Domain – Windows 8.1 domain computer cannot see it’s own domain

domainwindows-8.1windows-server-2008

Quite a perplexing one.

I have a Windows 8.1 machine (completely up to date on patches from Windows update) that I want to join a Windows Server 2008 (R1) domain. When I log into the local administrator account and choose to join the domain (i.e. "WinDom"), it says "Welcome to WinDom" but then follows this up with a pause and then an error message "Changing the Primary Domain DNS name of this computer to "" failed."

Ignoring this, I reboot and am able to log in to WinDOM\User which then creates a local account on the Windows 8 computer and a computer object in Active Directory on Server 2008 (so it is seeing the domain initially). However after logging in, it stops seeing the domain properly and subsequent reboots results in "There are currently no logon servers available" locking me out of the account on the machine that was just created.

If I run "nltest /dsgetdc:WinDom" on the Win 8 machine when it's not on the domain, it reports it can see the domain controller fine. If I join the domain and then run the same command it cannot see the domain controller anymore.

Whether it is on the domain or not, I can use nslookup to find the domain controller server and ping it so I don't think it's a general DNS issue. The DNS/DHCP server is not the same as the Windows Domain Controller server and both the server and the Windows8 machine have the IP set as it's preferred DNS server.

We have another dozen Windows 7 machines all working happily on the domain, it's just the Windows 8.1 machine I'm having trouble with

Anyone have any ideas what's going wrong here?

Thanks in advance for any light anyone can shed on this.

I'm going to try patching the Windows Server 2008 this weekend to see if anything there adds support/fixes for Windows 8 machines joining the domain, but I'm going around in circles at the moment.

Best Answer

I believe that I know what the problem is... To eliminate the error, either:

Verify that NetBIOS over TCP/IP is enabled.

Click Start , click Run , type ncpa.cpl , and then click OK .
In Network Connections , right-click Local Area Connection , and then click Properties .
Click Internet Protocol Version 4 (TCP/IPv4), and then click Properties .
In the Internet Protocol Version 4 (TCP/IPv4) Properties dialog box, click Advanced .
On the WINS tab, verify Enable NetBIOS Over TCP/IP is enabled, and then click OK three times.

Verify end-to-end network connectivity over UDP port 137 over the network path connecting the client being and the helper DC serving the join operation.

If the error occurred in an IPv6 only environment OR you require a fix to resolve the error, open a support incident with Microsoft Customer Service and Support requesting a post RTM fix for Windows 8 .

Related Solutions

How to assign permissions to ApplicationPoolIdentity account

Update: The original question was for Windows Server 2008, but the solution is easier for Windows Server 2008 R2 and Windows Server 2012 (and Windows 7 and 8). You can add the user through the NTFS UI by typing it in directly. The name is in the format of IIS APPPOOL\{app pool name}. For example: IIS APPPOOL\DefaultAppPool.

IIS APPPOOL\{app pool name}

Note: Per comments below, there are two things to be aware of:

Enter the string directly into the "Select User or Group" and not in the search field.
In a domain environment you need to set the Location to your local computer first.

Reference to Microsoft Docs article: Application Pool Identities > Securing Resources

Original response: (for Windows Server 2008) This is a great feature, but as you mentioned it's not fully implemented yet. You can add the app pool identity from the command prompt with something like icacls, then you can manage it from the GUI. For example, run something like this from the command prompt:

icacls c:\inetpub\wwwroot /grant "IIS APPPOOL\DefaultAppPool":(OI)(CI)(RX)

Then, in Windows Explorer, go to the wwwroot folder and edit the security permissions. You will see what looks like a group (the group icon) called DefaultAppPool. You can now edit the permissions.

However, you don't need to use this at all. It's a bonus that you can use if you want. You can use the old way of creating a custom user per app pool and assigning the custom user to disk. That has full UI support.

This SID injection method is nice because it allows you to use a single user but fully isolate each site from each other without having to create unique users for each app pool. Pretty impressive, and it will be even better with UI support.

Note: If you are unable to find the application pool user, check to see if the Windows service called Application Host Helper Service is running. It's the service that maps application pool users to Windows accounts.

Domain – Cannot connect Windows 7 machine to windows 2003 domain

That sounds like a network issue.

Try the following:

Open a command line as administrator and type:

ipconfig

Under "Ethernet adapter Local Area Connection" you should have an IPv4 address listed (and not an auto-discovered one like 169.254.xxx.xxx)

If that works, the start nslookup (still from the command line and type

set type=srv
abc.local

That should return the name an address of your DC machine.

Try it and report back. Also important. check your event log and report any error you see there.

Best Answer

Related Solutions

How to assign permissions to ApplicationPoolIdentity account

Domain – Cannot connect Windows 7 machine to windows 2003 domain

Related Topic