XP Clients - NT 4.0 Server

[Fred Martin_1]

Our network is primary 95/98/ME clients, with several NT 4.0 file servers (one PDC, others are BDC's). All are together on a domain with authentication for file and print services coming from NT.

Now, add an XP client (we've tried Pro and Home). It forces us to set up users on the local client, which won't authenticate with the domain unless the usernames and passwords match the NT server exactly. This seems like an incredible duplication of effort.

If for example, the administrator on the server changes a user's password, he also has to go around to all clients where that user may log in, to change passwords there.

Am I completely off my rocker here? Can XP be told to behave like 95/98/ME for authentication purposes?

Another quirk, the user name "administrator" seems to be reserved on XP. Well, wouldn't you know, that's the name of our admin account on the NT server. I can't set up an "administrator" account on an XP client that will also authenticate on the NT server.

I would prefer -no- user accounts on the local XP clients, than go through what I'm going through now.

[Jon Finley]

Here's 2 articles that may help:

XP security change:
http://support.microsoft.com/default.aspx?scid=kb;en-us;q318266

NT Servers with SP6a if have XP clients:
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q313384


Jon

[Fred Martin_1]

Jon,

Thanks that's useful info.

Still I am looking for a method to keep us from having to change passwords both on the NT server and on each client, when passwords change.

Fred

[rcmikey · Accepted solution]

Have you properly joined the Windows XP Professional computers to your domain? IE:

click "Start"
right click "My Computer"
select "Properties"
click the "Computer Name" tab
click the "Change" button
click the "Domain" radio button
enter the domain name
click "OK"

It sounds to me like you haven't added the computers to the domain, which is causing you require local accounts. As I recall, there is no way to join Windows XP Home to a domain. Were there any error messages when joining/trying to join?

Of course, I may be "off my rocker" as well... but I sure hope this helps.

A few related Technet articles:

"How to Change a Computer Name or Join a Domain in Windows XP"
http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q295017&

"Cannot Join Windows XP Client to a Windows NT Domain"
http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q314366&

"Troubleshooting Joining Networks"
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/winxppro/reskit/prcf_omn_wbog.asp

[Jon Finley]

The articles allow you to setup XP so that:

1. You can join an NT 4.0 domain.

2. Having joined, then be able to have it behave as any other member workstation (i.e. accounts and authentication only on the PDC.

NT 4.0 MUST have SP6a installed to be able to address an XP workstation.

The XP workstation MUST NOT try to encrypt or sign secure channel data, or it will NOT be able to authenticate with an NT domain.

Have another look at the original articles I mentioned in the first posting.


Jon

[Fred Martin_1]

Thanks Jon,
Fred

[Jon Finley]

hmmmmm maybe Michael is more on track for what you are REALLY asking.

Windows 95,98 and ME cannot be domain members. The users that login to these workstations can themselves be authenticated on an NT domain, but not their workstations.

NT workstation, 2000 pro and XP pro belong to the NT family, and MUST join the NT domain in order for users to be able to authenticate with the domain and have access to domain resources.

Michael gave a good example of how to add the XP workstation to the domain.

There are two ways of adding a workstation to a domain.
1. Have an Admin add the computer account prior to attempting to join the workstation to the domain, or

2. Have the Admin present when you atempt to join the workstation to the domain (it will prompt for and Admin ID and password if the computer account does not already exist).


Jon

[Fred Martin_1]

Ok Michael, we tried to add the XP host to the domain ... we got this:

Domain controller for the domain "DOMAIN" could not be contacted. etc...

Under details there is something about DOMAIN possibly being a NetBios domain, and to verify that the domain name is properly registered with WINS.

We've had this network in place for years, all the NT4 servers are in this domain (yeah the domain is called DOMAIN) no problem.

Is WINS required with XP? Is the domain name DOMAIN in some way invalid for XP?

Still stuck,
Fred

[Jon Finley]

In attempting to join a domain, XP will need to know what the REAL domain name is that the current NT PDC is a part of. i.e. if the domain the NT PDC is hosting is APPLICATORSALES, then that is the name that needs to be entered rather than "DOMAIN".

"DOMAIN" is simply the default domain name that Windows enters (much like the default workgroup is "WORKGROUP".

And yes... XP either wants a WINS server, or at least a Master Browser to establish the secure link to the server when joining the domain.


Jon

[Fred Martin_1]

Our PDC (NT4.0) is set up with the domain as being "DOMAIN" so I'm thinking that should all be OK.

I am not running WINS; I do have a browser service running though. That's what supplies data for "network neighborhood" right? Are there particular protocols required for that to work?