Windows 2k domain doesn't have an account in the domain

[jlong515]

I manage a Windows 2K domain with AD, and just in the past week the few (3) windows NT4 workstations are failing to login with the error, "computer doesn't have an account in this domain or the password is incorrect". The rest of the machines are Win 2K Pro and have no problems logging in. The servers/workstations are fully patched. Removing and re-adding the NT4 workstations to the domain does not resolve the problem. Any suggestions or help with this matter would be appreciated. Thanks in advance.



JLong

 

[jlong515]

The exact error message I am receiving on the NT4 workstations is...

"The system cannot log you on to this domain because the system's computer account in it's primary domain is missing or the password on that account is incorrect"

Again, removing and re-adding these computers has not resolved the issue. Thanks for any assistance anyone can provide.

JLong

 

[andrew2000]

I have the same problem and haven't solved it yet.

Drew

 

[bgallant]

Read the Microsoft Knowledge Base Article 32785 having to do with MaxTokenSize. This has solved many similiar problems for us. But of course we are not dealing with WinNT4 PCs. You probably have to make the registry hack on the Win2k domain server. Just a thought.

 

[Heavy4Metal]

After running the latest hotfixes (long list as usual!), the NT 4.0 machines on the SBS 2000 network couldn't connect. We tried heaps of things like uninstalling the hotfixes, restoring a previous System State ...

The last things tried before a reboot was, and that worked was either:

1. Open the [Properties] for the local network adapter on the server. Select the [Authentication] tab and uncheck the [Enable network access control using IEEE 802.1X] ...

or:

2. Patch the registry per a problem resolution in the Microsoft KDB in respect of NT 4.0 BDC authentication via LSA on a Windows 2000 PDC as follows:

1. Start Registry Editor (Regedt32.exe).

2. Locate the RestrictAnonymous value under the following key in the registry:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\restrictanonymous

3. On the Edit menu, click DWORD, type 0 in the data field, and then click OK.

4. Quit Registry Editor.

Restart the Windows 2000 domain controller.

** I checked some other server installations, and the value was usually 0 (one of them had 0x1).

If this works for you, please let me know, especially if you are able to try "one at a time" ...