Server 2003 Event ID 529 and Windows XP event id 1521

[Blerim]

Hi, we are running an Active Directory Forest which has one way transitive trust with another kerberos running forest. The users connected with our domain whenever try to login using the trust, they get the following error message:

“Windows cannot locate the server copy of your roaming profile and is attempting to log you on with your local profile. Changes to the profile will not be copied to the server when you logoff. Possible causes of this error include network problems or insufficient security rights. If this problem persists, contact your network administrator.

DETAIL - Logon failure: unknown user name or bad password.

Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.”

However the users are still; able to log in to the domain and access network drives, but the only problem is their profile neither loads nor gets saved. At the same time when they use our domain to login, their profiles loads and saves fine. While troubleshooting the problem I checked the Event Viewer and found the following:

Event id 529: Logon Failure:
Reason: Unknown user name or bad password
User Name: abc123
Domain: EXEL
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: STALFOS
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -

Event id 1521: Windows cannot locate the server copy of your roaming profile and is attempting to log you on with your local profile. Changes to the profile will not be copied to the server when you logoff. Possible causes of this error include network problems or insufficient security rights. If this problem persists, contact your network administrator.

DETAIL - Logon failure: unknown user name or bad password.

Event id 1511:
Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.

Any idea whats wrong and how can I fix it? Thanks for your helps.

[JinaJ]

The error mentioned above simply means that the profile location is not reachable. You can check this by accessing the network profile at the same time when the user is logged in. If I’m correct you will get an access denied error. Hence you need to first fix this.

[elander]

Hello Blerim, are your both Client as well as Server able to successfully locate the KDC in the file server's domain using SRV records? I mean, something similar to this:

nltest /dsgetdc:domain-name.com

or

nslookup -type=srv _kerberos._tcp.dc._msdcs.domain-name.com.

[RicRegier]

Hi I'm having about the same problems with several pc's on my domain, I tried the nslookup on this pc and found;

"Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\rregier.INT>nltest /dsgetdc:domain-name.com
'nltest' is not recognized as an internal or external command,
operable program or batch file.

C:\Documents and Settings\rregier.INT>nslookup -test=serv_kerberos._tcp.dc._msdc
s.domain-name.com
*** Invalid option: test=serv_kerberos._tcp.dc._msdcs.domain-name.com
*** Can't find server name for address 10.144.168.5: Non-existent domain
*** Default servers are not available
Default Server: UnKnown
Address: 10.144.168.5

Now I'm logged into the server and running everything I believe, I can see all networking drives this ip is my server01 with the AD and terminal server running...

Now to let you know something first, about 6mo ago our old IBM eserver crashed... We bought two servers’ one running winserver 08 and the other winserver 03 the first as I said running the AD, TS and then the other used as a file server... Both of them seem to be running good very little problems, however each of the PC in the domain are or have had a lot of problem logging in some times have to be rebooted to get on to the domain have that roaming profile problem we have none set to roaming...
Could this problem be the fault of the pc's having the old server info in the reg's if I was to redo the pc's as new then attach them to the domain would this correct the problem? I've done a lot of work to get them working correctly and seem like the same old thing happens... Help!