Hi,
I have a remote site (with 4 workstation) connected over a VPN WAN
(site-to-site VPN) to my corporate Head Office. All the Domain controllers
are located in the Head-Office. Suddenly my workstation in the remote site
are experiencing difficulties for longing into the domain (login takes a long
time) and access network resources. I have connectivity with the domain
controller because I can ping them and also resolve their name through DNS.

I can not find any error\warning events on the Domain Controller but on my
the workstations I get the following warning\error messages:

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1006
Date: 10/9/2008
Time: 9:57:09 PM
User: NT AUTHORITY\SYSTEM
Computer: XXXX-CLARA
Description:
Windows cannot bind to xxx.xxx.com domain. (Timeout). Group Policy
processing aborted.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.




Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date: 10/9/2008
Time: 9:57:09 PM
User: NT AUTHORITY\SYSTEM
Computer: XXXX-CLARA
Description:
Windows cannot query for the list of Group Policy objects. A message that
describes the reason for this was previously logged by the policy engine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 10/9/2008
Time: 11:35:27 PM
User: N/A
Computer: XXXX-CLARA
Description:
The Security System detected an attempted downgrade attack for server
LDAP/xxxx.corp.xxx.com. The failure code from authentication protocol
Kerberos was "There are currently no logon servers available to service the
logon request.
(0xc000005e)".

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.





Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40961
Date: 10/9/2008
Time: 11:35:27 PM
User: N/A
Computer: XXXX-CLARA
Description:
The Security System could not establish a secured connection with the server
LDAP/xxxx.corp.xxxxx.com. No authentication protocol was available.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: MRxSmb
Event Category: None
Event ID: 3019
Date: 10/9/2008
Time: 11:28:56 PM
User: N/A
Computer: XXXX-CLARA
Description:
The redirector failed to determine the connection type.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 04 00 4e 00 ......N.
0008: 00 00 00 00 cb 0b 00 80 ....Ë..€
0010: 00 00 00 00 84 01 00 c0 ....„..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

I am lost because I do not know what is causing the problem (is it the
domain controller or the workstation, or is it the WAN connectivity between
the workstation and the domain controller)

My domain controllers are running Windows Server 2003 standard edition SP1
and my workstation are running Windows XP SP2 .

Regards,

--
Screech

Any errors if using nslookup to check the DNS status?

--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com
"Screech" <Screech@discussions.microsoft.com> wrote in message
news:5CCBCA56-5D74-4785-B7EC-0EA96FC735A0@microsoft.com...

Quote:

Hi, I have a remote site (with 4 workstation) connected over a VPN WAN (site-to-site VPN) to my corporate Head Office. All the Domain controllers are located in the Head-Office. Suddenly my workstation in the remote site are experiencing difficulties for longing into the domain (login takes a long time) and access network resources. I have connectivity with the domain controller because I can ping them and also resolve their name through DNS. I can not find any error\warning events on the Domain Controller but on my the workstations I get the following warning\error messages: Event Type: Error Event Source: Userenv Event Category: None Event ID: 1006 Date: 10/9/2008 Time: 9:57:09 PM User: NT AUTHORITY\SYSTEM Computer: XXXX-CLARA Description: Windows cannot bind to xxx.xxx.com domain. (Timeout). Group Policy processing aborted. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Event Type: Error Event Source: Userenv Event Category: None Event ID: 1030 Date: 10/9/2008 Time: 9:57:09 PM User: NT AUTHORITY\SYSTEM Computer: XXXX-CLARA Description: Windows cannot query for the list of Group Policy objects. A message that describes the reason for this was previously logged by the policy engine. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Event Type: Warning Event Source: LSASRV Event Category: SPNEGO (Negotiator) Event ID: 40960 Date: 10/9/2008 Time: 11:35:27 PM User: N/A Computer: XXXX-CLARA Description: The Security System detected an attempted downgrade attack for server LDAP/xxxx.corp.xxx.com. The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request. (0xc000005e)". For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Event Type: Warning Event Source: LSASRV Event Category: SPNEGO (Negotiator) Event ID: 40961 Date: 10/9/2008 Time: 11:35:27 PM User: N/A Computer: XXXX-CLARA Description: The Security System could not establish a secured connection with the server LDAP/xxxx.corp.xxxxx.com. No authentication protocol was available. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Event Type: Warning Event Source: MRxSmb Event Category: None Event ID: 3019 Date: 10/9/2008 Time: 11:28:56 PM User: N/A Computer: XXXX-CLARA Description: The redirector failed to determine the connection type. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 00 00 00 00 04 00 4e 00 ......N. 0008: 00 00 00 00 cb 0b 00 80 ....Ë..€ 0010: 00 00 00 00 84 01 00 c0 ....„..À 0018: 00 00 00 00 00 00 00 00 ........ 0020: 00 00 00 00 00 00 00 00 ........ I am lost because I do not know what is causing the problem (is it the domain controller or the workstation, or is it the WAN connectivity between the workstation and the domain controller) My domain controllers are running Windows Server 2003 standard edition SP1 and my workstation are running Windows XP SP2 . Regards, -- Screech

I finally solved the problem:

netdiag.exe showed that I was having difficulties communicating with the
Domain Controllers using LDAP. Furher research showd that this was being
caused by a mismatch in MTU size between the two ends of the VPN tunnel. I
was able to solve the problem by applying the hotfix KB898060 to my windows
server 2003 R2 . Running netdiag on my XP clients after the apllication of
the hotfix on the servers confirmed that the problem has been resolved.

Regards,
--
Screech


"Screech" wrote:

Quote:

Hi, I have a remote site (with 4 workstation) connected over a VPN WAN (site-to-site VPN) to my corporate Head Office. All the Domain controllers are located in the Head-Office. Suddenly my workstation in the remote site are experiencing difficulties for longing into the domain (login takes a long time) and access network resources. I have connectivity with the domain controller because I can ping them and also resolve their name through DNS. I can not find any error\warning events on the Domain Controller but on my the workstations I get the following warning\error messages: Event Type: Error Event Source: Userenv Event Category: None Event ID: 1006 Date: 10/9/2008 Time: 9:57:09 PM User: NT AUTHORITY\SYSTEM Computer: XXXX-CLARA Description: Windows cannot bind to xxx.xxx.com domain. (Timeout). Group Policy processing aborted. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Event Type: Error Event Source: Userenv Event Category: None Event ID: 1030 Date: 10/9/2008 Time: 9:57:09 PM User: NT AUTHORITY\SYSTEM Computer: XXXX-CLARA Description: Windows cannot query for the list of Group Policy objects. A message that describes the reason for this was previously logged by the policy engine. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Event Type: Warning Event Source: LSASRV Event Category: SPNEGO (Negotiator) Event ID: 40960 Date: 10/9/2008 Time: 11:35:27 PM User: N/A Computer: XXXX-CLARA Description: The Security System detected an attempted downgrade attack for server LDAP/xxxx.corp.xxx.com. The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request. (0xc000005e)". For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Event Type: Warning Event Source: LSASRV Event Category: SPNEGO (Negotiator) Event ID: 40961 Date: 10/9/2008 Time: 11:35:27 PM User: N/A Computer: XXXX-CLARA Description: The Security System could not establish a secured connection with the server LDAP/xxxx.corp.xxxxx.com. No authentication protocol was available. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Event Type: Warning Event Source: MRxSmb Event Category: None Event ID: 3019 Date: 10/9/2008 Time: 11:28:56 PM User: N/A Computer: XXXX-CLARA Description: The redirector failed to determine the connection type. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 00 00 00 00 04 00 4e 00 ......N. 0008: 00 00 00 00 cb 0b 00 80 ....Ë..€ 0010: 00 00 00 00 84 01 00 c0 ....„..À 0018: 00 00 00 00 00 00 00 00 ........ 0020: 00 00 00 00 00 00 00 00 ........ I am lost because I do not know what is causing the problem (is it the domain controller or the workstation, or is it the WAN connectivity between the workstation and the domain controller) My domain controllers are running Windows Server 2003 standard edition SP1 and my workstation are running Windows XP SP2 . Regards, -- Screech