Re: WinXP computer not authenicating properly on Win2k Domain Controller

From: Cary Shultz [A.D. MVP] (cwshultz_at_mvps.org)
Date: 04/30/04 

Date: Fri, 30 Apr 2004 07:32:56 -0400

Ken,

I am sure that you have a good reason for adding a regular domain user
account object to those very powerful Domain groups. Generally speaking I
would advise against that and not want to be responsible for an environment
where this was the case.

I might look at the IP Address information ( via typing ipconfig /all at a
command prompt ) and make sure that the DNS information is correct.

After you added that particular domain user account object to the Domain
Admins and Enterprise Admins groups did you log off and then back on? Do
those two particular groups have both share and NTFS permissions to folders
( I am assuming - always a dangerous thing - that you are talking about
access to shared network folders on, for example, the File Server )?

Are you sure that when you logged in that you were logging into the domain
and not the local computer? I have seen this many many times. The 'log on
to...' box has to be the NetBIOS domain name, not that specific computer
name! But I am sure that you checked this.

As far as the GPO, if the DNS information is not correct then it is possible
that the GPO would not apply. What exactly were you setting in the GPO that
is not applying? There are a couple of tools that you could use ( gpresult
is one of them ). Have you rebooted the computer and then logged back on?
With WINXP it is possible that you would have to either reboot or log off /
log on a couple of times before the GPO is applied.

Is this the only user that is not getting the GPO?

Do you have a logon script? Is this user receiving the mapped network
drives from the logon script? If not, then you might be logging on locally
( or the WIN XP situation is happening ).

HTH,

Cary

"plunck" <atrainphoto@yahoo.com> wrote in message
news:1b85c51e.0404291401.5dbb6beb@posting.google.com...
> Hi everybody. OK, this may be a dumb question, but I am baffled. I
> have a windows xp client computer that has been upgraded from win2k.
> It used to log in to a WinNT4 domain. Recently I moved it to my win2k
> active directory domain. Now when I logon to that computer, my
> permissions are all messed up. Meaning, I have created a new user on
> the win2k domain controller, and added that user to the Administrators
> group. When I log on to that computer as that user, and log on to my
> new win2k domain, I am not granted Administrator-level rights. I can't
> browse to certain system folders, I can't change IP settings, etc. I
> have even tried adding that user to Domain and Enterprise Admins
> groups to no avail. Further, when I apply a group policy to the OU
> that user is in, that policy is not applied to the user. It's almost
> as if that user is being authenticated and granted permissions locally
> on that machine instead of from the domain controller, even thought
> the machine is supposedly logging on to the domain. Has anybody seen
> this or have any ideas? Thanks, Ken

Relevant Pages

  • Re: Disabling a GPO logon Script
    ... exactly you have defined your current logon script, in which GPO, ... What loopback processing does is that it takes the User ... the Terminal Server), in stead of the normal processing (taking the ...
    (microsoft.public.windows.terminal_services)
  • Re: DNS Problem????
    ... but i have a problem: most computers have windows 2000 ... Either create a new GPO or edit the GPO that is linked to where your ... Do an Ipconfig /all to check DNS suffix has taken effect ... The log on script is triggered from the ad propertie logon script. ...
    (microsoft.public.windows.server.active_directory)
  • Re: LogOff Script
    ... Enable loopback processing in a GPO ... >then associate the logon script with that loopback GPO. ... >> My batch file will do this, however I do not want the ...
    (microsoft.public.windows.group_policy)
  • Re: Printer Script by OU 2008 TS
    ... Choose edit TSPolicy, ... Double-click "Scripts Policy processing", select Enabled, make sure the ... a new GPO, only enable the above policy and add the printer logon script. ...
    (microsoft.public.windows.group_policy)
  • Re: .MSI Software Installation
    ... First of all you do not deploy software via GPO to groups. ... And the user account object or the computer account object must ... you can control this by way of the Security Group Filtering ... Users' is given the READ and APPLY GROUP POLICY rights. ...
    (microsoft.public.win2000.active_directory)