Re: Kerberos Query

Tech-Archive recommends: Fix windows errors by optimizing your registry

Thanks Paul, that registry change worked perfectly.

Much appreciated!

--
-JohnH


"Paul Bergson [MVP-DS]" wrote:

I would go into dns and validate both forward and reverse names for both
machines are gone as well as any alias'.

Then go to the new machine and from a command prompt key in

ipconfig /registerdns


Plus to create an alias on the machine edit:
HKEY_Local_Machine\System\CurrentControlSet\Services\LanmanServer\Parameters
Add Value: OptionalNames
REG_SZ String: "Alias"

If you make it a REG_MULTI_SZ, you can then create multiple aliases

Also use DNS and alias the machine name back to the new name

I doubt you have duplicate spn's but here is a bit of additional info to
help out:
http://msmvps.com/blogs/vandooren/archive/2008/03/11/getting-rid-of-the-duplicate-spn-in-active-directory.aspx

Kerberos troubleshooting
http://www.microsoft.com/technet/solutionaccelerators/cits/interopmigration/unix/usecdirw/17wsdsu.mspx


--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

"JohnH" <JohnH@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:DFC0330A-BE4E-42D7-A8F4-B134E4699DB0@xxxxxxxxxxxxxxxx
Hi everyone,

I've managed to cause myself a bit of a problem with Kerberos that I'm not
100% sure how to diagnose... I've got two web servers, we'll say server1
(Win2k web server) and server2 (win2k3 web server - indended to replace
server1 hardware, which is now eol).

The plan was to migrate server1 to server 2, but keep the same IP address
due to a unknown number of badly-coded applications referencing the server
by
IP. So we built server2 on another IP address and copied all the websites
and data over. The final plan was to remove server1 from the domain and
shut
it down, then change the address of server2 to the desired IP address (and
create an alias for server1 in DNS to direct all traffic to server2).

Due to a mistake by myself I ended up having the two web servers on the
network at the same time with the same address - which was stupid I know.
The result of this was that all web traffic is fine to the new server, but
if
I try to connect to a fileshare using \\server1\share, it now shows an
error
about a duplicate name on the network. If you do this from server1
itself,
it actually shows a Windows authentication prompt, but no credentials work
and you end up with an access denied error.

Initally I was getting a KRB_AP_ERR_MODIFIED error logged in the eventlog.
Since then I've removed server2 from the domain, made sure all computer
accounts, DNS entries and WINS entries are all removed for both server1
and
server2, then re-added server2 to the domain but I still get the same
error
dialog windows, but no eventlog errors.

I'm now a bit lost as to where to troubleshoot next - any help would be
much
appreciated. Thanks.

--
-JohnH



.

Relevant Pages

  • Re: Kerberos Query
    ... I would go into dns and validate both forward and reverse names for both ... Plus to create an alias on the machine edit: ... we'll say server1 ... Due to a mistake by myself I ended up having the two web servers on the ...
    (microsoft.public.windows.server.active_directory)
  • Re: Kerberos Query
    ... MVP - Directory Services ... This posting is provided "AS IS" with no warranties, ... Plus to create an alias on the machine edit: ... server1 hardware, which is now eol). ...
    (microsoft.public.windows.server.active_directory)
  • Re: Alias a linked server
    ... if you write server1.database1.dbo.table1, server1 does not have to be ... the name of the database must be the same on both machines. ... I could just update the alias so that stored ... > update the alias on server2, and any stored proc that referenced the alias ...
    (microsoft.public.sqlserver.programming)
  • Re: Inbound Messages
    ... If the Exchange 2003 has joined the same site and you can see the Exchange ... 2003 server from the Exchange 5.5 Admin, ... Please do not send email directly to this alias. ... > is directed to Server1. ...
    (microsoft.public.exchange.setup)
  • Re: Kerberos Query
    ... we'll say server1 ... Due to a mistake by myself I ended up having the two web servers on the network at the same time with the same address - which was stupid I know. ... It's as if the share is being accessed with the 'old name' causing the kerberos KDC to encrypt the service ticket with the 'old password'. ... Have you considered enabling Kerberos event logging? ...
    (microsoft.public.windows.server.active_directory)