New users can't logon to the domain

[Bruno_A]

Hello, guys, basically, I am studying IT at college and we have two domains here, which are the college machines domain and the ICTLab domain. I was made an administrator and had to create users for each of my class mates in the active directory. The problem is that the new users can't login to the ICTLab domain, I am actually the only student who can because I got admin previleges. If I go on gpedit, I am not actually able to edit "allow users to log on locally" and I am actually not allowed to, but still, that shouldn't fix it because that is messing with the main comain. I think ICTLab is just a subdomain. Can anyone help me with this, I'm not great with all this domains thing? Let me know if you need more info. Also, do any of you guys know any good books or online training websites I could check out about this?

 

Many thanks, Bruno.

 

Here folows a few screenshots:

Spoiler

 

[Sir Asvald]

1 minute ago, bruny06 said:

Hello, guys, basically, I am studying IT at college and we have two domains here, which are the college machines domain and the ICTLab domain. I was made an administrator and had to create users for each of my class mates in the active directory. The problem is that the new users can't login to the ICTLab domain, I am actually the only student who can because I got admin previleges. If I go on gpedit, I am not actually able to edit "allow users to log on locally" and I am actually not allowed to, but still, that shouldn't fix it because that is messing with the main comain. I think ICTLab is just a subdomain. Can anyone help me with this, I'm not great with all this domains thing? Let me know if you need more info. Also, do any of you guys know any good books or online training websites I could check out about this?

 

Many thanks, Bruno.

 

Here folows a few screenshots:

  Reveal hidden contents

 

What happens when they try to login? What message comes up? Also, try adding the PCs to the subdomain.

 

 

[Bruno_A]

Just now, Abdul201588 said:

What happens when they try to login? What message comes up? Also, try adding the PCs to the subdomain.

 

 

Thanks for your reply. What you actually mean with "adding the PC's to the subdomain? The PC's were created in the subdomain active directory, which is ictlab.int. As for the error message, here it is: 

Spoiler

 

[Sir Asvald]

Just now, bruny06 said:

Thanks for your reply. What you actually mean with "adding the PC's to the subdomain? The PC's were created in the subdomain active directory, which is ictlab.int. As for the error message, here it is: 

  Reveal hidden contents

 

I see, How are you logging in?

 

Have you tried these 2 methods ictlab.int\user? or username@ictlab.int

 

 

[Bruno_A]

Just now, Abdul201588 said:

I see, How are you logging in?

 

Have you tried these 2 methods ictlab.int\user? or username@ictlab.int

 

 

I'm logged in because I have admin previleges, as you can see in the printscreens I uploaded. This is quite complicated. I'll try those methods and let you know in a second.

[Sir Asvald]

Just now, bruny06 said:

I'm logged in because I have admin previleges, as you can see in the printscreens I uploaded. This is quite complicated. I'll try those methods and let you know in a second.

Btw, you created an OU or (Organisational Unit) You need to give permissions for the OU to login. For a test, go to the users folder create a standard account and try to log into the domain.  

 

 

[Bruno_A]

4 minutes ago, Abdul201588 said:

Btw, you created an OU or (Organisational Unit) You need to give permissions for the OU to login. For a test, go to the users folder create a standard account and try to log into the domain.  

 

 

Okay, I just tried those two methods and neither worked. As for the OU account, I just tried that and didn't work.

Spoiler

 

[Bruno_A]

@Abdul201588 When I'm creating the users, I tick the option "change password on next login" and when I first login, it recognizes and lets me change the password, but then doesn't login and gives me that error message.

 

[Sir Asvald]

2 minutes ago, bruny06 said:

@Abdul201588 When I'm creating the users, I tick the option "change password on next login" and when I first login, it recognizes and lets me change the password, but then doesn't login and gives me that error message.

 

This is odd, remove the PC from the domain and add it back.

[Bruno_A]

3 minutes ago, Abdul201588 said:

This is odd, remove the PC from the domain and add it back.

That won't do it because I actually can log in on those PC's with my account.  What do I do?

[Sir Asvald]

3 minutes ago, bruny06 said:

That won't do it because I actually can log in on those PC's with my account.  What do I do?

Well, there is some permissions issue. Go to the PC, right click and click on "member of" and add the OU and see if it'll work.

 

EDIT: I saw the picture of the test user you added, there is a folder called USERS on the bottom. you've created an OU with the same name. Move the Admins and users into there and try.

[Bruno_A]

1 minute ago, Abdul201588 said:

Well, there is some permissions. Go to the PC, right click and click on "member of" and add the OU and see if it'll work

I think that's already done. 

Spoiler

 

[Sir Asvald]

Just now, bruny06 said:

I think that's already done. 

  Reveal hidden contents

 

That's the user settings, go to the Computer and add the OU.

[Bruno_A]

Just now, Abdul201588 said:

That's the user settings, go to the Computer and add the OU.

How exactely? I'm not sure I'm getting you. 

[Sir Asvald]

4 minutes ago, bruny06 said:

How exactely? I'm not sure I'm getting you. 

Go to Active directory, then computers folder, locate the PC that is not letting you login. Right click it and then go to "member of"

[Bruno_A]

5 minutes ago, Abdul201588 said:

Go to Active directory, then computers folder, locate the PC that is not letting you login. Right click it and then go to "member of"

The "Computers" folder is empty.

[Sir Asvald]

Just now, bruny06 said:

The "Computers" folder is empty.

Okay, that's causing the issues, the PC is not on the domain...

[Bruno_A]

@Abdul201588 

Spoiler

 

[Bruno_A]

Just now, Abdul201588 said:

Okay, that's causing the issues, the PC is not on the domain...

We're in a classroom, and the PC I'm using is definitely on the domain. And the other ones are too because I can log on to them  

[Bruno_A]

@Abdul201588

UPDATE: I just made 0000TestU (my test user) an admin, so, he is in the same groups as me, and I can't log in in that account, giving me the same log on error as above.

[Sir Asvald]

9 minutes ago, bruny06 said:

We're in a classroom, and the PC I'm using is definitely on the domain. And the other ones are too because I can log on to them  

Are you sure you're on the correct domain? Go to control panel, then go to system and check the domain settings.

[Bruno_A]

6 minutes ago, Abdul201588 said:

Are you sure you're on the correct domain? Go to control panel, then go to system and check the domain settings.

Well, the PC I'm using right now is, and no one can log in here that doesn't have Admin Previleges. Also, I just found out, you have to be a member of "Domain Admins" to log on.

[chiller15]

On the computer you cannot log in with...have you confirmed that the computer is a member of the correct domain? You can check by launching System Properties (Windows Key + Print Screen).

 

If it is on the correct domain, check that the computer account is appearing in Active Directory. You can do this by loading Active Directory and right clicking the domain name in the left pane. Select 'Find'. Change the drop down menu for 'Find' from 'Users, Contacts, and Groups' and change it to the option that reads: 'Computers'. Now type some or all of the computer name and press 'Find Now' or use the Enter/Return key.

 

If it did appear, right click the machine name and select 'Properties' and then select the 'Objects' tab. That will show you exactly where the computer account is located in Active Directory. If it is located in the wrong place, cancel out of the properties box and right click the machine name again. Select 'Move' and then browse to the location is ought to be in and press 'OK'. If there are machine-based GPO's applying to the OU it is being moved into, then you'll need to reboot the machine for them to take effect.

 

If nothing appears in the results, then the computer account has been deleted from Active Directory and you will need to drop the machine from the domain by joining it to a workgroup (you can type anything in here, it doesn't have to be an existing workgroup). Then reboot the machine and manually add the machine back to the domain. Reboot again and then the computer account should appear in the 'Computers' OU.

[Bruno_A]

1 hour ago, chiller15 said:

On the computer you cannot log in with...have you confirmed that the computer is a member of the correct domain? You can check by launching System Properties (Windows Key + Print Screen).

 

If it is on the correct domain, check that the computer account is appearing in Active Directory. You can do this by loading Active Directory and right clicking the domain name in the left pane. Select 'Find'. Change the drop down menu for 'Find' from 'Users, Contacts, and Groups' and change it to the option that reads: 'Computers'. Now type some or all of the computer name and press 'Find Now' or use the Enter/Return key.

 

If it did appear, right click the machine name and select 'Properties' and then select the 'Objects' tab. That will show you exactly where the computer account is located in Active Directory. If it is located in the wrong place, cancel out of the properties box and right click the machine name again. Select 'Move' and then browse to the location is ought to be in and press 'OK'. If there are machine-based GPO's applying to the OU it is being moved into, then you'll need to reboot the machine for them to take effect.

 

If nothing appears in the results, then the computer account has been deleted from Active Directory and you will need to drop the machine from the domain by joining it to a workgroup (you can type anything in here, it doesn't have to be an existing workgroup). Then reboot the machine and manually add the machine back to the domain. Reboot again and then the computer account should appear in the 'Computers' OU.

Thanks a lot for your reply. I'll try that on Monday as I finished my day already. This has been a pain in the ass, but at least it's a challenge.

[dalekphalm]

It definitely sounds like the computers are not joined to the correct Domain. They are probably joined to the School's primary domain, not the Lab domain. As everyone above me mentioned, go to System Properties and verify which domain the computer is connected to.

 

Generally speaking, a single computer can only be joined to a single domain. The only way around that is to setup a Trust Relationship between the two domains. You can create a one-way trust (Domain User A can log into both Domain A and Domain B, but Domain User B can only log into Domain B), or a two-way trust (Domain Users of either domain can log into both).