Unable to browse shares on Domain Controller.

I posted this at www.msusenet.com yesterday.

We have recently ran into a problem trying to do some upgrading on our
network. We are running a Win 2003 AD domain with some remaining Win 2K
member servers and mostly Win XP SP2 computers. We have three DC's at our
main site, and one at each of 4 remote sites. Of the three we have at the
main site one is the PDC emulator & GC (no longer a needed role, but helps us
identify who is who), one is a GC, and one is the Infrastructure Master. The
two back-up DC's are also our tape-backup servers. We are in the process of
getting rid of them due to getting a new tape-library solution in. As part
of this we needed to promote two new servers to replace the existing back-ups.

We installed a new server and promoted it to a DC using the "Manage your
server wizard." All seemed well until we tried to browse to a shared folder
on it. We were greeted with a box that pops up with a title of "Connect to
<servername>" asking for a username and password. No combination will work.
We get the same error when trying \\10.x.x.x.

We have done a little more work since then to try and find/fix the problem.
We verfied in the domain controller group policy that access is allowed to
browse the machines from the network (and we can browse the other DC's no
problem). We verified permissions locally on the computer. We attempted
access from another DC logged in as the Domain Admin. In every case we get
the same problem.

It got a little odd here. From the DC that we cannot browse to we can open
\\10.x.x.x and are shown a shared folder, but not netlogon or sysvol. If we
do \\<servername> we see all three folders, but anytime we try to get into
one we get that same pop-up logon box. Trying \\companyname.com\netlogon
gets the same logon box.

We removed the DC role from one of the three computers while we were
troubleshooting this (left hand right hand and all) and ended up putting the
DC function back onto it as we need to be able to get to the shared folder.
The DC which was working perfectly fine is now showing the exact same problem
as the new one. The new one has since been removed from the DC role and
access has been restored to normal.

Any ideas?

I feel you have FRS issue. any errors in dcdiag and netdiag?

Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
"CeridianMN" <(E-Mail Removed)> wrote in message news:3D1F87A6-335C-442D-A368-(E-Mail Removed)...
I posted this at www.msusenet.com yesterday.

We have recently ran into a problem trying to do some upgrading on our
network. We are running a Win 2003 AD domain with some remaining Win 2K
member servers and mostly Win XP SP2 computers. We have three DC's at our
main site, and one at each of 4 remote sites. Of the three we have at the
main site one is the PDC emulator & GC (no longer a needed role, but helps us
identify who is who), one is a GC, and one is the Infrastructure Master. The
two back-up DC's are also our tape-backup servers. We are in the process of
getting rid of them due to getting a new tape-library solution in. As part
of this we needed to promote two new servers to replace the existing back-ups.

We installed a new server and promoted it to a DC using the "Manage your
server wizard." All seemed well until we tried to browse to a shared folder
on it. We were greeted with a box that pops up with a title of "Connect to
<servername>" asking for a username and password. No combination will work.
We get the same error when trying \\10.x.x.x.

We have done a little more work since then to try and find/fix the problem.
We verfied in the domain controller group policy that access is allowed to
browse the machines from the network (and we can browse the other DC's no
problem). We verified permissions locally on the computer. We attempted
access from another DC logged in as the Domain Admin. In every case we get
the same problem.

It got a little odd here. From the DC that we cannot browse to we can open
\\10.x.x.x and are shown a shared folder, but not netlogon or sysvol. If we
do \\<servername> we see all three folders, but anytime we try to get into
one we get that same pop-up logon box. Trying \\companyname.com\netlogon
gets the same logon box.

We removed the DC role from one of the three computers while we were
troubleshooting this (left hand right hand and all) and ended up putting the
DC function back onto it as we need to be able to get to the shared folder.
The DC which was working perfectly fine is now showing the exact same problem
as the new one. The new one has since been removed from the DC role and
access has been restored to normal.

Any ideas?

I do have some errors in dcdiag - they are all access denied errors. NetDiag
shows no errors, but does have warnings on NetBT showing "At least one of the
<00> 'WorkStation Service', <03> 'Messenger Service', <20>'WINS' names is
missing."

The logs are availible as a text document at
ftp:\\adamtemp:newzealand41@208.49.62.3 for review.

This is after running them on the offending server.

"Robert L [MS-MVP]" wrote:

> I feel you have FRS issue. any errors in dcdiag and netdiag?
>
> Bob Lin, MS-MVP, MCSE & CNE
> Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
> How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
> "CeridianMN" <(E-Mail Removed)> wrote in message news:3D1F87A6-335C-442D-A368-(E-Mail Removed)...
> I posted this at www.msusenet.com yesterday.
>
> We have recently ran into a problem trying to do some upgrading on our
> network. We are running a Win 2003 AD domain with some remaining Win 2K
> member servers and mostly Win XP SP2 computers. We have three DC's at our
> main site, and one at each of 4 remote sites. Of the three we have at the
> main site one is the PDC emulator & GC (no longer a needed role, but helps us
> identify who is who), one is a GC, and one is the Infrastructure Master. The
> two back-up DC's are also our tape-backup servers. We are in the process of
> getting rid of them due to getting a new tape-library solution in. As part
> of this we needed to promote two new servers to replace the existing back-ups.
>
> We installed a new server and promoted it to a DC using the "Manage your
> server wizard." All seemed well until we tried to browse to a shared folder
> on it. We were greeted with a box that pops up with a title of "Connect to
> <servername>" asking for a username and password. No combination will work.
> We get the same error when trying \\10.x.x.x.
>
> We have done a little more work since then to try and find/fix the problem.
> We verfied in the domain controller group policy that access is allowed to
> browse the machines from the network (and we can browse the other DC's no
> problem). We verified permissions locally on the computer. We attempted
> access from another DC logged in as the Domain Admin. In every case we get
> the same problem.
>
> It got a little odd here. From the DC that we cannot browse to we can open
> \\10.x.x.x and are shown a shared folder, but not netlogon or sysvol. If we
> do \\<servername> we see all three folders, but anytime we try to get into
> one we get that same pop-up logon box. Trying \\companyname.com\netlogon
> gets the same logon box.
>
> We removed the DC role from one of the three computers while we were
> troubleshooting this (left hand right hand and all) and ended up putting the
> DC function back onto it as we need to be able to get to the shared folder.
> The DC which was working perfectly fine is now showing the exact same problem
> as the new one. The new one has since been removed from the DC role and
> access has been restored to normal.
>
> Any ideas?