Slow password change on domain

[Swiftie]

Hi guys

Have a bit of mistery issue that has cropped up and I'm trying to assit to look into it, but want to seek advice as so far nothing has stuck out.

The setup is a Windows 7 clients, mixture of 32 and 64bit SP1. Domain controller is Windows 2008 R2 SP1.

Domain controller is hosted on a VPS, no local DC on site. There is a S2S vpn between the office to the VPS server with a good up/down link between the two.

PC's are joined to the domain and functioning, its only this 1 niggly thing that has cropped up now when a user changes the password via CTRL + ALT + DELETE and it takes over 2 minutes from hitting the arrow to submit the change to getting a confirmation to say the password was changed. If you hit CTRL + ALT + DELETE whilst the screen is stuck on "Changing Password" with the wheel spinning then you get the confirmation that the password was changed and password definitely gets updated.

Anybody have any ideas on why the password change has a delay if you leave it to complete by itself?

[stumper66]

I would start by checking the following:

• DNS: Can it resolve the domain and all domain controllers? Are the IP addresses correct?
  
• Run a diagnostic check for active directory. I can't remember how exactly but dcdiag sounds right.
  
• Check event viewer on the domain controller and clients for any clues on related errors.
  
• What domain functional level is the forest and domain? May want to raise them to Server 2008 R2 if not already.
  
• How is the latency and bandwidth between the DC and client site?
  

[Swiftie]

I would start by checking the following:

• DNS: Can it resolve the domain and all domain controllers? Are the IP addresses correct?
  
• Run a diagnostic check for active directory. I can't remember how exactly but dcdiag sounds right.
  
• Check event viewer on the domain controller and clients for any clues on related errors.
  
• What domain functional level is the forest and domain? May want to raise them to Server 2008 R2 if not already.
  
• How is the latency and bandwidth between the DC and client site?
  

Thanks for the response.

Latency between DC and client is around the 10ms mark average.

PC's can resolve the domain and DNS is correct with the settings being picked up from the server.

No issues found with DCDiag and event logs on server and client are clean with no obvious errors to highlight the cause of the delay.

At the moment my suggestion has been to put a local DC onsite which can then replicate to the VPS DC.

[+John Teacake MVC]

This might help you...

http://technet.microsoft.com/library/cc732801%28WS.10%29.aspx

[sc302 Veteran]

high latency over the vpn would cause the issue. a local dc would fix the issue.

[TyRmYz]

We had similar problems in our remote office. about 200 pc.s there XP SP3 and Windows 7 32/64-bits.

First we tried Slowlink mode and that helped much, but final solution was that we added RODC, now everything works nicly there.

[Swiftie]

Can I bump this for a revisit for your thoughts please

I'm basically still experiencing the same issues as what I've already highlighted in my previous posts and what this user has posted here -> http://social.technet.microsoft.com/Forums/en-US/itprovistanetworking/thread/06dce842-c6dc-4e1f-9f86-7fd7a0a55191

We have implemented a DC locally and there is a DC in a remote site linked via S2S, I've checked the PC logon server and it is the local server, not the remote server. But yet when I try and do a password change. IT JUST TAKES an age...

[sc302 Veteran]

Something doesn't sound right withy the network setup. Could be active directory, could be Dns, could be replication..... Any event logs on the servers (system, application, security, Dns, replication).

[Arkos Reed]

If there's a firewall between the computers and the DC, I would look at that... Typically dynamic RPC ports allocation. Try to restrict the ports used for RPC by the domain controllers and make sure the now fixed tcp port range is open on the firewall.

Have a look at these KBs

http://bensjibberjabber.wordpress.com/2011/07/26/configuring-domain-controllers-to-use-fixed-rpc-ports-behind-firewalls/

http://support.microsoft.com/kb/832017

http://support.microsoft.com/kb/154596

[Swiftie]

Something doesn't sound right withy the network setup. Could be active directory, could be Dns, could be replication..... Any event logs on the servers (system, application, security, Dns, replication).

Well AD replication tests out fine, No critical errors in my dcdiag and also dcdiag /test:dns and repadmin /showrepl * /errorsonly comes back clean. I can PM or post the outputs if it will help.

With regars to event logs, apart from some errors that may have been caused when I was changing some of the settings. There is nothing that stick out from the server end. Once again, I'm happy to get this posted if it will help. From the client (workstation) side, everything event wise is so clean, I wish something was erroring out.. :(

If there's a firewall between the computers and the DC, I would look at that... Typically dynamic RPC ports allocation. Try to restrict the ports used for RPC by the domain controllers and make sure the now fixed tcp port range is open on the firewall.

Have a look at these KBs

http://bensjibberjab...hind-firewalls/

http://support.microsoft.com/kb/832017

http://support.microsoft.com/kb/154596

Well the local DC and workstation are now all within the same network with obviously a firewall protecting that whole network. So don't think if the above will help, but will keep in mind.Windows firewall is disabled.

[Guest]

I would start with DNS, DNS and then erm DNS. Lastly look into Sites and Services to make sure your subnets are correct.

[sc302 Veteran]

Short of remoting in and seeing what is going on, all I can do is ask to see your dhcp scope properties and your dns tabs as well as your dns tree itself. You can pm it to me if you wish.