Joining NT4 Workstation to WS2003 Active Directory

I could have posted this in one of several locations, but decided that this
is probably some quirk in name resolution.

I need to join an NT4 workstation to an AD 2003 domain. There's no way
around it. Hardware and software that are aboslutely not supported by a more
recent OS reside on this system.

I placed a local admin account with identical name and password to those of
a domain admin account on the NT4 system, and I made its workgroup name the
same as the domain name (non-dotted version). I set the NT4 box to use DNS
servers on the domain. It can ping any system on the domain (over multiple
subnets) by name. It can browse to shares on the domain in Network
Neighborhood.

On the PDC emulator I can browse to the NT4 box in Network Neighborhood.

I add the NT4 box name as a new computer on the domain in AD Computers and
Users.

I go into the dialog to change the NT4 box's network identification to add
it to the domain, using the non-dotted name (DOMAIN instead of DOMAIN.EXT).

I am welcomed to the domain. After that I can't log on to the domain with
any account, admin or otherwise. I keep getting popups claiming that the
domain controller for the domain can't be found.

Does anyone have an idea what I could do to correct this situation?

Hello LeftFoot,

Just to get you correct, the machine joined the domain with the welcome to
the domain window? After the reboot you are not aible to logon to the domain?
Do you run a WINS server in 2003? Please post an unedited ipconfig /all from
the NT4 and DC/DNS server.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> I could have posted this in one of several locations, but decided that
> this is probably some quirk in name resolution.
>
> I need to join an NT4 workstation to an AD 2003 domain. There's no way
> around it. Hardware and software that are aboslutely not supported by
> a more recent OS reside on this system.
>
> I placed a local admin account with identical name and password to
> those of a domain admin account on the NT4 system, and I made its
> workgroup name the same as the domain name (non-dotted version). I set
> the NT4 box to use DNS servers on the domain. It can ping any system
> on the domain (over multiple subnets) by name. It can browse to shares
> on the domain in Network Neighborhood.
>
> On the PDC emulator I can browse to the NT4 box in Network
> Neighborhood.
>
> I add the NT4 box name as a new computer on the domain in AD Computers
> and Users.
>
> I go into the dialog to change the NT4 box's network identification to
> add it to the domain, using the non-dotted name (DOMAIN instead of
> DOMAIN.EXT).
>
> I am welcomed to the domain. After that I can't log on to the domain
> with any account, admin or otherwise. I keep getting popups claiming
> that the domain controller for the domain can't be found.
>
> Does anyone have an idea what I could do to correct this situation?
>

Yes, that is correct. I get the welcome to the domain popup, but I cannot
logon to the domain following the reboot.

I do not run a WINS server in 2003. (The need to accommodate downlevel
clients is a relatively recent issue, and I had hoped to avoid using WINS.)

I have left the site for the remainder of the day, but I will comply with
your request for the output from IPCONFIG /ALL for both the NT4 and the
DC/DNS server when I arrive at the site tomorrow morning.

I am grateful for your response.

"Meinolf Weber" wrote:

> Hello LeftFoot,
>
> Just to get you correct, the machine joined the domain with the welcome to
> the domain window? After the reboot you are not aible to logon to the domain?
> Do you run a WINS server in 2003? Please post an unedited ipconfig /all from
> the NT4 and DC/DNS server.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
> > I could have posted this in one of several locations, but decided that
> > this is probably some quirk in name resolution.
> >
> > I need to join an NT4 workstation to an AD 2003 domain. There's no way
> > around it. Hardware and software that are aboslutely not supported by
> > a more recent OS reside on this system.
> >
> > I placed a local admin account with identical name and password to
> > those of a domain admin account on the NT4 system, and I made its
> > workgroup name the same as the domain name (non-dotted version). I set
> > the NT4 box to use DNS servers on the domain. It can ping any system
> > on the domain (over multiple subnets) by name. It can browse to shares
> > on the domain in Network Neighborhood.
> >
> > On the PDC emulator I can browse to the NT4 box in Network
> > Neighborhood.
> >
> > I add the NT4 box name as a new computer on the domain in AD Computers
> > and Users.
> >
> > I go into the dialog to change the NT4 box's network identification to
> > add it to the domain, using the non-dotted name (DOMAIN instead of
> > DOMAIN.EXT).
> >
> > I am welcomed to the domain. After that I can't log on to the domain
> > with any account, admin or otherwise. I keep getting popups claiming
> > that the domain controller for the domain can't be found.
> >
> > Does anyone have an idea what I could do to correct this situation?
> >
>
>
>

Hi, Meinolf,

Here is the result of the ipconfig /all command for the PDC Emulator / FSMO
role holder for the domain:



Windows 2000 IP Configuration



Host Name . . . . . . . . . . . . : b1vip
Primary DNS Suffix . . . . . . . : vip.lcl
Node Type . . . . . . . . . . . . : Broadcast

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : vip.lcl

Ethernet adapter Broadcom NIC - onboard:



Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
Physical Address. . . . . . . . . : 00-06-5B-3F-D3-93

DHCP Enabled. . . . . . . . . . . : No

IP Address. . . . . . . . . . . . : 192.168.1.16

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.1.1

DNS Servers . . . . . . . . . . . : 192.168.1.16

And here is the result of the command for the NT4 system:

Windows NT IP Configuration



Host Name . . . . . . . . . : sapprobak.VIP
DNS Servers . . . . . . . . : 192.168.1.16
192.168.9.3
192.168.21.44
Node Type . . . . . . . . . : Broadcast

NetBIOS Scope ID. . . . . . :

IP Routing Enabled. . . . . : No

WINS Proxy Enabled. . . . . : No

NetBIOS Resolution Uses DNS : Yes


Ethernet adapter El90x1:



Description . . . . . . . . : 3Com EtherLink PCI

Physical Address. . . . . . : 00-01-03-1F-D9-FD

DHCP Enabled. . . . . . . . : No

IP Address. . . . . . . . . : 192.168.4.101

Subnet Mask . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . : 192.168.4.1



"Meinolf Weber" wrote:

> Hello LeftFoot,
>
> Just to get you correct, the machine joined the domain with the welcome to
> the domain window? After the reboot you are not aible to logon to the domain?
> Do you run a WINS server in 2003? Please post an unedited ipconfig /all from
> the NT4 and DC/DNS server.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
> > I could have posted this in one of several locations, but decided that
> > this is probably some quirk in name resolution.
> >
> > I need to join an NT4 workstation to an AD 2003 domain. There's no way
> > around it. Hardware and software that are aboslutely not supported by
> > a more recent OS reside on this system.
> >
> > I placed a local admin account with identical name and password to
> > those of a domain admin account on the NT4 system, and I made its
> > workgroup name the same as the domain name (non-dotted version). I set
> > the NT4 box to use DNS servers on the domain. It can ping any system
> > on the domain (over multiple subnets) by name. It can browse to shares
> > on the domain in Network Neighborhood.
> >
> > On the PDC emulator I can browse to the NT4 box in Network
> > Neighborhood.
> >
> > I add the NT4 box name as a new computer on the domain in AD Computers
> > and Users.
> >
> > I go into the dialog to change the NT4 box's network identification to
> > add it to the domain, using the non-dotted name (DOMAIN instead of
> > DOMAIN.EXT).
> >
> > I am welcomed to the domain. After that I can't log on to the domain
> > with any account, admin or otherwise. I keep getting popups claiming
> > that the domain controller for the domain can't be found.
> >
> > Does anyone have an idea what I could do to correct this situation?
> >
>
>
>

Hello LeftFoot,

So the server is in the domain vip.lcl and the client in vip?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Hi, Meinolf,
>
> Here is the result of the ipconfig /all command for the PDC Emulator /
> FSMO role holder for the domain:
>
> Windows 2000 IP Configuration
>
> Host Name . . . . . . . . . . . . : b1vip
> Primary DNS Suffix . . . . . . . : vip.lcl
> Node Type . . . . . . . . . . . . : Broadcast
> IP Routing Enabled. . . . . . . . : No
>
> WINS Proxy Enabled. . . . . . . . : No
>
> DNS Suffix Search List. . . . . . : vip.lcl
>
> Ethernet adapter Broadcom NIC - onboard:
>
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit
> Ethernet
> Physical Address. . . . . . . . . : 00-06-5B-3F-D3-93
> DHCP Enabled. . . . . . . . . . . : No
>
> IP Address. . . . . . . . . . . . : 192.168.1.16
>
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
>
> Default Gateway . . . . . . . . . : 192.168.1.1
>
> DNS Servers . . . . . . . . . . . : 192.168.1.16
>
> And here is the result of the command for the NT4 system:
>
> Windows NT IP Configuration
>
> Host Name . . . . . . . . . : sapprobak.VIP
> DNS Servers . . . . . . . . : 192.168.1.16
> 192.168.9.3
> 192.168.21.44
> Node Type . . . . . . . . . : Broadcast
> NetBIOS Scope ID. . . . . . :
>
> IP Routing Enabled. . . . . : No
>
> WINS Proxy Enabled. . . . . : No
>
> NetBIOS Resolution Uses DNS : Yes
>
> Ethernet adapter El90x1:
>
> Description . . . . . . . . : 3Com EtherLink PCI
>
> Physical Address. . . . . . : 00-01-03-1F-D9-FD
>
> DHCP Enabled. . . . . . . . : No
>
> IP Address. . . . . . . . . : 192.168.4.101
>
> Subnet Mask . . . . . . . . : 255.255.255.0
>
> Default Gateway . . . . . . : 192.168.4.1
>
> "Meinolf Weber" wrote:
>
>> Hello LeftFoot,
>>
>> Just to get you correct, the machine joined the domain with the
>> welcome to the domain window? After the reboot you are not aible to
>> logon to the domain? Do you run a WINS server in 2003? Please post an
>> unedited ipconfig /all from the NT4 and DC/DNS server.
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers
>> no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> I could have posted this in one of several locations, but decided
>>> that this is probably some quirk in name resolution.
>>>
>>> I need to join an NT4 workstation to an AD 2003 domain. There's no
>>> way around it. Hardware and software that are aboslutely not
>>> supported by a more recent OS reside on this system.
>>>
>>> I placed a local admin account with identical name and password to
>>> those of a domain admin account on the NT4 system, and I made its
>>> workgroup name the same as the domain name (non-dotted version). I
>>> set the NT4 box to use DNS servers on the domain. It can ping any
>>> system on the domain (over multiple subnets) by name. It can browse
>>> to shares on the domain in Network Neighborhood.
>>>
>>> On the PDC emulator I can browse to the NT4 box in Network
>>> Neighborhood.
>>>
>>> I add the NT4 box name as a new computer on the domain in AD
>>> Computers and Users.
>>>
>>> I go into the dialog to change the NT4 box's network identification
>>> to add it to the domain, using the non-dotted name (DOMAIN instead
>>> of DOMAIN.EXT).
>>>
>>> I am welcomed to the domain. After that I can't log on to the domain
>>> with any account, admin or otherwise. I keep getting popups claiming
>>> that the domain controller for the domain can't be found.
>>>
>>> Does anyone have an idea what I could do to correct this situation?
>>>

Hi, Meinolf.

Yes.

None of the DNS servers are on the same subnet as the NT4 system. I do not
have WINS running. I have not created an LMHOSTS file for the NT4 system.

I am vaguely aware that a "downlevel" client like this may need some help
finding other system names on the domain.

The funny thing is that the NT4 client sees the DC and the DC sees the NT4
client BEFORE I join the client to the domain. After I join the client to the
domain, the DC is unable to get access to the client through Network
Neighborhood.

"Meinolf Weber" wrote:

> Hello LeftFoot,
>
> So the server is in the domain vip.lcl and the client in vip?
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
> > Hi, Meinolf,
> >
> > Here is the result of the ipconfig /all command for the PDC Emulator /
> > FSMO role holder for the domain:
> >
> > Windows 2000 IP Configuration
> >
> > Host Name . . . . . . . . . . . . : b1vip
> > Primary DNS Suffix . . . . . . . : vip.lcl
> > Node Type . . . . . . . . . . . . : Broadcast
> > IP Routing Enabled. . . . . . . . : No
> >
> > WINS Proxy Enabled. . . . . . . . : No
> >
> > DNS Suffix Search List. . . . . . : vip.lcl
> >
> > Ethernet adapter Broadcom NIC - onboard:
> >
> > Connection-specific DNS Suffix . :
> > Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit
> > Ethernet
> > Physical Address. . . . . . . . . : 00-06-5B-3F-D3-93
> > DHCP Enabled. . . . . . . . . . . : No
> >
> > IP Address. . . . . . . . . . . . : 192.168.1.16
> >
> > Subnet Mask . . . . . . . . . . . : 255.255.255.0
> >
> > Default Gateway . . . . . . . . . : 192.168.1.1
> >
> > DNS Servers . . . . . . . . . . . : 192.168.1.16
> >
> > And here is the result of the command for the NT4 system:
> >
> > Windows NT IP Configuration
> >
> > Host Name . . . . . . . . . : sapprobak.VIP
> > DNS Servers . . . . . . . . : 192.168.1.16
> > 192.168.9.3
> > 192.168.21.44
> > Node Type . . . . . . . . . : Broadcast
> > NetBIOS Scope ID. . . . . . :
> >
> > IP Routing Enabled. . . . . : No
> >
> > WINS Proxy Enabled. . . . . : No
> >
> > NetBIOS Resolution Uses DNS : Yes
> >
> > Ethernet adapter El90x1:
> >
> > Description . . . . . . . . : 3Com EtherLink PCI
> >
> > Physical Address. . . . . . : 00-01-03-1F-D9-FD
> >
> > DHCP Enabled. . . . . . . . : No
> >
> > IP Address. . . . . . . . . : 192.168.4.101
> >
> > Subnet Mask . . . . . . . . : 255.255.255.0
> >
> > Default Gateway . . . . . . : 192.168.4.1
> >
> > "Meinolf Weber" wrote:
> >
> >> Hello LeftFoot,
> >>
> >> Just to get you correct, the machine joined the domain with the
> >> welcome to the domain window? After the reboot you are not aible to
> >> logon to the domain? Do you run a WINS server in 2003? Please post an
> >> unedited ipconfig /all from the NT4 and DC/DNS server.
> >>
> >> Best regards
> >>
> >> Meinolf Weber
> >> Disclaimer: This posting is provided "AS IS" with no warranties, and
> >> confers
> >> no rights.
> >> ** Please do NOT email, only reply to Newsgroups
> >> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
> >>> I could have posted this in one of several locations, but decided
> >>> that this is probably some quirk in name resolution.
> >>>
> >>> I need to join an NT4 workstation to an AD 2003 domain. There's no
> >>> way around it. Hardware and software that are aboslutely not
> >>> supported by a more recent OS reside on this system.
> >>>
> >>> I placed a local admin account with identical name and password to
> >>> those of a domain admin account on the NT4 system, and I made its
> >>> workgroup name the same as the domain name (non-dotted version). I
> >>> set the NT4 box to use DNS servers on the domain. It can ping any
> >>> system on the domain (over multiple subnets) by name. It can browse
> >>> to shares on the domain in Network Neighborhood.
> >>>
> >>> On the PDC emulator I can browse to the NT4 box in Network
> >>> Neighborhood.
> >>>
> >>> I add the NT4 box name as a new computer on the domain in AD
> >>> Computers and Users.
> >>>
> >>> I go into the dialog to change the NT4 box's network identification
> >>> to add it to the domain, using the non-dotted name (DOMAIN instead
> >>> of DOMAIN.EXT).
> >>>
> >>> I am welcomed to the domain. After that I can't log on to the domain
> >>> with any account, admin or otherwise. I keep getting popups claiming
> >>> that the domain controller for the domain can't be found.
> >>>
> >>> Does anyone have an idea what I could do to correct this situation?
> >>>
>
>
>

Is there a way I can make this work without running WINS?

I've never used an LMHOSTS file before. Is that a possible solution for me?

"Meinolf Weber" wrote:

> Hello LeftFoot,
>
> So the server is in the domain vip.lcl and the client in vip?
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

In news:02AB5783-AD02-4A9E-A351-F3665CCA9B73@microsoft.com,
LeftFoot <LeftFoot@discussions.microsoft.com> typed:
> Is there a way I can make this work without running WINS?
>
> I've never used an LMHOSTS file before. Is that a possible solution
> for me?

It's actually easier to setup WINS. Are you running Exchange 2000, 2003 or
2007? Did you know that Exchange *requires* WINS in a multi subnetted
environment? Plus the ability for users to browse the neighborhood and for
printers, and possibly using applications that require NetBIOS support.

Exchange Server 2003 and Exchange 2000 Server require NetBIOS name
....Explains the different scenarios where Exchange Server 2003 and Exchange
2000 Server still require NetBIOS name resolution for full functionality.
http://support.microsoft.com/kb/837391

I wanted to mention that first in case you were running Exchange. If
you want to create an lmhosts file on the NT4 box, put these lines in it and
of course I am assuming the Windows 2000 machine is the DC that holds the
PDC Emulator Role, and the domain and computer names are not munged, meaning
the domain's NetBIOS name is actually VIP, and the 2000's machine is
actually b1vip.


192.168.1.16 b1vip #PRE #DOM:VIP


--
Regards,
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
MVP Microsoft MVP - Directory Services
Microsoft Certified Trainer

For urgent issues, you may want to contact Microsoft PSS directly.
Please
check http://support.microsoft.com for regional support phone numbers.

Infinite Diversities in Infinite Combinations

Thank you for that response.

No, we're not running Exchange on this domain. It's a very special purpose
domain which runs production equipment only. I didn't want to add WINS if it
wasn't needed.

Interestingly enough, the NT4 workstation has no problem logging on to the
domain as long as it is situated on a network segment that has a DC on it. (I
had it on another subnet while I was doing the initial configuration.)

I have made a note regarding the LMHOSTS file and will use that technique if
needed in the future, though it may never be necessary. Everything is going
to be on a single subnet within a few weeks.

"Ace Fekay [MVP]" wrote:

> In news:02AB5783-AD02-4A9E-A351-F3665CCA9B73@microsoft.com,
> LeftFoot <LeftFoot@discussions.microsoft.com> typed:
> > Is there a way I can make this work without running WINS?
> >
> > I've never used an LMHOSTS file before. Is that a possible solution
> > for me?
>
> It's actually easier to setup WINS. Are you running Exchange 2000, 2003 or
> 2007? Did you know that Exchange *requires* WINS in a multi subnetted
> environment? Plus the ability for users to browse the neighborhood and for
> printers, and possibly using applications that require NetBIOS support.
>
> Exchange Server 2003 and Exchange 2000 Server require NetBIOS name
> ....Explains the different scenarios where Exchange Server 2003 and Exchange
> 2000 Server still require NetBIOS name resolution for full functionality.
> http://support.microsoft.com/kb/837391
>
> I wanted to mention that first in case you were running Exchange. If
> you want to create an lmhosts file on the NT4 box, put these lines in it and
> of course I am assuming the Windows 2000 machine is the DC that holds the
> PDC Emulator Role, and the domain and computer names are not munged, meaning
> the domain's NetBIOS name is actually VIP, and the 2000's machine is
> actually b1vip.
>
>
> 192.168.1.16 b1vip #PRE #DOM:VIP
>
>
> --
> Regards,
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
> MVP Microsoft MVP - Directory Services
> Microsoft Certified Trainer
>
> For urgent issues, you may want to contact Microsoft PSS directly.
> Please
> check http://support.microsoft.com for regional support phone numbers.
>
> Infinite Diversities in Infinite Combinations
>
>
>

In news:F0AB88E2-B167-467C-AB14-BEB525B11CD1@microsoft.com,
LeftFoot <LeftFoot@discussions.microsoft.com> typed:
> Thank you for that response.
>
> No, we're not running Exchange on this domain. It's a very special
> purpose domain which runs production equipment only. I didn't want to
> add WINS if it wasn't needed.
>
> Interestingly enough, the NT4 workstation has no problem logging on
> to the domain as long as it is situated on a network segment that has
> a DC on it. (I had it on another subnet while I was doing the initial
> configuration.)
>
> I have made a note regarding the LMHOSTS file and will use that
> technique if needed in the future, though it may never be necessary.
> Everything is going to be on a single subnet within a few weeks.
>
> "Ace Fekay [MVP]" wrote:

The reason it worked on the same network segment (subnet), is because it was
able to find the domain using a broadcast. hence why it did not work when it
was on another subnet. Broadcasts do not traverse routers. You will need
somelike like WINS to support NetBIOS resolution across a router. That's why
I was saying WINS is the answer. WINS eliminates broadcasts and provides a
central repository for all NetBIOS name to IP resolution for any machine
configured to use a WINS server. Plus WINS works with the Browser service
too to populate the Neighborhood without all of the NetBIOS chitchat, or
broadcast traffic. Using WINS is usually a defacto to support NetBIOS across
routers or subnets.

Ace

Ace