Recommended Posts

ive looked through all the mods that have been done and there is nothing that could really stuff this up, but i found some things on the audit logs on the server

so ive included everything that it has from the login i used to add the account

Event Type: Success Audit

Event Source: Security

Event Category: Logon/Logoff

Event ID: 538

Date:  1/01/2005

Time:  2:50:19 PM

User:  JHOME\jamesas

Computer: CURLY

Description:

User Logoff:

  User Name: jamesas

  Domain:  JHOME

  Logon ID:  (0x0,0x211B42)

  Logon Type: 3

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Success Audit

Event Source: Security

Event Category: Account Management

Event ID: 646

Date:  1/01/2005

Time:  2:50:18 PM

User:  JHOME\jamesas

Computer: CURLY

Description:

Computer Account Changed:

  -

  Target Account Name: STINGER$

  Target Domain: JHOME

  Target Account ID: JHOME\STINGER$

  Caller User Name: jamesas

  Caller Domain: JHOME

  Caller Logon ID: (0x0,0x211B42)

  Privileges: -

Changed Attributes:

  Sam Account Name: -

  Display Name: -

  User Principal Name: -

  Home Directory: -

  Home Drive: -

  Script Path: -

  Profile Path: -

  User Workstations: -

  Password Last Set: -

  Account Expires: -

  Primary Group ID: -

  AllowedToDelegateTo: -

  Old UAC Value: 0x80

  New UAC Value: 0x81

  User Account Control:

  Account Disabled

  User Parameters: -

  Sid History: -

  Logon Hours: -

  DNS Host Name: -

  Service Principal Names: -

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Success Audit

Event Source: Security

Event Category: Account Management

Event ID: 629

Date:  1/01/2005

Time:  2:50:18 PM

User:  JHOME\jamesas

Computer: CURLY

Description:

User Account Disabled:

  Target Account Name: STINGER$

  Target Domain: JHOME

  Target Account ID: JHOME\STINGER$

  Caller User Name: jamesas

  Caller Domain: JHOME

  Caller Logon ID: (0x0,0x211B42)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Success Audit

Event Source: Security

Event Category: Directory Service Access

Event ID: 565

Date:  1/01/2005

Time:  2:50:18 PM

User:  JHOME\jamesas

Computer: CURLY

Description:

Object Open:

  Object Server: Security Account Manager

  Object Type: SAM_DOMAIN

  Object Name: DC=JHOME,DC=ath,DC=cx

  Handle ID: 47271400

  Operation ID: {0,2169795}

  Process ID: 528

  Process Name: C:\WINDOWS\system32\lsass.exe

  Primary User Name: CURLY$

  Primary Domain: JHOME

  Primary Logon ID: (0x0,0x3E7)

  Client User Name: jamesas

  Client Domain: JHOME

  Client Logon ID: (0x0,0x211B42)

  Accesses: DELETE

  READ_CONTROL

  WRITE_DAC

  WRITE_OWNER

  ReadPasswordParameters

  WritePasswordParameters

  ReadOtherParameters

  WriteOtherParameters

  CreateUser

  CreateGlobalGroup

  CreateLocalGroup

  GetLocalGroupMembership

  ListAccounts

 

  Privileges: -

  Properties:

---

domain

DELETE

READ_CONTROL

WRITE_DAC

WRITE_OWNER

ReadPasswordParameters

WritePasswordParameters

ReadOtherParameters

WriteOtherParameters

CreateUser

CreateGlobalGroup

CreateLocalGroup

GetLocalGroupMembership

ListAccounts

  Domain Password & Lockout Policies

  lockOutObservationWindow

  lockoutDuration

  lockoutThreshold

  maxPwdAge

  minPwdAge

  minPwdLength

  pwdHistoryLength

  pwdProperties

  Other Domain Parameters (for use by SAM)

  serverState

  serverRole

  modifiedCount

  uASCompat

  forceLogoff

  domainReplica

  oEMInformation

  Domain Administer Server

  Access Mask: 0

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Success Audit

Event Source: Security

Event Category: Logon/Logoff

Event ID: 538

Date:  1/01/2005

Time:  2:50:18 PM

User:  JHOME\jamesas

Computer: CURLY

Description:

User Logoff:

  User Name: jamesas

  Domain:  JHOME

  Logon ID:  (0x0,0x211B8C)

  Logon Type: 3

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Success Audit

Event Source: Security

Event Category: Logon/Logoff

Event ID: 540

Date:  1/01/2005

Time:  2:50:18 PM

User:  JHOME\jamesas

Computer: CURLY

Description:

Successful Network Logon:

  User Name: jamesas

  Domain:  JHOME

  Logon ID:  (0x0,0x211B8C)

  Logon Type: 3

  Logon Process: Kerberos

  Authentication Package: Kerberos

  Workstation Name:

  Logon GUID: {b5971aae-3c83-4c93-27a7-551b90b7b6bf}

  Caller User Name: -

  Caller Domain: -

  Caller Logon ID: -

  Caller Process ID: -

  Transited Services: -

  Source Network Address: 192.168.0.21

  Source Port: 1552

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Success Audit

Event Source: Security

Event Category: Privilege Use

Event ID: 576

Date:  1/01/2005

Time:  2:50:18 PM

User:  JHOME\jamesas

Computer: CURLY

Description:

Special privileges assigned to new logon:

  User Name: jamesas

  Domain:  JHOME

  Logon ID:  (0x0,0x211B8C)

  Privileges: SeChangeNotifyPrivilege

  SeBackupPrivilege

  SeRestorePrivilege

  SeDebugPrivilege

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Link to comment
https://www.neowin.net/forum/topic/265015-joining-domain/#findComment-585208280
Share on other sites

Is your PC getting DHCP and DNS from the Server. Check on the server to see if the computer has already been created. If so delete it and try to join again. Can you ping the server by IP. Check if you have a firewall on both machines. Cause it seems like it cannot comunicate via RPC. Make sure the RPC services are started on both the server and the workstation.

Have fun!!!

Link to comment
https://www.neowin.net/forum/topic/265015-joining-domain/#findComment-585230558
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.