Win can't determine user or computer name...do what?

[coffeedogz]

We're getting this error (event id 1000) logged every 5 minutes. It happened in the middle of the night when no one was logged in while the backup was running. Any ideas? It shut the backup down 3 consecutive nights before we got a clean backup last night.

Microsoft says install SP 4, but I'm not so sure.

 

[snootalope]

ha.. the ticket I read said "Break the computer from the domain and rejoin it" yeah, ok, on a frickin domain controller.. I've been looking for a solution for this for the past 2 months..

I have sp4 installed and it is STILL doing it.. I've been through so much crap trying to get rid of it, but everynight its the same thing..

snooter

"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me

 

[CPTjdc]

I ran into the same sort of problems when I didn't have my DNS configured properly.(

http://support.microsoft.com/default.aspx?scid=kb;en-us;261007)

With all of the research you guys have done, I'm sure you know this already, but it fixed my problem...

You have to ensure that your domain controller that is running DNS points to itself as the primary DNS server and uses forwarders when resolving addresses outside of your domain. All of your servers/workstations should point to that same internal DNS to ensure proper name resolution within the domain.

If your server or workstations have external DNS's configured as their primary DNS you will tend to see these errors.

Hope that helps ;-)

 

[snootalope]

yeah, seen that one.. dns is fine here..

here's mine though:

Windows cannot determine the user or computer name. Return value (1359)

??? - sucks, i'll keep huntin though..
snooter

"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me

 

[coffeedogz]

I'm thinking it might be a virus launching a DOS attack. About 10 of our users have the W32.Mimmail.A@mm. NAV caught it on most machines and deleted it or quanrantined it. But I'm going to use their removal tool to try to undo the damage on the workstations. SP4 also apparently has the patch to fix the vulnerability the worm targets.

Anyway, that's my fun plans for this evening. I'll let you know if this fixes it.

 

[snootalope]

I just finished doing a complete virus scan on all of my servers.. it's not a virus..

 

[coffeedogz]

It's not an internal virus. It's an Internet attack. Go to syamntec.com to read about it. There's several patches, plus some ports to close on the firewall. We've been good for 36 hours.

BTW, sp4 install went off without a hitch.

 

[snootalope]

Do you have a link to that??

 

[snootalope]

I can't find it!!! AAAHHHHHH 8-(

 

[coffeedogz]

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

I believe this is the one attacking us. We closed the FTP port and a TCP port, don't remember which one. Installed SP4, plus some patches...not sure where we downloaded those from, though.

Good luck.

 

[snootalope]

Thanks Coffeedogz, but that is definitly not our case here..

Still getting the same thing every night in the early A.M. hours:

Windows cannot determine the user or computer name. Return value (1359)

There's got to be a solution to this out there somewhere!!!



"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me

 

[LoJACK]

snootalope,

what is your DNS configuration? maybe you've missed something.. I've done that before.