Windows Active Directory Login Issue

Question

For some reason, any new domain users created on Windows Server 2003's Active Directory cannot login to the domain. However, existing domain users can login just fine.

I have even tried copying an existing user (who can login) and then giving the new user a new username and a password.

What's causing this? I have recently updated the server with the latest update. I am not sure if it is related.

Solution

One possibility...

You may have a DNS or other Active Directory issue on your domain preventing PC's from contacting a domain controller, and since "existing" users have already logged into their PCs, they're simply logging in under their cached account.

Quick litmus test - if you go to a PC in the domain and ping domainname.local (where domainname.local is the FQDN of your domain, but does not contain any server name), do you get the IP address for one of your domain controllers?

Comments

[Paolo_Mulder]

Please give more detail about the logon failure. What error message do the users receive when they try to log on?

[Spence]

+1 for Jay - I am so sick of people reporting "can't logon" errors. There is an ERROR MESSAGE displayed when you "can't logon". READ IT. sigh

[Kejml]

Or another test, a user who can successfully login to their own machine, can they log on to a machine they've never logged on to before?

[Kejml]

Poster needs to clarify how many domain controllers there are, and their relative location.

[Sean Earp]

If you only have one Domain Controller, then replication is not your problem. Back to the original comments, what exact error message to users get when trying to log on? Were things working fine before you installed the "latest update"? What was the "latest update" that you installed? What happens if you uninstall that update?