Problem with Active Directory

[mkessler9]

Ok, so just for my own use case and purposes I have decided to setup Active directory on my Dell 2950 server. I have setup my main computer up with the domain server. Once I added my computer to the domain I restarted the computer and added a new user in active directory(on the server) just to make sure everything was working...  When it booted back up it gave me the choice to sign into the account that's on the SSD or sign into a account that I have on the server. When I put in my credentials for the user account I had created and clicked sign in it gave me this error "The security database on the server does not have a computer account for this workstation trust relationship." I'm thinking this just means that when I added the computer to the domain that it did not create a account for that computer in active directory on the server. But I'm not positive that that's it.

 

I haven't been able to find anything online to help me, so anyone know what the problem is? Have I not set something up that needs to be setup?

 

Thanks.

[Altecice]

This is what happens when the computer or server is moved to a new location/IP changes:

To fix it you need to remove your computer from the domain and rejoin it. 

[mkessler9]

This is what happens when the computer or server is moved to a new location/IP changes:

To fix it you need to remove your computer from the domain and rejoin it. 

Well as far as that goes neither of the computers IP address changed as both have a static IP. Unless when I joined that computer to the domain it changed. But I'll try it when I get home. 

[Vitalius]

@mkessler9

I work on these things at my job (which I'm at right now). We have had this issue before. You need to go to the Active Directory on the DC (Domain Controller) >  Users and Computers > Computers > Then make sure the computer account exists. The computer account will be named whatever your computer name is (the [name]-PC in Windows when you first install the OS and make the first user). You can check the computer name by pressing Windows + E then clicking System Properties in the top left corner (or on the ribbon bar if you are using Windows 8).

If the account is there, then you need to make sure you are signing into the computer with your domain account (we use Domain/User for example).

 

If both of those things are good, then we get to the more specific issues beyond simple things. First check these two things though.

 

This is what happens when the computer or server is moved to a new location/IP changes:

To fix it you need to remove your computer from the domain and rejoin it. 

That's not the issue. I mean, that causes this issue, but it's not the reason if he didn't move the computer, which it seems like he didn't. Other things can cause this problem.

[Altecice]

That's not the issue. I mean, that causes this issue, but it's not the reason if he didn't move the computer, which it seems like he didn't. Other things can cause this problem.

 

Hmm what else can cause it? (interested) currently learning this in college so any info would be useful 

I guess what i said and perhaps if any of the PC names changes?

[mkessler9]

@mkessler9

I work on these things at my job (which I'm at right now). We have had this issue before. You need to go to the Active Directory on the DC (Domain Controller) >  Users and Computers > Computers > Then make sure the computer account exists. The computer account will be named whatever your computer name is (the [name]-PC in Windows when you first install the computer). You can check the computer name by pressing Windows + E then clicking System Properties in the top left corner (or on the ribbon bar if you are using Windows 8).

If the account is there, then you need to make sure you are signing into the computer with your domain account (we use Domain/User for example).

 

If both of those things are good, then we get to the more specific issues beyond simple things. First check these two things though.

 

That's not the issue. I mean, that causes this issue, but it's not the reason if he didn't move the computer, which it seems like he didn't. Other things can cause this problem.

Ok thanks, I should be home within the hour and I'll check them then.

[Vitalius]

Hmm what else can cause it? (interested) currently learning this in college so any info would be useful 

I guess what i said and perhaps if any of the PC names changes?

Well, a lot can. Good example, we have 3 DC's at my workplace. We used snapshots (because they are all VM's) to restored DC3 back to an older version to fix a major issue. This was before we knew you were never supposed to use snapshots to backup DC's. Ever. It breaks synchronization when you do this and causes the DC that was reverted back to fall out of trust with the domain meaning it basically can't connect anymore because the Primary DC (DC1 in this case) doesn't trust it. 

After reverting DC3 to an older version using snapshots, we then logged into DC3 to make sure things were fixed. It gave us this exact same error. Which is kind of crazy considering it's a DC (i.e. it is the server). Admittedly, it wasn't the primary DC, so it makes sense, but at the same time, it wouldn't if you didn't realize that. 

But that's why the only "Microsoft recommended" way to backup a DC is through Windows Server Backup. Because that accounts for what happens to event synchronization between DC's when you have to jump one back to an older state. 

The actual base reasoning for the issue "The security database on the server does not have a computer account for this workstation trust relationship." is that the server doesn't trust the workstation. Meaning it won't let it log on because it isn't allowed in the Domain. It's a security feature really. 

The list of things that could cause this that I know of off the top of my head are such:

• The security database is corrupt (i.e. the account can't be found by the server to let the computer on)
• The computer can't contact the domain. (i.e. networking issue though it's rare it says this rather than "This computer can't contact the domain." or something similar.)
• The computer was moved (as you said) meaning the server views it as a different computer (new IP and such).
• The two machines are having issues with kerberos (Microsoft used authentication protocol).

And so on. Basically anything that interferes with the computer authenticating with the server. Whether server or workstation side.

[Altecice]

Well, a lot can. Good example, we have 3 DC's at my workplace. We used snapshots (because they are all VM's) to restored DC3 back to an older version to fix a major issue. This was before we knew you were never supposed to use snapshots to backup DC's. Ever. It breaks synchronization when you do this and causes the DC that was reverted back to fall out of trust with the domain meaning it basically can't connect anymore because the Primary DC (DC1 in this case) doesn't trust it. 

After reverting DC3 to an older version using snapshots, we then logged into DC3 to make sure things were fixed. It gave us this exact same error. Which is kind of crazy considering it's a DC (i.e. it is the server). Admittedly, it wasn't the primary DC, so it makes sense, but at the same time, it wouldn't if you didn't realize that. 

But that's why the only "Microsoft recommended" way to backup a DC is through Windows Server Backup. Because that accounts for what happens to event synchronization between DC's when you have to jump one back to an older state. 

The actual base reasoning for the issue "The security database on the server does not have a computer account for this workstation trust relationship." is that the server doesn't trust the workstation. Meaning it won't let it log on because it isn't allowed in the Domain. It's a security feature really. 

The list of things that could cause this that I know of off the top of my head are such:

• The security database is corrupt (i.e. the account can't be found by the server to let the computer on)
• The computer can't contact the domain. (i.e. networking issue though it's rare it says this rather than "This computer can't contact the domain." or something similar.)
• The computer was moved (as you said) meaning the server views it as a different computer (new IP and such).
• The two machines are having issues with kerberos (Microsoft used authentication protocol).

And so on. Basically anything that interferes with the computer authenticating with the server. Whether server or workstation side.

 

Thanks

 

I am currently learning this stuff but I am in my first year, So we have only skipped over the things like Kerberos for the moment. Is your other two DC's read only? (the main DC being the only one that can be changed). That may explain why when you revert back to a snapshot the server its self does not access or the ability to revert (copy over) the database so it just corrupts? Or perhaps because its changed from the original (main) DC that it wont trust the unauthorised changes?

 

This is just pure guesswork on what I think I understand haha

[Vitalius]

Thanks

 

I am currently learning this stuff but I am in my first year, So we have only skipped over the things like Kerberos for the moment. Is your other two DC's read only? (the main DC being the only one that can be changed). That may explain why when you revert back to a snapshot the server its self does not access or the ability to revert (copy over) the database so it just corrupts? Or perhaps because its changed from the original (main) DC that it wont trust the unauthorised changes?

 

This is just pure guesswork on what I think I understand haha

You're welcome. 

Cool. That's not how ours are set up. That's not what causes the problem when using snapshots. 

Lol, I figured. It's close, but not exactly right (it is a guess afterall). 

The problem is that when you have multiple DC's in a Domain, they label each event (a change in the system) with an Event ID. A new user being created is an event. A password change is an event. Pretty much anything where a configuration change occurs for the Domain is an event. If the Event ID isn't identical between DC's, they fall out of trust with one another (meaning they stop trusting each other). 

Using a snapshot literally is like a time machine for a DC, so it's current Event ID changes as well. So say I have 3 DC's. Whether they are read-only or not is kind of irrelevant to this. DCs 1-3 are all on Event ID 4096. That's the last event that occurred in the Domain that all DC's recognize. If you jump DC3 back using a snapshot, it's current Event ID will be whatever it was when the snapshot was taken. Say, 2567. 

So, when DC1 (primary DC) tries to authenticate then replicate it's current setup to DC3, it will see that it's already done that once, and that DC3 should be current, but isn't. From DC1's perspective, that means DC3 isn't DC3 and shouldn't be trusted. Windows Server Backups somehow preserves the DC's ability to authenticate while still allowing it to be restored. Not sure how, but it does. Snapshots don't. 

I figure Windows Server Backup verifies to DC1 that DC3 really is DC3 and is trustable via some flag that says "Hey, I just restored from this backup at this time, and I am definitely DC3."

[mkessler9]

@mkessler9

I work on these things at my job (which I'm at right now). We have had this issue before. You need to go to the Active Directory on the DC (Domain Controller) >  Users and Computers > Computers > Then make sure the computer account exists. The computer account will be named whatever your computer name is (the [name]-PC in Windows when you first install the OS and make the first user). You can check the computer name by pressing Windows + E then clicking System Properties in the top left corner (or on the ribbon bar if you are using Windows 8).

If the account is there, then you need to make sure you are signing into the computer with your domain account (we use Domain/User for example).

 

If both of those things are good, then we get to the more specific issues beyond simple things. First check these two things though.

 

That's not the issue. I mean, that causes this issue, but it's not the reason if he didn't move the computer, which it seems like he didn't. Other things can cause this problem.

Ok so this is weird. I took the computer off the domain and put it in a workgroup and now I'm trying to add it back to the domain but it can't find it. Nothings changed server side. And I have a static ip along with the dns set to the server. But when I go to add me to a member it won't work (I had this issue before but yesterday I did something to make it work but I don't know what I did to do it)

 

Oh btw the domain I'm trying to add me to is called- domain.net which is what it says on server side

[Vitalius]

Ok so this is weird. I took the computer off the domain and put it in a workgroup and now I'm trying to add it back to the domain but it can't find it. Nothings changed server side. And I have a static ip along with the dns set to the server. But when I go to add me to a member it won't work (I had this issue before but yesterday I did something to make it work but I don't know what I did to do it)

 

Oh btw the domain I'm trying to add me to is called- domain.net which is what it says on server side

That tells me the issue with the PC was that it couldn't contact the domain, so it couldn't log on. 

Are you typing "domain.net" in the Domain box when trying to add the computer to the domain, or are you typing "domain"? You have to type the full domain according to the server, which would be "domain.net" and not just "domain". 

What all services do you have installed on the server? Obviously it's a Domain Controller, but aside from that? 

I know this is a silly question, but does the Domain Controller have a static IP address? 

Try pinging the DC from the computer through a command prompt using "ping domain.net", then try it with the IP address of the server. If one works while the other doesn't, then it's a DNS issue. If both don't work, it's a network issue. If both work, then it's a server issue.

[mkessler9]

That tells me the issue with the PC was that it couldn't contact the domain, so it couldn't log on. 

Are you typing "domain.net" in the Domain box when trying to add the computer to the domain, or are you typing "domain"? You have to type the full domain according to the server, which would be "domain.net" and not just "domain". 

What all services do you have installed on the server? Obviously it's a Domain Controller, but aside from that? 

I know this is a silly question, but does the Domain Controller have a static IP address? 

Try pinging the DC from the computer through a command prompt using "ping domain.net", then try it with the IP address of the server. If one works while the other doesn't, then it's a DNS issue. If both don't work, it's a network issue. If both work, then it's a server issue.

I'm doing domain.net and I tried pinging both and both work.

[Vitalius]

I'm doing domain.net and I tried pinging both and both work.

Have you tried flushing your DNS? It's this in the command prompt:

ipconfig /flushdns

Then try adding the computer to the domain.

[menendez1293]

Ok so this is weird. I took the computer off the domain and put it in a workgroup and now I'm trying to add it back to the domain but it can't find it. Nothings changed server side. And I have a static ip along with the dns set to the server. But when I go to add me to a member it won't work (I had this issue before but yesterday I did something to make it work but I don't know what I did to do it)

Oh btw the domain I'm trying to add me to is called- domain.net which is what it says on server side

Out of curiosity, what is you schema level? Eg, 2008, 2008R2, 2012, etc...

[mkessler9]

Have you tried flushing your DNS? It's this in the command prompt:

ipconfig /flushdns

Then try adding the computer to the domain.

 

I tried it. Still gets an error when I try to connect to the domain.

 

Out of curiosity, what is you schema level? Eg, 2008, 2008R2, 2012, etc...

I'm using Windows Server 2008 R2

[menendez1293]

I tried it. Still gets an error when I try to connect to the domain.

I'm using Windows Server 2008 R2

Are you using the ADDS server as a name server or are you using your router as the name server?

[mkessler9]

Are you using the ADDS server as a name server or are you using your router as the name server?

I'm using the name from Active Directory?

[menendez1293]

I'm using the name from Active Directory?

Right but what device is translating the names to IP address? By default when installing the ADDS role, a DNS role is installed. If your DC and computer can't talk to each other there might be something going on network side.

Verify that both the DC and computer can talk to each other and their gateways. If a ping times out make sure the firewall is off on the server and try again.

[mkessler9]

Right but what device is translating the names to IP address? By default when installing the ADDS role, a DNS role is installed. If your DC and computer can't talk to each other there might be something going on network side.

Verify that both the DC and computer can talk to each other and their gateways. If a ping times out make sure the firewall is off on the server and try again.

I already said that they can both talk to each other earlier. And yes I'm using the dns role serverside also.

[menendez1293]

I already said that they can both talk to each other earlier. And yes I'm using the dns role serverside also.

Sorry, didn't see that as I'm on my phone. Just to clarify have you tried pinging the computer from the server?

Edit: and is there a record for your PC in DNS?

[mkessler9]

Sorry, didn't see that as I'm on my phone. Just to clarify have you tried pinging the computer from the server? Edit: and is there a record for your PC in DNS?

Yup, I get a reply. 

[menendez1293]

Yup, I get a reply.

Have you tried renaming and then attempting to reintroduce to the domain?

Also when you first joined the PC, what rights did the account you used have?

[mkessler9]

Have you tried renaming and then attempting to reintroduce to the domain?

Also when you first joined the PC, what rights did the account you used have?

I have not tried renaming the domain, but I am restarting the server to see if that does anything. And when I connected to the domain the first time I signed in as an administrator.

[menendez1293]

I have not tried renaming the domain, but I am restarting the server to see if that does anything. And when I connected to the domain the first time I signed in as an administrator.

Sorry, I didn't mean rename the domain, I meant to rename the PC, restart and then try to join.

[legopc]

have you also tried joining the domain by using the ip instead of the the domain name and have you tried setting your primary dns server on your client pc to the ip of your dns server/dc