NT workstations slow login to 2000

Hi, here is some past history: whenever I set up a new 2K DC in my building, my NT 4.0 workstations in the building sometimes have trouble logging in, or when they do login, they do not load the profile from the PDC/2K DC that is "supposed" to service them. Once I remove the DC from that site, the logins return to normal.

I had to reload a 2K DC that is in the same building (and was working OK prior to the great crash...) and now my nice speedy, mostly reliable 15 second login time has gone to 3-5 mins, and some machines will not login at all! Some machines will login once, and then the next user that sits down to use the computer will not, and maybe later, the same user can! --Too wierd--

I have reset every switch and router in the building. The only thing I have not tried is to shut down the new 2K DC to see if my logins return (I am using the server in production 24/7 and this would be a ***** to shutdown, even for testing and I know that this seems like a good idea ).

Any Ideas on how to get back to being happy??

 

Sounds like they are using the new server to authenticate from and the profile info is not replicated to it, so it is trying to load the profile, but cannot find it and after awhile, it just loads a default profile. Are there any error messages on the Workstations popping up at the end of this time?

I have had similar problems in our mixed domain. What I wound up doing was setting up a small profile server to store profiles on. It is not a dc and does nothing else. When managing the user accounts, I make sure to set any profile information to an absolute UNC path and not use any % variables.

 

For the profile, we use \\server\share\profilename for all of the users so I'm assuming that this means that users might authenticate to the other server, but would still get their profile from the one server (you are right, we don't replicate the profiles).

As for error type messages, sometimes the workstations say that they are unable to locate the domain...

 

Are you using DHCP, but assigning static addresses to the servers? I had a problem where I was doing that, but forgot to add more exclusions to the dhcp server.

Check to see that the main domain controller is the master browser. I have had this problem also, where for some weird reason, my IIS server took over as the master browser and was causing problems with logins.

Check to make sure that the new machine is a backup DC, and not the primary. This one I am not sure about, since you are indicating that you run 2000 servers with NT clients, I run a mix of both servers and workstations here and it works like a NT network.

Check that replication of account info is occuring.

If all else fails, install any new servers as member servers and not as a DC.

 

In this bulding, I use static IPs (for now...). With 2K, either you are a DC or a member server, the BDC went away with the NT4. We also have full AD replication happening...

The DC in this building is the PDC emulator, and I have seen some events on the viewer about elections being forced for master browsing. I'll hit the MS site to see if there is anything about designating it for the master (I don't remember anything like that from my class...).

Something else that we have noticed is that this server, which used to screem, now is dog slow for network response. I'm not quite sure where to look to see if something else is happening here...

 

Was not sure about that in a pure 2000 server setup.

I am not sure about that in a 2000, in NT you can use this link for instructions for a Domain Controller to be the Master Browser

http://is-it-true.org/nt/registry/rtips15.shtml

 

I found an article at the win2k.net site that talked about it. I looked, and the server was *not* the master... I changed the registry value and restarted the server.

Before the change, reading & writing to the server over the LAN was a slow go (it used to scream), now we are back to screaming for the LAN read/write , but the workstations still sometimes can login, and other times can not.

I looked at the event logs and when the DC (PDC and DNS) starts, it can not load records into the DNS. I'm assuming that is because it is the DNS and that service hasn't started yet. After the DC is up, if I run DCDIAG on it, it looks OK and it can do DNS name resolution OK too. The only real weird thing I can see is that the DNS has a SID in the security tab, which would tell me that it is missing something (probably important). The groups that show are:

1. Administrators
2. Authenticated users
3. DNS Admins
4. Domain Admins
5. Enterprise Admins
6. Everyone
7. Exchange Enterprise Admins
8. Pre-Win 2K Compatible access
9.System
10. ???

Anybody have any idea what that SID might be??? Since I can see the permissions, I can fix this pretty quickly if I just had a clue. No help on the MS site that I could find ...