NT BDCs and clients cannot browse to Server 2003

[Donal Rogers_1]

Hi all,
I have a problem on one of my customer sites. I installed a nice new ProLiant in December running Windows Server 2003. This server acts as their DC, DHCP, WINS and DNS server (also running Exchange 2003). It replaced an NT4 PDC, and there are several NT4 BDCs still on the network. One of the BDCs is on a remote site with a different subnet. The clients are running Windows 98, 2000 and XP.

The problem is that none of the clients can browse to the DC and vice versa. They cannot log on or authenticate. Pinging can be done in all directions with no problem, and all Outlook clients can receive their mail from this server. I believe that it is a DNS problem. If I remove the DNS server role and then reinstall it, will that solve the problem? Is this even the problem?

I am going back on-site today to further examine the situation. Can anyone help me?

Regards,
Donal.

[Patrick Ruane_1]

Donal

Have you got wins server and DNS server running on the on-site BDC? If not, my first step would be to do this. How are the clients on this subnet being assigned IP address, wins and DNS settings? If they're being assigned dynamically, try setting one up with a static ip address and specify the PDC as your WINS and DNS server.

You could also try modifying the hosts file on a Win2k client, go to C:\winnt\system32\drivers\etc\hosts and put an entry in there to point to the PDC.

Hope that gives you some ideas, good luck.

Patrick.

[Donal Rogers_1]

Patrick,
Thanks for replying. The DHCP server is largely redundant, as almost all clients have static IP addresses. When I connected my Linux laptop to the network, however, I received a dynamic IP address, so I know the DHCP server is working.

The WINS and DNS servers are not running on the BDCs, as the single remaining BDC on this site is a 90MHz Pentium PC which is currently in its last month or so of use and a new ProLiant is already on-site to replace it. I don't want to over-stretch the limited resources available to this machine. The only other BDC on the network is in the remote site, and this is not running DNS or WINS either. Currently, all BDCs are NT4, and there is, AFAIK, no built-in DNS server on NT4.

I have just finished testing a Windows 98 PC. Both the hosts and lmhosts files do nothing. If I only have TCP/IP installed on the PC, I can see no machines in Network Neighborhood. If I install NetBEUI, I see every machine except the DC, as obviously I can't install NetBEUI on Server 2003. The DNS is successfully resolving client requests for external websites, because there is no other DNS listed in the Network Properties.

Hmmm... the plot thickens...!

[Patrick Ruane_1]

Bear in mind that Win98 won't use DNS for name resolution, so you will have to have the wins settings correct for name resolution. Make sure the client settings are pointing to the PDC as the wins server and then put a static mapping in wins for the PDC itself. Also, check under wins on the PDC to see if enable netbios is ticked (i think this is the same in 2003 as it is in 2000).

HTH

[Jon Finley]

The other approach you can take is to have on of the BDS's at the site also as a WINS server. The WINS servers can be set to replicate at convieniant times (other than the initial transfer of WINS information at setup) to minimize bandwidth usage. The workstations can't authenticate due to the lack of a local netbios (WINS) server.

For some reason, MS does authtication through the netbios friendly name, which is fine when you're on the same subnet, or if you allow WINS information to be broadcast through routers, but if not, then you either have to setup WINS proxies in each subnet, or WINS servers in each.

Jon

[Patrick Ruane_1]

sorry, forgot to mention, if it's not already set up, Wins forwarding can be set up on your routers. Check the router manufacturer's web site on how to set up forwarding on port 135 (think it's 135 for wins).

HTH

Patrick.

[Rune J. Winje]

Have you checked that the PDC emulator role is available at the Windows Server 2003?
-> i.e. that noone has upgraded the domain to Windows Server 2003 functional level...

Also check trust between BDC machines and domain (NLTEST).



Cheers,
Rune

[Donal Rogers_1]

OK guys, we have a solution, but what a solution it is!

I brought a friend of mine in on a colsultancy basis to help me solve this problem. None of the suggestions made here worked. After a full day of trying various options, we placed a support call with Microsoft in the UK at 5:00. The support guy told us to gather various information using a MS Support tool and send it to him via e-mail. This was done just before 6:00, when the UK support office closed for the evening. He suggested that if time was an issue, we should contact Microsoft in the US (we are in Ireland). After approx. 2.5 hours, the Microsoft guys had produced little in the way of a solution, but between us all, this is what we found.

The new server has three network cards: one onboard and a dual-headed Gigabit NIC. Each of these cards were initially given a different IP address by me, and everything seemed to be working OK. On my last visit there, I decided to team two of the cards, and I think this is where the problems started. Once I had disabled two of the NICs, and left the server using just one card and one IP address, all the clients could see the DC and the BDCs were able to sync.

I have to say, however, that this issue is documented NOWHERE that I have found. I never heard of it, my friend never heard of it, Microsoft never heard of it, but I certainly won't make the same mistake again!

Thank you to all who contributed suggestions to help me. If you find yourselves in a similar situation where you are installing a 2003 machine, don't do what I did!

Regards,
Donal.

[Patrick Ruane_1 · Accepted solution]

Good old microsoft. I've got a problem with Security settings not being applied via group policy and can I find any documentation? Can I hell. No forums have been of any use, I haven't resorted to calling their extortionate phone lines yet, but may well do soon as everything else i've tried has fallen flat. Still, if all microsoft software worked perfectly we'd all be out of work.

Patrick.

[Donal Rogers_1]

Patrick,
You've probably already thought of it, but my number 1 technical resource is Google Groups. Have you checked there?

Incidentally, as I discovered yesterday, the cost of a support call to MS UK is about EUR 330. The cost if I ring the US is approx EUR 230. Hmmm...

Donal.

[Jon Finley]

Where WAS a known issue with multiple NIC's and MS loosing it's mind as to where to send the packets.

If I can find it again, I'll send it your way.

Jon

[Jon Finley]

Here's one article:

http://support.microsoft.com/default.aspx?scid=kb;en-us;157025&Product=win2000

Jon