XP connection issues with Server 2008 Domain

[rider90]

We installed a new Windows Server 2008 R2 Server last year, and changed the Domain level to 2008. Since then we have been having various issues which only affect XP machines. All Windows 7 computers are absolutely fine.



The problems:

1.) Computers when first logged into in the morning are unremarkable slow and un-responisive. When you finally get to click restart, an error message appears "You do not have administrative privileges to shut down this computer"

2.) The computer will not be able to connect to some servers. A log in box will appear but the user, nor the administrator can successfully log in.

3.) The user cannot print every morning. The print spooler reports to be started and running problem free, and no error messages appear other then the printer icon in the taskbar with a red question mark. To resolve this, you need to restart the print spooler and then click refresh on the print. This then solves the problem for the rest of the day.



These are the error's we are getting on the computers event logs:

Event Type: Warning

Event Source: LSASRV

Event Category: SPNEGO (Negotiator)

Event ID: 40960

Date: 15/02/2011

Time: 09:04:36

User: N/A

Computer: PC-07

Description:

The Security System detected an attempted downgrade attack for server cifs/server. The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request.

(0xc000005e)".





Event Type: Warning

Event Source: LSASRV

Event Category: SPNEGO (Negotiator)

Event ID: 40961

Date: 15/02/2011

Time: 09:04:30

User: N/A

Computer: PC-07

Description:

The Security System could not establish a secured connection with the server cifs/sql. No authentication protocol was available.



For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

This problem also doesn't affect every XP machine, and seems to follow users. Computers which have this issues have been rebuilt which resolved the problem, but within a few months the problem has come back and been persistant since. We have also tried swapping computers and even components, so I think this could be user related.



I am totally lost, and our local IT Support company are struggling with this.



Any ideas or suggestions would be greatly appriciated, as I have tried and read so many different forums and hotfixes.



Cheers,

Matt

 

[hairlessupportmonkey]

I would start with

1) Remove machine from domain - re-add.
2) Delete / rename the server profile for user and re-create from local
3) Delete / rename local profile for user and re-create from server

4) ensure all machines are on same software level (i.e windows updates / service packs.
5) remove offending machines from domain and rebuild workstations and create new profiles, and migrate users to new profile.

Some Event ID help here:

http://www.eventid.net/display.asp?eventid=40960&eventno=8508&source=LSASRV&phase=1

http://www.eventid.net/display.asp?eventid=40961&eventno=1398&source=LsaSrv&phase=1

ACSS - SME
General Geek

 

[goombawaho]

What about something simple like - are the workstations pointing at the 2008 server (via IP address) for their DNS?

 

[rider90]

Hi guys,

These computers have already been removed from the domain, deleted from the Server, rebuilt, and re-added. This was fine for around a month before the issues begun again. In some cases I have given the computer a different name, to see if the Server was somehow remembering it, and these problems still occurred.

All computers are controlled by DHCP and therefore all their IP Addresses are pointing to the correct Server. An IP Config confirms this.

Our WSUS server controls the computer versions and they are also all currently on the same version, SP3. At the moment they are awaiting a shutdown to install Office 2007 SP3, IE8 compatibility list and a security update.

Local Profiles have been deleted with no change.

The one thing I haven't yet tried is removing the user from the Server entirely, deleting their Exchange account, and then re-creating them from scratch. I have resisted doing this as I'm worried that I will loss data or E-Mails etc in the process.

 

[hairlessupportmonkey]

just back the emails up with outlook (create PST file) then re-import them once the new profile is created.

ACSS - SME
General Geek

 

[rider90]

I know it is simple, just over cautious.

Ok more information. These errors started to occur when we changed from a Domain 2003 Server to a new server with 2008 and changed the Domain level. This all happened before I started to how this was done I don't know.

The users which have been effected all this long could be due to corruption during the change, except within the past month, a couple more users who have never had the problem before have also started to experience these issues.
So if we look away from it being User profile corruption, what else should I be looking into? The IT guy at the time doesn't think it is User Profile corruption, although he hasn't said much more then that.

 

[hairlessupportmonkey]

have you had a good dig around DNS and ADIEDIT to make sure there are no dodgy entries in there?



ACSS - SME
General Geek

 

[rider90]

We have had a real good look around DNS, and done a lot of Googleing on it. A few changes have been made, although this hasn't made any difference.

Again I will look into DNS further.

Its a tough one!

 

[rider90]

Ben YES! In the research I have done this is something I have come across several times but have so far failed to resolve.

With all the different articles I find which could be related to the problems we are having, this is one which has been playing on my mind for a while so I'm glad you have mentioned it.

I will try out the suggestions in the link you have provided and let you know.

Thanks,
Matt

 

[rider90]

Have added the registry value, will have to wait now until Monday/Tuesday to see if the people who's computers I have set this on still receive the issue.

Thanks again,
Matt

 

[rider90]

It didn't appear to work.
O
n Monday it continued to affect 3 out of the 4 computers I added this registry value to.
It only affected 2 out of 4 on Tuesday, but that is the difficult nature of this problem in that one week it could be affecting several computers and then suddenly its fine again.

 

[hairlessupportmonkey]

there is something in the doamin / AD / DNS that is broken

You might be better opening a ticket with MS

DO you have a TechNet account? You get 2 free tickets!

ACSS - SME
General Geek

 

[BadBigBen]

perhaps this is the ticket:

W2K8 R2 AD Upgrade Tip: NTLM Changes

http://www.windowsitpro.com/blog/ac.../8-w2k8-r2-ad-upgrade-tip-ntlm-changes-137269

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[rider90]

Sorry taken so long to reply.

I have slowly gone through the various suggestions and left each one for a few days to see if it makes a difference. It did start to look promising but then the error started to hit hard again.

I have added the Registry key to downgrade XP machines from using 128bit encryption. No Luck. I've had a look around the DNS and nothing is obviously not working.
I haven't opened a Ticket with Microsoft yet.

Matt