2000 Server: XP workstations not seeing PDC as DMB; can't browse to server

Greetings!

Apologies if this is in the wrong forum. I wasn't sure whether to post it here (Windows Server System) or under Networking. I'm new here, though I've read several threads in the past (you guys come up near the top of lots of Google searches! )

Anyway, I just migrated my office from a workgroup to a domain using our existing 2000 Server. The 2000 Server machine is the only domain controller on the network. It's doing everything except functioning as the gateway: it's doing DNS (necessary for Active Directory, from what I've been reading anyway), DHCP, WINS, etc.

Everything else on the network appears to be configured and working correctly. The workstations are getting IPs (so DHCP is working), are able to resolve addresses on public Internet as well as private machines by NetBIOS name (so DNS is working both for forwarding and internally), and I can search for and see the NetBIOS names for local computers in the server's WINS configuration screen.

However, when browsing the domain on the server, I can only see two machines (the server itself and a Buffalo LinkStation NAS). When browsing the domain from the XP workstations, I can only see other workstations and not the server or the NAS.

I can connect to the shares using \\[computername] (and pinging [computername] on the command line resolves it to [computername].fully.qualified.domain), so it's not the end of the world, but it's annoying (especially since the users do share up files amongst themselves from their own machines [why, I don't know] and often try to browse to network devices), and I'd like to fix it.

I've done a lot of reading and Googling and have seen many people with similar problems (including here on WindowsBBS), but so far, I have not found any solutions that have fit my situation.

I found the hint to check browstat.exe status, and it appears that the workstations are holding elections amongst themselves to determine who is the Master Browser. They are ignoring the PDC and not recognizing it as the Domain Master Browser. Therefore, they can't see the server, but they can see themselves. (I'm less clear why the server can't see them, since it knows about all of them, and most of the workstations DO have file sharing enabled and do have shares configured), but I assume it's related.

Being somewhat new to Windows Server, I'm not entirely clear on the relationship between NetBIOS, WINS, DNS, and TCP/IP, so I don't know exactly what I'm looking for to get this to work. Based on the reading I've done, here are some of my configuration details that might help (as far as I know, I'm set the way every solution I've seen posted recommends, such as having NetBIOS over TCP/IP turned on, etc.):

Also, this is a relatively small operation to start off with (I'll be eventually building it into a citywide network with VPN tunnels or perhaps Metro Ethernet). As such, there are currently all of five hosts connecting to the one domain controller, all on a single subnet with a single NAT router. No other subnets/VLANs/routed networks/relay agents/etc. to span here!

Below, [SERVER NAME] represents the server's NetBIOS name. [DOMAIN] is our domain name. [fully.qualified.domain] represents what I've set up as our domain's DNS suffix.

ON SERVER: net view

Code:

Server Name            Remark

-------------------------------------
\\LS-GL044             LinkStation
\\[SERVER NAME]
The command completed successfully.

ON SERVER: browstat status

Code:

Status for domain [DOMAIN] on transport \Device\NetBT_Tcpip_{6C5F2E2B-7C7E-4DDB-B3EF
-BA688BE076AE}
    Browsing is active on domain.
    Master browser name is: [SERVER NAME]
        Master browser is running build 2195
    1 backup servers retrieved from master [SERVER NAME]
        \\[SERVER NAME]
    There are 2 servers in domain DTAG on transport \Device\NetBT_Tcpip_{6C5F2E2
B-7C7E-4DDB-B3EF-BA688BE076AE}
    There are 1 domains in domain DTAG on transport \Device\NetBT_Tcpip_{6C5F2E2
B-7C7E-4DDB-B3EF-BA688BE076AE}

ON SERVER: ipconfig /all

Code:

Windows 2000 IP Configuration

        Host Name . . . . . . . . . . . . : [server name]
        Primary DNS Suffix  . . . . . . . : [internal.fullyqualified.domain]
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : Yes
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : [internal.fullyqualified.domain]
                                            [fullyqualified.domain]

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : Intel(R) 82540EM Based Network Conne
ction
        Physical Address. . . . . . . . . : 00-03-47-31-34-6E
        DHCP Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 192.168.0.10
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.0.1
        DNS Servers . . . . . . . . . . . : 192.168.0.10
        Primary WINS Server . . . . . . . : 192.168.0.10

Server's primary network adapter (GigE) properties:

Code:

-Static IP: 192.168.0.10
-Subnet mask: 255.255.255.0
-Default gateway: 192.168.0.1
-Preferred DNS server: 192.168.0.10
-Alternate DNS server: none
Advanced options/DNS tab:
-DNS server addresses, in order of use: 192.168.0.10
-Append primary and connection specific DNS suffixes [B]selected[/B]
-Append parent suffixes of the primary DNS suffix [B]checked[/B]
-Register this connection's address in DNS [B]checked[/B]
-Use this connection's DNS suffix in DNS registration [B]unchecked[/B]
Advanced options/WINS tab:
-WINS addresses, in order of use: 192.168.0.10
-Enable LMHOSTS lookup [B]checked[/B] (no lmhosts file in C:\WINNT\system32\drivers\etc)
-Enable NetBIOS over TCP/IP [B]selected[/B]

Server's secondary network adapter (100baseT) disabled and no cable plugged into it; assigned to receive address as DHCP if enabled (I've seen reference that multihomed machines have issues with network browsing, but the adapter is disabled)

DNS configuration

Code:

[SERVER NAME] properties:
Interfaces tab:
-Listen on All IP addresses [B]selected[/B] (192.168.0.10 is entered anyway)
Forwarders tab:
-Enable forwarders [B]checked[/B]
-IP addresses: 208.67.222.222, 208.67.220.220 (OpenDNS)
All other tabs left on defaults
[internal.fullyqualified.domain] properties:
General tab:
-Status: Running
-Type: Primary
-Zone file name: [internal.fullyqualified.domain.dns]
-Allow dynamic updates? [B]Yes[/B]
SOA tab:
-Primary server: [servername.internal.fullyqualified.domain]
-Responsible person: [admin.internal.fullyqualified.domain]
Name Servers tab:
-Server Name: [servername.internal.fullyqualified.domain]
-IP Address: 192.168.0.10
WINS tab:
-Use WINS forward lookup [B]checked[/B]
-Do not replicate this record [B]checked[/B]
-IP addresses: 192.168.0.10
-Zone transfers tab: left on defaults, no notification set up
Forward Lookup Zones/[internal.fullyqualified.domain]:
-the four SRV records exist (_msdcs, _sites, _tcp, _udp)
-the XP workstations on the network have registered A records that match their IP addresses

DHCP configuration

Code:

[servername.internal.fullyqualified.domain] properties:
DNS tab:
-Automatically update DHCP client information in DNS [B]checked[/B]
-Update DNS only if DHCP client requests [B]selected[/B]
-Discard forward (name-to-address) lookups when lease expires [B]checked[/B]
-Enable updates for DNS clients that do not support dynamic update [B]unchecked[/B]
Server Options:
-003 Router: 192.168.0.1
-004 Time server: 131.107.13.100, 132.163.4.22
-006 DNS Servers: 192.168.0.10
-015 DNS Domain Name [internal.fullyqualified.domain]
-044 WINS/NBNS Servers: 192.168.0.10
-046 WINS/NBT Node Type: 0x8
-028 Broadcast Address: 192.168.0.255
-047 NetBIOS Scope ID: [DOMAIN]
Scope [192.168.0.0] [Scope name]/Scope Options:
-Same as Server Options

(This means I'm setting those things--including the WINS server information--on each of the client machines that gets a DHCP lease, right?)

WINS configuration

Code:

-All parameters left on defaults (it doesn't look there are any real user-configurable options)
-If I right click Active Registrations and choose Find by Owner... and choose This owner: 192.168.0.10/[SERVER NAME] (the only one listed), I see a relatively long list of various hosts, domain names, workgroups, etc. (a few external laptops have been plugged in since I set this up.

This KB describes the name resolution requirements for recognizing a DMB:

In the WINS configuration, there is a Type [1Bh] Domain Master Browser object with the record name of [DOMAIN] and an IP address of 192.168.0.10. There are also a number of Type [00h] records matching that same address of 192.168.0.10:

Code:

[DOMAIN] [00h] Workgroup 192.168.0.10
IS~[SERVER NAME]--- [00h] WorkStation 192.168.0.10
[SERVER NAME] [00h] WorkStation 192.168.0.10
WORKGROUP [00h] Workgroup 192.168.0.10

As well as some others of interest ( "--__MSBROWSE__- [01h] Other 192.168.0.10" as well as some 03h, 1Ch, 1Eh, and 20h records).

I assume [00h] equals <00> in the KB article and [1Bh] equals <1b> in the KB article, so it appears I'm good to go there.

There is an HP ProCurve 2324 switch that the server and all of the workstations are plugged into. I cannot access it via the network (I don't know its IP address, and it is not being given a DHCP lease according to the DHCP server-edit: apparently the 2324 doesn't have remote access capabilities, so nevermind), so I will try to reset it and make sure it's not blocking broadcast packets (there is an Automatic Broadcast Control option; I don't know if that is affecting this issue--edit: I can't access the config, so nevermind; I don't think the broadcast control is enabled by default anyway, and the previous owners surely haven't touched the switch).

I'm offsite now, accessing the server via Remote Desktop Connection, so I can't run NET VIEW or BROWSTAT STATUS or IPCONFIG /ALL on a workstation. When I can get to the office, I will edit the above post to include those for reference.

I hope I've covered all of the bases (I tried to do a lot of reading before asking for help). Anyone have any ideas?

 

I would like to see an ipconfig /all on a few clients.

I would also like to see a screen shot of the system properties / Computer Name tab.

Any personal firewalls running on the clients?

 

Wow--fast response! I said I'd edit the above post to include those, but you beat me! I'll just post them below.

CLIENT 1:
net view

Code:

Server Name            Remark

-------------------------------------------------------------------------------
\\AN5AC...
\\AN5DA...           Da...'s office
\\AN5DB...         DB... 1
\\AN5DE...
The command completed successfully.

browstat status

Code:

Status for domain [DOMAIN] on transport \Device\NetBT_Tcpip_{FF965936-7D4F-4352-BA35
-29A8CBBBBC91}
    Browsing is active on domain.
    Master browser name is: AN5DB...
        Master browser is running build 2600
    1 backup servers retrieved from master AN5DB...
        \\AN5DB...
    There are 4 servers in domain [DOMAIN] on transport \Device\NetBT_Tcpip_{FF96593
6-7D4F-4352-BA35-29A8CBBBBC91}
    There are 1 domains in domain [DOMAIN] on transport \Device\NetBT_Tcpip_{FF96593
6-7D4F-4352-BA35-29A8CBBBBC91}

ipconfig /all

Code:

Windows IP Configuration

        Host Name . . . . . . . . . . . . : AN5Ac...
        Primary Dns Suffix  . . . . . . . : internal.fullyqualified.domain
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : internal.fullyqualified.domain
                                            internal.fullyqualified.domain
                                            fullyqualified.domain

Ethernet adapter Local Area Connection 2:

        Connection-specific DNS Suffix  . : internal.fullyqualified.domain
        Description . . . . . . . . . . . : Intel(R) PRO/100 VE Network Connecti
on
        Physical Address. . . . . . . . . : 00-16-76-04-66-0C
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.0.100
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.0.1
        DHCP Server . . . . . . . . . . . : 192.168.0.10
        DNS Servers . . . . . . . . . . . : 192.168.0.10
        Primary WINS Server . . . . . . . : 192.168.0.10
        Lease Obtained. . . . . . . . . . : Friday, December 18, 2009 5:06:20 PM

        Lease Expires . . . . . . . . . . : Saturday, December 26, 2009 5:06:20
PM

Screenshot of System Properties/Computer Name tab (will be able to update S3's ACL for viewing within 30 minutes or so of this edit)

CLIENT 2:
net view

Code:

Server Name            Remark

-------------------------------------------------------------------------------
\\AN5AC...
\\AN5DA...           Da...'s office
\\AN5DB...         DB...1
\\AN5DE...
The command completed successfully.

browstat status

Code:

Status for domain [DOMAIN] on transport \Device\NetBT_Tcpip_{00CE726B-BE61-42BF-90F5
-707A6D66AD89}
    Browsing is active on domain.
    Master browser name is: AN5DB...
        Master browser is running build 2600
    1 backup servers retrieved from master AN5DB...
        \\AN5DB...
    There are 4 servers in domain [DOMAIN] on transport \Device\NetBT_Tcpip_{00CE726
B-BE61-42BF-90F5-707A6D66AD89}
    There are 1 domains in domain [DOMAIN] on transport \Device\NetBT_Tcpip_{00CE726
B-BE61-42BF-90F5-707A6D66AD89}

ipconfig /all

Code:

Windows IP Configuration

        Host Name . . . . . . . . . . . . : AN5Da...
        Primary Dns Suffix  . . . . . . . : internal.fullyqualified.domain
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : internal.fullyqualified.domain
                                            internal.fullyqualified.domain
                                            fullyqualified.domain

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . : internal.fullyqualified.domain
        Description . . . . . . . . . . . : Intel(R) 82566DC Gigabit Network Con
nection
        Physical Address. . . . . . . . . : 00-16-76-DC-31-10
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.0.199
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.0.1
        DHCP Server . . . . . . . . . . . : 192.168.0.10
        DNS Servers . . . . . . . . . . . : 192.168.0.10
        Primary WINS Server . . . . . . . : 192.168.0.10
        Lease Obtained. . . . . . . . . . : Saturday, December 19, 2009 5:54:07
AM
        Lease Expires . . . . . . . . . . : Sunday, December 27, 2009 5:54:07 AM

Screenshot of System Properties/Computer Name tab (will be able to update S3's ACL for viewing within 30 minutes or so of this edit)

I just took screenshots, but I can't upload them from here. I will edit this post when I can get that done.

Firewalls are enabled on some of the clients, but I had taken them off of a couple while working on this and other issues. I will get around to taking them off the others shortly. Client 1 and Client 2 above both did not have a firewall. Additionally, Client 2 is connected to the same switch the server is connected to, an Allied Telesis AT-GS900/8POE switch--non-managed, I believe--so that effectively rules out the HP ProCurve as the issue. (All of the other computers are behind the ProCurve.)

I'll head over to another machine and do the same thing. I'll either edit this post with its results or, if you've beaten me with a reply, I'll reply with it...

 

I am unable to view those screen shots.

Looks like the link is private.

 

Try them now. I use Amazon S3 for public file hosting, but the Jungle Disk web interface I upload to does not set the read permission for guests. I have S3Fox (which can edit the ACL) at home and at work, but I didn't have it at the office where all of this is taking place.

Just tested and I was able to see them. Let me know if they still don't work.

 

Cant tell much because you have the majority of the info blanked out but it looks like you didn't join those clients to the domain correctly.

Can you explain the steps you took to join them?

 

Sorry. I'm a little leery of publishing identifying information (about both my company and host/domain). Hopefully what I posted was enough of how things are formed to assist in diagnosing the problem (there weren't any typos in them!).

Here's what I did to join the domain (on the first computer, anyway--perhaps the errors can clue you in):

1) System Properties/Computer Name
2) Click Change
3) Click the radio button next to Domain
4) Type in [DOMAIN]
5) Received an error that the domain controller could not be contacted
6) Type in [internal.fullyqualified.domain]
7) Asked for domain admin password
8) Received a welcome to the domain note and a prompt to restart

On the login screen (and in My Network Places), the domain shown is [DOMAIN], not [internal.fullyqualified.domain], even though [internal.fullyqualified.domain] is what I had to use to join the domain (which is what I expected--I just thought I'd post it here as info).

 

When you got the error just typing in the domain was the DNS of the client pointed to 192.168.0.10 at that time?

When you joined the domain were you prompted for a Domain admin credential?

 

Yes and yes.

 

I'd start by removing some of those DHCP scope options:

With Server 2003, the client systems automatically take their time from the server and I believe the same is true for 2000. Therefore, remove that scope option 004 from DHCP and let Windows handle time.

The broadcast address (028) is the same as the default for a 255.255.255.0 mask so that entry is doing nothing constructive, so remove it in case it is doing something destructive.

Remove the NetBIOS Scope ID (047). Let the system work that out for themselves.

If that doesn't help I'd start looking for registry hacks. It might be that whoever set up the workgroup hacked the system registries to cut down browser re-elections and in so doing has raised the browser heirarchy for the clients above that of the server.

Oh! and make sure TCP/IP is the only network protocol running. Remove NetBEUI as that could well be messing things up.

 

Thanks. I removed the three you suggested. However, I don't have access to any of the workstations on the network, so I can't test it out. (I'll need to throw VNC or something on one of them this week.)

If the workstations are getting their time from the server, where do I configure which NTP servers the server is getting its own time from them? I'm connecting right now from home via RDC, and the clock is not displayed. If I go into the office and log into the console session on the machine itself, I assume the clock will be displayed there--is there a function in there (as in XP) to set the NTP server? ( "time" in the command window indicates the time is about a minute off, so it must not have an NTP server configured.)

Given it was such a small office and haphazardly set up when we inherited it during a buyout of a competitor, I doubt it (before the buyout, it was mostly functioning as a Terminal Services server to run POS software on WYSE thin clients, and it seemed any other services were an afterthought--it was a simple file server). I'll keep this in mind if nothing else works, though. (If it's a simple answer, where would I start looking for this? I'm not normally a Windows guy, so I'm not intimately familiar with the registry.)

I haven't seen anywhere in the system that indicates NetBEUI is enabled. I assume it'd show up under the network adapter properties as an installed protocol--if so, it's definitely not there. Should I look somewhere else for it?

Thanks again for your help.

 

Just a suggestion but I would use something other than RDC.

My favorite is Logmein free.
That way the desktop is identical to being there.

 

Here's a start.
http://support.microsoft.com/kb/188001

 

I've read through that KB article a number of times and haven't come up with anything that seems to be wrong in my configuration. As I indicated in my first post, I have the required <00> and <1b> entries in my server's WINS database.

Will get around to installing VNC or LogMeIn Free or something on both the server and a workstation or two next time I'm over at that office.

 

I guess I didn't make that link suggestion very clear. I think the Master Browser election problem is on the clients not the server.

 

You want to make sure your DC has all five FSMO roles (google> fsmo). If it doesn't, you can force it to seize these roles.
You may want to unjoin your workstations and rejoin using the network id button in the computer name tab as opposed to using the change button.

 

I'm looking into FSMO. I only have the one server, and it was promoted alone to PDC (no other DCs involved), so I don't know how the FSMO roles could have gotten messed up, but I'm looking into it.

I did decide to take your advice and unjoin and re-join using the Network Identification wizard instead of the Change button. Interestingly, I received the following error--BOTH when joining with the NetBIOS domain name AND the fully-qualified domain name:

What's doubly odd, though, is that it DOES find the DC, since before it pops that error up, it shows a dialog stating that an account for that computer was found!

Domain Joining Error 1
Domain Joining Error 2

This part of the error message caught my eye:

I looked into the DNS records on the server, and this might be a clue:

DNS records on server

It's not quite clear when I'm trying to obfuscate my actual addresses, but [DOMAIN] represents the NetBIOS domain name [e.g. to use my college as an example, UAAACTDIR] and a...d...com represents the fully-qualified domain (e.g. uaa.alaska.edu).

In other words, it looks like the client is looking for (to substitute my university's info) _ldap._tcp.dc._msdcs.UAAACTDIR, but the actual record in the DNS (according to the hierarchy shown in the left pane) is _ldap._tcp.dc._msdcs.uaa.alaska.edu.

Could that be causing it? What would cause that? How would I fix it?

When I promoted the server, I followed pretty much exactly the steps you can see in this series of screenshots:

http://www.ucertify.com/article/how-to-promote-a-stand-alone-server-to-a-domain-controller.html

(That wasn't the article I used to walk through the steps, but it's basically the same thing.)

Obviously, I entered the DNS (fully-qualified domain) name and the NetBIOS name correctly, because the server shows both in pretty much all of the right places.

I did have trouble installing DNS, since I didn't have the W2K Server disc with me at the time, and it wasn't already installed on the server. When it kept prompting me for a file I didn't have at the time, I hit cancel, but I installed DNS the next night. DNS is working in every other capacity, though (all the clients are accessing the internet and the rest of the local network just fine, with the singular exception of browsing the network), but I could be convinced it's a faulty DNS setup. What might I check to see if that's the case, and how would I repair it?

If someone helping me needs to see full, unobfuscated information (full hostnames, domain names, etc.), please let me know and I'll PM links to unedited screenshots or unredacted command outputs. I just don't want them plastered for all the world to see (both from a technical protection aspect as well as a personal identity protection aspect).

BTW, I did get VNC on the server, and I also looked into configuring the server to get time from an NTP server, so we're all good with that now. I've also got VNC installed on one of the workstations that I was going to use for testing, but the last guy to leave turned it off...

 

It might be worth having a play with NSLOOKUP. If you nslookup a couple of addresses the output will show you which DNS server is being used. I'd suggest checking that you client PC are actually getting DNS from your server.

 

Why don't you demote and promote the dc again thus recreating the domain and associated dns info. i would skip wins setup. it really isn't needed.