Logon Problemi

Merhaba, sanırım PC leri imaj ile kuruyorsunuz, PC leri imaj ile kurduktan sonra sysprep yapmanız gerekli.

Hocam Pcler 2 senedir imajla kuruluyor ve sadece pc değil serverlarda da oluyor 1 dc 2 adc var onlarda bile oldu bu sorun restart edince açılıyor 

Imaj ile kurulması normal, sysprep yapılmıyor olması anormal. Sysprep yapmalısınız bu doğru olan eğer yapmazsanız bunu gibi başka sorunlarda yaşarsınız.

Hocam sysprep li olarak atıyoruz Windows deployment kullanıyoruz bunda sysprep olmadan zaten imaj alınamıyor serverlarda ise imaj atmıyoruz imajdan kaynaklı olduğunu düşünmüyorum

Bu en bilinen sorundu, ama tabiki illaki sorun bu demek değil, ne yazık ki pe çok şirkette benzer sorunlar gördüm. Sen sysprep yapıyor isen imajlarına ve ondan sonra dağıtıyorsan süper.

o zaman genel olarak bu sorunu yaşadığımızda takip ettiğimiz aşağıdaki adımları takip etmek zorundasın;

Duplicate DNS entries
Most of the configurations gives the KRB_AP_ERR_MODIFIED error because of old DNS entries on your DNS server are not removed. Simply remove these so you only have one IP address per server and one server per IP address (use the sort on the DNS Manager to find duplicates). Also check the reverse lookup zone as the Kerberos use this lookup to make the server-match. And remember the replication delay for other DNS servers and the DNS-timeout on clients before testing – better wait a couple of minutes (or up to 30 min. for auto-repl.)

2.Multiple or missing SPN entries
The SPN’s are configured and centrally stored in your KDC in Active Directory. You only need mapping the http-type to your Application Pool account. If you map these to more accounts/servers or do not map those correctly you get the error. Remember that the host-type is used if no http are configured. Check for multiple mappings with the command:

ldifde -d "dc=domain,dc=local" -r "servicePrincipalName=http*" -p subtree -l "dn,servicePrincipalName" -f output.txt

The http/NETBIOS and http/FQDN must only appear on one of the objects. Remove the ones that are not on the Application Pool Account. And if none is configured for that account you must of course map the SPN to it.

Note: It could be that the SPN’s are case-sentitive, so check your server- and domain-names just in case! (See Shane Young’s blog entry)

1.Computer account secure connection
Some clients/servers fail to setup a correct secure connection with the domain. If this happens you need to reset and rebuild this. Follow this link to Microsoft Knowledgebase article KB216393 http://support.microsoft.com/kb/216393/en-us for instructions.

If your server/client has been cloned you need to generate a new security ID (SID) and the recommended way to do this is to run the Microsoft sysprep-utility. Another way is to use the former Sysinternals, now Microsoft, utility NewSID.

2.Issues with the MTU Size
The network packets that are send through the wires have a certain length. If an account is member of a large number of groups this have been seen. Another way to deal with the MTU-problem is to force the Kerberos to use TCP. You can find information about this in Microsoft knowledgebase article KB244474 ( http://support.microsoft.com/kb/244474/en-us )