normal way and giving simple answers.

1)i configured DHCP so the 2000pro syst is getting ip. that means the connection is ok
2)i am able to ping with ip and with name also so there is no problem with dns.(means already system is in domain)
3)i am able to login with any domain user.. so there is problem with the system account with PDC.

i did the samething before also andreh.till that ok but only when pressed the add button i am getting this error.

i am getting this problem for 2 machines not for the other systems(its not the fresh installed ones ..) and even those too systems i applied sp3 also.. still no change

 

[softwareguy]

Have you found a solution to this problem? I am finding the exact same problem. Even more interesting is that, I can choose the domain user from the list & get the error when I hit OK. If I hit cancel then try and add the domain user again. This time the listbox is grayed out and I can only choose from the local domain. I have seen this problem on 3 of our machines with no ryme or reason.....

 

[gt6350a]

The fix to this problm is that you must disable MS2000's communication with MS access server. This is done on the W2k client and I forgot the exact details but it is a radio button that need to be clikcd saying 'disble'.

What is happening is that the W2K client is sending security informaiton (Authentication) to the NT server but the NT server does not have active directory so it records this information as a loggin when in fact it is just a tranmital of information.