XP vs win2k clients and DNS prob

OK, I try to maintain my Dad's companies network.. it's a side job and I
really am not very qualified, but he needs to save the cash. With that
said, please excuse the "newbieness" of this request for help.

We have a Win2k DC, it is also the DHCP and DNS server.

We have 3 win2k pro clients that login into said DC.

We have a *new* XP pro client that logs in... sorta. At one point, early in
it's life on the network it appeared to login fine, access protected network
resources, etc, etc. Lately it has started acting up. Namely;

Logins take forever - not the much complained about "Applying .. settings"
hang, but after that step, it applies settings(so fast it's hard to see it
happen) then hangs for about 2-3 minutes showing the wallpaper only, as if
Explorer.exe hadn't even fired up yet.

Accessing network resources and even other clients is problematic, sometimes
fails altogether, sometimes after browsing the network first, I can access
network shares, sometimes it asked for credentials, over and over...


After reading much on google groups, I looked into the DNS issues, from what
I can tell the server is setup fine, but one thing that I noticed is that
the win2k clients show the ISPs primary and secondary DNS servers while the
XP client show the LAN DNS server. TCP/IP configurations are
identical("Obtain from blah blah") - so that is weird.


Inspection of the XP's event logs show these entries:
[
The Security System detected an attempted downgrade attack for server
cifs/K2svr01. The failure code from authentication protocol Kerberos was
"There are currently no logon servers available to service the logon
request.
]


[
cThe Security System could not establish a secured connection with the
server cifs/K2svr01. No authentication protocol was available.
]


[
Automatic certificate enrollment for local system failed to contact the
active directory (0x8007054b). The specified domain either does not exist
or could not be contacted.
Enrollment will not be performed.
]



[
Windows cannot obtain the domain controller name for your computer network.
(The specified domain either does not exist or could not be contacted. ).
Group Policy processing aborted.
]


So armed with all this.... do any of you have any ideas for me?? I am so
bad and tracking this stuff and finding solutions, it still all seems like
black magic at times. I got him yellin' at me cause he can't open files on
his new laptop and then there's me w/ this stupid "I dunno" look on my face.

Any help...... would be greatly appreciated!
Thanks for reading this far,
Steve

sklett wrote:
> OK, I try to maintain my Dad's companies network.. it's a side job
> and I really am not very qualified, but he needs to save the cash.
> With that said, please excuse the "newbieness" of this request for
> help.
>
> We have a Win2k DC, it is also the DHCP and DNS server.
>
> We have 3 win2k pro clients that login into said DC.
>
> We have a *new* XP pro client that logs in... sorta. At one point,
> early in it's life on the network it appeared to login fine, access
> protected network resources, etc, etc. Lately it has started acting
> up. Namely;
>
> Logins take forever - not the much complained about "Applying ..
> settings" hang, but after that step, it applies settings(so fast it's
> hard to see it happen) then hangs for about 2-3 minutes showing the
> wallpaper only, as if Explorer.exe hadn't even fired up yet.
>
> Accessing network resources and even other clients is problematic,
> sometimes fails altogether, sometimes after browsing the network
> first, I can access network shares, sometimes it asked for
> credentials, over and over...
>
> After reading much on google groups, I looked into the DNS issues,
> from what I can tell the server is setup fine, but one thing that I
> noticed is that the win2k clients show the ISPs primary and secondary
> DNS servers while the XP client show the LAN DNS server. TCP/IP
> configurations are identical("Obtain from blah blah") - so that is
> weird.

Since you're using DHCP on the server, you need to change the scope so the
only DNS server "dished out" is the internal/AD DNS server IP. All servers
and workstations should specify *only* the internal AD-integrated DNS
server's IP address in their network settings. The AD-integrated DNS server
should be set up with forwarders to your ISP's DNS servers for external
resolution. See
http://support.microsoft.com/default...b;en-us;300202 for more
info.
> Inspection of the XP's event logs show these entries:

> The Security System detected an attempted downgrade attack for server
> cifs/K2svr01. The failure code from authentication protocol Kerberos
> was "There are currently no logon servers available to service the
> logon request.

> cThe Security System could not establish a secured connection with the
> server cifs/K2svr01. No authentication protocol was available.

> Windows cannot obtain the domain controller name for your computer
> network. (The specified domain either does not exist or could not be
> contacted. ). Group Policy processing aborted.
> ]


See http://support.microsoft.com/default...b;en-us;244474 for help
with this.

> So armed with all this.... do any of you have any ideas for me?? I
> am so bad and tracking this stuff and finding solutions, it still all
> seems like black magic at times. I got him yellin' at me cause he
> can't open files on his new laptop and then there's me w/ this stupid
> "I dunno" look on my face.

Well, frankly, unless he's paying you, he should just be patient. Remind him
that he's saving money. Or he should find a consultant who knows this stuff
backwards and forwards, pay the consultant, and then he can yell away as
long as the consultant puts up with it.
>
> Any help...... would be greatly appreciated!
> Thanks for reading this far,
> Steve