Can't connect to 2k3 server from mac osx smb client

I have a fresh install of Windows Server 2003. I've loaded
WINS, DNS, Active Directory and File Sharing on it. I
created a file share and gave read-write permissions to
Domain Users. I created a user account in Active
Directory. I can connect to the server and file share
using the user account from a Windows ME client and a
Windows NT 4 workstation.

I try to connect to the server from a Macintosh running OS
X 10.2.8 (using finder go connect to server and using the
smb protocol)using the same user account and I get
a "can't connect to server (error -5000)" error. The
console displays two messages saying "Permission Denied".
When I look at Event Viewer on the Windows Server I see a
540 Successful login event followed immediately by a 538
Logout event for that user.

And here is something a little odd - I created a file
share on the Windows NT 4 workstation, gave it full
control to group Everyone. I can connect to that share
from the Mac using the Active Directory user account.

I don't have AppleTalk active on the Mac, and I don't have
Services for Macintosh loaded on the Server - I don't want
to if I don't have to.

I get the same results from 2 different Macs running OS X.

The Macs were able to connect to network services (file
shares) on a previous Windows NT 4 Server. (The NT server
and network were removed, and this Windows Server 2003 is
a fresh install - not an upgrade/migration.)

Anyone have any suggestions?

Update: In my frustration I removed the 4 server roles
(AD, WINS, DNS and File Sharing), and then re-installed
just File Sharing. I created a share and now I can
connect from the mac to the server and access the file
share.

What is it in Active Directory that would prevent the Mac
from accessing the server if it works in the Workgroup?

TIA

>-----Original Message-----
>I have a fresh install of Windows Server 2003. I've
loaded
>WINS, DNS, Active Directory and File Sharing on it. I
>created a file share and gave read-write permissions to
>Domain Users. I created a user account in Active
>Directory. I can connect to the server and file share
>using the user account from a Windows ME client and a
>Windows NT 4 workstation.
>
>I try to connect to the server from a Macintosh running
OS
>X 10.2.8 (using finder go connect to server and using
the
>smb protocol)using the same user account and I get
>a "can't connect to server (error -5000)" error. The
>console displays two messages saying "Permission
Denied".
>When I look at Event Viewer on the Windows Server I see
a
>540 Successful login event followed immediately by a 538
>Logout event for that user.
>
>And here is something a little odd - I created a file
>share on the Windows NT 4 workstation, gave it full
>control to group Everyone. I can connect to that share
>from the Mac using the Active Directory user account.
>
>I don't have AppleTalk active on the Mac, and I don't
have
>Services for Macintosh loaded on the Server - I don't
want
>to if I don't have to.
>
>I get the same results from 2 different Macs running OS
X.
>
>The Macs were able to connect to network services (file
>shares) on a previous Windows NT 4 Server. (The NT
server
>and network were removed, and this Windows Server 2003
is
>a fresh install - not an upgrade/migration.)
>
>Anyone have any suggestions?
>.
>

Found the answer - I'll post it in case anyone else is
interested. On the Win 2K3 domain controller start Control
Panels -> Administrative Tools -> Domain Controller
Security Policy. From there go to Security Settings ->
Local Policies -> Security Options -> Microsoft Network
Server: Digitally Sign Communications (Always) to
disabled. It is enabled by default. It seems you can leave
the other Digitally Sign Communications entry enabled.

Set at your own risk - I'm not sure what security
implications the above change will have.

>-----Original Message-----
>I have a fresh install of Windows Server 2003. I've
loaded
>WINS, DNS, Active Directory and File Sharing on it. I
>created a file share and gave read-write permissions to
>Domain Users. I created a user account in Active
>Directory. I can connect to the server and file share
>using the user account from a Windows ME client and a
>Windows NT 4 workstation.
>
>I try to connect to the server from a Macintosh running
OS
>X 10.2.8 (using finder go connect to server and using the
>smb protocol)using the same user account and I get
>a "can't connect to server (error -5000)" error. The
>console displays two messages saying "Permission Denied".
>When I look at Event Viewer on the Windows Server I see a
>540 Successful login event followed immediately by a 538
>Logout event for that user.
>
>And here is something a little odd - I created a file
>share on the Windows NT 4 workstation, gave it full
>control to group Everyone. I can connect to that share
>from the Mac using the Active Directory user account.
>
>I don't have AppleTalk active on the Mac, and I don't
have
>Services for Macintosh loaded on the Server - I don't
want
>to if I don't have to.
>
>I get the same results from 2 different Macs running OS X.
>
>The Macs were able to connect to network services (file
>shares) on a previous Windows NT 4 Server. (The NT server
>and network were removed, and this Windows Server 2003 is
>a fresh install - not an upgrade/migration.)
>
>Anyone have any suggestions?
>.
>