WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

Troubleshooting Microsoft Networking

This section lists tools and techniques that you can use to determine and resolve networking problems. Although this section is not meant to be all-inclusive, it includes many of the problems that you might encounter within a networking environment.

Always perform the following steps when you encounter a problem with a network connection in Windows 2000 Professional:

Make sure that the cable connection between the network adapter and the port is secure. If it is, restart the computer in case you have temporarily lost connection.

Make sure the network adapter is correctly installed. Use Device Manager to verify that it is functioning correctly.

Check Event Viewer for the system and the application events that might explain the problem. For more information about using Event Viewer and the event logs, see "Troubleshooting Tools" later in this chapter.

Verify that the domain controller(s) are available and functioning. Contact your network administrator if they are not.

For more information about troubleshooting techniques and tools, see "Troubleshooting Tools and Strategies" in this book.

Troubleshooting Tools

For detailed usage and syntax information about each of the troubleshooting tools, see "Troubleshooting Tools and Strategies" in this book.

Event Viewer

Event Viewer allows you to monitor events in your system. It maintains logs about program, security, and system events on your computer. You can use Event Viewer to view and manage the event logs, gather information about hardware and software problems, and monitor Windows 2000 security events. The Event Log service starts automatically when you start Windows 2000. All users can view application and system logs.

To access Device Manager, click the Start button, and then point to Programs. Point to Administrative Tools, and then click Event Viewer.

Event logs consist of a header, a description of the event (based on the event type), and optionally, additional data. Most Security log entries consist of the header and a description. Figure 23.8 shows a typical entry in the event log.

Figure 23.8 Event Log Entry

Event Viewer categorizes the events by log type (for example, security or system), and displays a separate log of every event. Each line of the log shows information about a single event, including date, time, source, event type, category, event ID, user account, and computer name.

The log types that directly relate to a user logging on are the security and system logs. Table 23.6 provides a description of the log types and how they can be used in troubleshooting:

Table 23.6 Log Contents

For more information about Event Viewer, see Windows 2000 Professional Help.

Network Connectivity Tester (Netdiag.exe)

This command-line diagnostic tool helps isolate networking and connectivity problems by performing a series of tests to determine the state of your network client and whether it is functional. These tests and the key network status information they expose give network administrators a more direct means of identifying and isolating network problems. Netdiag.exe performs LAN connectivity and domain membership tests, including network adapter status, IP configuration, domain membership and Kerberos security tests. The tests can be performed consecutively as a group or individually.

For more information about the function and syntax of Netdiag.exe, see "Troubleshooting Tools and Strategies" in this book.

Troubleshooting Joining Networks

This section describes the techniques and procedures that you can use to determine and resolve problems in joining a Windows 2000 Professional-based computer to a Windows NT or Windows 2000 domain, or to a workgroup consisting of other Microsoft networking clients.

Can't join a domain

The following message is displayed when you attempt to add a computer running Windows 2000 Professional to a Windows NT or Windows 2000 domain:

Unable to connect to the domain controller for this domain. 
Either the user name or password entered is incorrect.

To join a domain, you must provide an account name that is a member of the Domain Admins group (Windows NT and Windows 2000 domains) or that is a member of a group that has been delegated the permission to add computers to a Windows 2000 domain. Contact your domain administrator if you receive the preceding message.

Can't find a domain controller

When you attempt to add a computer to a Windows NT or Windows 2000 domain or workgroup by using the Network Identification wizard or by manually adding the computer, the following message is displayed:

The specified domain does not exist or could not be contacted.

Perform the following steps to resolve the problem:

Verify that the correct domain or workgroup name is specified. Check the Workgroup and Domain fields for incorrectly entered names.

If TCP/IP is the transport protocol used, the problem might be caused by the configuration of TCP/IP options at the client. Log on to a local administrative account and use the following procedure to correct the problem:

Attempt to ping the domain controller by name, using the NetBIOS (that is, DomainController1) or fully qualified DNS name (that is, DomainController1.domain1.reskit.com). If unsuccessful, attempt to ping the domain controller by IP address.

If the attempt to ping the domain controller by name was not successful and DNS and/or WINS is used for name resolution, verify the IP addresses of the name servers. Attempt to ping the domain controller by name again.

If the attempt to ping the domain controller by name is unsuccessful and the Windows 2000 Professional-based client is in the same subnet as the domain controller, check the client's IP address.

If the Windows 2000 Professional-based computer is in a different subnet than the domain controller, confirm that the you have specified the correct default gateway(s).

If Internet Control Message Protocol (ICMP) Router Discovery is used to configure default gateways, configure ICMP Router Discovery. For more information, see "TCP/IP in Windows 2000 Professional" in this book.

If Routing Information Protocol (RIP)-enabled routers are used in the network, install RIP support.

A domain controller with an Internet Protocol security (IPSec) policy set at Secure Server denies transfer of IP packets with clients that do not have IPSec enabled through local or domain-based security policies. Contact your network administrator to determine the domain controller's IPSec policy. For more information about IPSec, see "TCP/IP in Windows 2000 Professional" in this book.

Can't rename a computer

When you attempt to name or rename a computer with a name that is identical or similar to the domain or workgroup name, the following message is displayed:

The new computer name may not be the same as the Workgroup (Domain) name.

In a Windows NT workgroup or domain, or in a Windows 2000 domain where NetBIOS has not been disabled on all clients and servers, the first 15 characters of the Windows 2000 Professional computer cannot be the same as the names of existing clients, workgroups, or domains. For example, if the domain name is Reskit1domainSEA, you cannot use that same name as a computer name in the domain. Select a different computer name.

Troubleshooting Logon Problems

After joining a Windows 2000 Professional-based computer to a workgroup or domain, the computer running Windows 2000 Professional should be able to communicate with other clients in the network environment. This section describes the techniques and procedures that you can use to determine and resolve problems encountered when attempting to log on to a Windows NT or Windows 2000 domain, or to a workgroup consisting of other Microsoft networking clients.

Can't log on at a local workstation

After creating a computer account at the domain, you attempt to log on locally by using a nonadministrative account. The following message is displayed:

The system could not log you on. Make sure your user name and Domain are correct, 
then type your password again.

Creation of a domain computer account does not migrate domain user accounts to the local computer. The local accounts must be created manually (by hand or through scripting).

Can't log on to a domain

After joining a Windows 2000 domain, you attempt to log on to the domain. The following message is displayed:

The system cannot log you on due to the following error: There is a time difference between the Client 
and Server. Please try again or consult your system administrator. 

Kerberos security inspects the time stamp of the authentication request sent by the client that is logged on. The time stamp is compared to the current time of the domain controller. If there is a significant difference between the two times (the default is five minutes), authentication fails. Log on locally to an administrative account, and synchronize the time between the Windows 2000 Professional client and the domain controller.

You attempt to log on to a Windows 2000 domain and the following message is displayed:

Your account has been disabled. Please see your system administrator.

The user account has been configured for logging on by using a smart card. Each user account object in Active Directory contains a User must log on using a smart card option. If this option is selected and you attempt to log on without using a smart card, you receive the preceding message even though your account is not actually disabled. Contact your network administrator to disable the User must log on using smart card option.

Look for these common causes of logon failure:

Incorrectly typed passwords or user names.

Caps Lock is inadvertently turned on when you enter a password.

Lack of a common protocol between a Windows 2000 Professional-based client and a domain controller.

If TCP/IP is the protocol that you used in the network, the client configuration might have changed since initial installation. Look for these causes:

Incorrect static addresses or subnet masks.

DHCP enabled in an environment where no DHCP server is available.

Improperly configured default gateways.

Incorrect addresses for DNS and/or WINS servers.

Incorrectly configured Hosts/Lmhosts files.

Can't log on to a domain after renaming the computer

To rename a Windows 2000 Professional computer that is a member of a Windows NT domain, perform the following steps:

Create a new computer account (or have one created for you) by using the new computer name.

Leave the domain by temporarily joining a workgroup.

Restart the computer when prompted.

Join the domain by using the new computer name.

Restart the computer when prompted.

Configuration conflicts can occur between local Windows 2000 Group Policy settings and Windows NT system policy, which can impede user access to system features and functions. For example, if a Windows 2000 Professional-based computer that was originally a stand-alone computer or a member of a workgroup, is added to a Windows NT domain that uses system policy, both the local Group Policy and Windows NT system policy may be processed at various points in the logon process. To determine the behavior of a Windows 2000 Professional-based computer with local Group Policy in a Windows NT domain with system policies, see "System Policy and Group Policy Coexistence" in this chapter.

For more information about troubleshooting Group Policy settings in a migration environment, see "Troubleshooting Change and Configuration Management" in the Microsoft® Windows® 2000 Server Resource Kit Distributed Systems Guide.

Troubleshooting Browsing and Publishing

This section discusses how you resolve problems that you have with the browser service in a Windows NT or Windows 2000 domain, or with published objects in a Windows 2000 domain.

Can't see member computers in a workgroup or domain

After successfully logging on to a workgroup or domain, you attempt to view shared resources in My Network Places or by entering net view from the command prompt. The resulting window shows no computers or does not show all members of the workgroup or domain.

Look for these possible causes for this situation:

If you are in a workgroup, verify that you have specified the correct workgroup name (or have changed the default from WORKGROUP).

A browser election has taken place, and the browse list is being updated on the domain master browser, on master browsers in the domain/workgroup, and on backup browsers. You can attempt to force an update of the browse list by refreshing the My Network Places window. Otherwise, it might take up to 15 minutes for all browsers to receive an updated browse list.