smoak's questions

I've got one Domain Controller for our small network (~20 users). It's running Win Server 2k3.

I have added a Global Security Group (MYDOMAIN\GroupA) and added 3 users to it (MYDOMAIN\UserA, MYDOMAIN\UserB, MYDOMAIN\UserC).

I have a separate computer running Windows Server 2k3 that's named fileserver (you guessed it, it just has file shares on it). It's joined to the domain.

I have a share:

D:\Docs\ShareOne

I have set it up to be shared with Share Permissions: "Everyone / Full Control"

Then the NTFS permissions only permit MYDOMAIN\GroupA to have Full Control over it.

However, I'm experiencing very strange problems.

I have 3 workstations (2 XP and one Vista) that are joined to the domain and UserA, UserB, and UserC are all logged in to MYDOMAIN.

UserA who is running XP can run \\fileserver\ShareOne and access the files fine.

UserB (on XP) and UserC (on Vista) however type in \\fileserver\ShareOne into Explorer, hit enter and are greeted with a friendly "Access Denied" error.

I even had UserB (whos on XP) restart their entire machine, relogin and they still cannot access the share.

Why would this be happening? Something very very strange is happening.

This has been bugging me now. I'm in the process of converting a standalone fileserver that was not joined to our domain into using AD Groups\Users for the file shares. This fileserver used to use local machine accounts for the Share permissions. I've gotten the fileserver joined to the domain so now I want to replace the Share permissions with the correct ones from AD.

Maybe I need this explained to me but for some reason I cannot get it to work. For example, I have a shared folder:

\\fileserver\jsmith

On this folder the Share permissions are set so that the AD user John Smith has Full Control. The NTFS permissions (That's what's in the Security Tab right?) are set to this:

FILESERVER\Adminstrators -- Full Control
CREATOR OWNER -- Special Permissions is checked and greyed out
SYSTEM -- Full Control though it's greyed out (as well as the other check boxes in the Allow column)
FILESERVER\Users -- Read & Execute, List Folder Contents, and Read (all greyed out)

From my understanding (and maybe I'm wrong) the user John Smith should be able to access \\filserver\jsmith and be able to open any files and folders there as well as create files and folders.

However, this is not the case. John Smith gets an Access Denied message when trying to access this share.

EDIT: To clarify, when John Smith types in the UNC path to the share (\\fileserver\jsmith) into Windows Explorer and hits Enter he gets the Access Denied message.

Maybe I'm not understanding this whole thing. So, what would be the "proper" way to accomplish what I want: An AD user or group to have Read & Write access to a shared folder.

Something very odd is happening. We have a Windows Server 2003 computer that is NOT part of our domain. It is simply just serving up files via file shares (don't ask me why they used Win 2k3 for a simple fileserver).

Anyways I'm attempting to join it to our domain and it's giving me the dreaded

A Domain Controller for the domain <domain> could not be contacted

Clicking details it's giving me:

The error was: "DNS name does not exist."  
(error code 0x0000232B RCODE_NAME_ERROR)

Which is very odd because I can use nslookup to successfully query the NS for the DC's FQDN and it comes back with the right IP.

Additionally, using:

nslookup -q=srv _ldap._tcp.dc._msdcs.<domain>

Brings back the correct info:

Server:  <dc name>.<domain>
Address:  xxx.xxx.xxx.xxx

_ldap._tcp.dc._msdcs.<domain>   SRV service location:
  priority       = 0
  weight         = 100
  port           = 389
  svr hostname   = <dc name>.<domain>
<dc name>.<domain>  internet address = xxx.xxx.xxx.xxx

I can ping the DC from the fileserver and I can ping the fileserver from the DC.

What the heck is going on?! Why can't my fileserver join our domain?

We only have 1 DC set up on our small network (less than 20 users). Surely, I'm missing something?

EDIT: Oh, yeah, the DC is also the DNS server and on the fileserver it's primary DNS server is the DC. EDIT2: The DC is a Win Server 2k3 box

We have a computer on our network with some network shares. This computer is NOT part of our domain. In order to allow certain users to access the network shares, we have been creating local accounts on the computer with the same user name and password as the active directory user and adding those (local) users to the permissions list.

For example, this computer (TestComputer) has a local user (UserA) that has been given Full Control of a shared folder (TestFolder). There is also an active directory user with the same name (TESTDOMAIN\UserA). UserA can now browse to \\TestComputer\TestFolder and read or write to it.

What we want to do is join TestComputer to our domain and then give permissions to the active directory user (TESTDOMAIN\UserA) instead and eventually delete the local user (UserA) from TestComputer.

It looks like here shows that joining a computer to a domain doesn't mess with the local accounts. However, it didn't clarify if anything would happen if those local accounts had the same name as active directory accounts. I just need clarification that I can just simply join the computer to the domain, replace the local user permissions with the active directory user and delete (maybe disable) the local user account.

I'm trying to set up a MS SQL 2000 server to use an already existing SSL certificate installed on the server.

I verified that the certificate shows up in the Personal/Certificate folder of the account that is running the MSSQLSERVER service using the Certificate MMC snap-in.

I also verified that the certificate for the CA is installed under the Trusted Root Certificate Authorities.

Additionally, to make sure that it is using this specific certificate I created a Certificate registry value of type REG_BINARY in:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer\SuperSocketNetLib 

and I set it to the certificates thumbprint like it mentions in: http://support.microsoft.com/kb/276553

Finally, I opened up the Server Network Utility, checked Force protocol encryption, clicked OK, and restarted the MSSQLSERVER service.

Unfortunately, it fails to start and looking at the event log it's failing with:

19015: 
Encryption requested but no valid certificate was found. SQL Server terminating.

I'm at a loss. Any ideas? Where did I go wrong?