I ran across several Astaro User Forum posts telling people the same things over and over about what to check, and none of it was helping.

I’ll try and give a run through of some error message appearances from the Fallback error log, and what you should do to fix them. If you have more, leave them in the comments below, and I’ll add them.

ads_get_dnshostname: No dNSHostName attribute!

You need to make sure you have a Host Name specified in the FQDN style in the Management > System Settings > Hostname tab

ads_keytab_add_entry: unable to determine machine account’s dns name in AD

• You need to make sure your Astaro box doesn’t show up as a Computer listed in Active Directory anywhere there are computers listed, then you need to make sure there is a DNS Host (A) entry for your hostname, and also you need to reboot your Active Directory and/or DNS server. (For me, they were the same Windows SBS Box, but a reboot fixed this error message.)

»clock skew too great«

• You need to make sure the Time & Date on both the Astaro box and the Active Directory server are no more than 5 minutes apart.

»pre-authentication failed«

Make sure the Username/Password you're using to join the domain are correct. They should look like the image above.

Below is the fix that finally worked for me, but I never saw anything in the User Forums (or anywhere else, for that matter) related to these error codes and the Astaro box (only to Samba and Linux Servers).

libsmb/clientgen.c:cli_receive_smb

rpc_client/cli_pipe.c:rpc_api_pipe

pipe \lsarpc fnum

• This means that the Intrusion Prevention System is preventing the Active Directory server from approving the Active Directory join. You need to create an Exception like this:

Go to Network Security > Intrusion Prevention > Exceptions and create a new Exception that Skips "Intrusion Prevention" and list the Active Directory Server in the Source Network area.

I’m sure there are probably more items in the Fallback error logs that folks have encountered. Surprisingly, I didn’t even come across this PDF document detailing a lot of them during my searches until I was researching the error codes for this post. Check that document out and see if your answer is in there.

The main rebuttals from most of the “suggestions” you’ll find on the User Forums are:

1. You don’t need to create a Pre-Win2000 Computer in Active Directory for this to work.
2. You can’t have an existing computer entry in Active Directory for the hostname you’ve given your Astaro box.
3. You should create a DNS Host (A) entry for the Astaro box, if you run a DNS server outside of the Astaro box
4. The Time & Date on both the Server and Astaro Box need to be within 5 minutes of each other.
5. You don’t have to be able to ping the Astaro box from the server for this to work.
6. You do have to be able to ping the Active Directory server from the Astaro box’s Support > Tools area
7. Domains ending in .local will work.
8. You don’t have to use all CAPS when filling in the hostname  & domain name, but it’s suggested by the Astaro people. It won’t make a difference to DNS – CAPS or lowercase both resolve the same.

As I mentioned above, if you have any other error messages or tips or suggestions, etc., related to getting the Astaro box on the domain, please post them in the comments. Too many people have spent too long trying to get things to work simply because the information wasn’t out there when they were searching.

Technorati Tags: active directory, ads_get_dnshostname, ads_keytab_add_entry, ASG 120, astaro, astaro sg 120, authentication, can't join domain, clientgen.c:cli_receive_smb, cli_pipe.c:rpc_api_pipe, clock skew too great, Fallback logs, Intrusion Prevention, joining domain failed, Kerberos, pipe \lsarpc fnum, RPC, rpc_client, Samba, SSO astaro

“The connection to the Microsoft Exchange Server is unavailable. Outlook must be online or connected to complete this action.”

The user could not connect to Exchange via Outlook 2007, nor via IE8. Firefox worked just fine after adding the https exception for our server’s self-signed certificate. So the problem wasn’t Outlook, nor was it a problem with the server. It had to be a problem with the network connection – but up to 7 system restarts still hadn’t fixed the issue. There were no proxies, IE8 was reset to manufacturer’s defaults, and the server’s domain name was put into the Trusted Sites list on IE.

After a lot of searching the internet, and talking with [Wizard] a troubleshooting step hit me: Create a new user profile and see if you can set up Outlook.

I switched-user on the computer, and tried to log into an account that was not previously set up on the computer and got:

“There are no logon servers available to service the logon request”

I immediately knew the problem was the computer’s Active Directory entry. I had seen this same error message on another computer that was recently brought to the office from my boss’s home, and had to be taken out of Active Directory, and put back in. As I go to remove the computer, I realize the computer name is exactly the same as one of the 2 computer the boss brought from home.

A couple months ago, we bought 4 identical computers, 3 of which stayed here, and the 4th one went to the boss’s home. The 3 here were named GX740-VB1, -VB2, and -VB3. Apparently the one that went to the boss’s home was also named GX740-VB2. When he brought it back last week, and wanted me to get it set up to be deployed before end-of-day Friday, I did just that.

Simultaneously, the person who sat at the original VB2 left early Friday, and shut off his computer so the pending password expiration wouldn’t lock him out over the weekend. He left at 4:00, I installed the newly finished computer at 4:30 – and there were no problems Friday. But there were now two computers on the network with the same NETBIOS name.

This morning, he rebooted his computer per his Windows Updates, and when he logged back in, he was logged into a cached profile, and his Outlook stopped working. But his shared network drives and everything else on the network cached his credentials and continued to function like normal.

Solution

If you find yourself with the “The connection to the Microsoft Exchange Server is unavailable. Outlook must be online or connected to complete this action.” Error message on Outlook, and Work Offline doesn’t let you open the Outlook client, then it’s possible that there is another computer on the network with the same NETBIOS name or same IP as you, and they have claimed ownership of that identity in Active Directory.

Change the computer name, or the IP of the offending computer, and it should fix it. You might have to drop the computer from the domain, change the computer name, and then re-add the computer to the domain as I had to.

Technorati Tags: active directory, cannot connect, Exchange, Exchange 2003, Exchange Server 2003, netbios, network identification conflict, Outlook 2003, Outlook 2007, outlook error

• Their passwords are going to have to change at some point, due to security policy.
• When they change it on their desktop, it’s not automatically done on their laptop.
• After changing the desktop password, they need to connect the laptop to the network and then login with that new password for it to be cached.

Now, it’s easy to write out, and easy for a tech to understand the scenario – but it’s not that easy for a 45yr old Hispanic guy who hates his laptop anyway to grasp. But what if they didn’t have to grasp anything? What if no matter where you were, the login process and the features available were as seamless in Wisconsin as if you were sitting at your desk in Texas?

What I’m proposing is this:

• Internet is gained through the use of a mobile AirCard, that is set to automatically connect once plugged in. If no AirCard, some other form of high-speed internet would suffice, and possibly be preferred.
• Use OpenVPN as a system service that runs when Windows boots. It makes its connection to the Main Network with a PSK (pre-shared key), authenticates, and then routes all internet and network traffic through that connection.
• A Windows or Linux client that has been previously joined to the Active Directory Domain on campus.

Upon boot, the computer connects to the internet, and then sets up the VPN connection to the main campus. This is done as a Windows or Linux service. When the login prompt appears, the user enters their most recent credentials for the main campus, and logs in. These credentials are then passed through the secured VPN to the main campus, authenticated against LDAP or AD, and their group policies, logon scripts, and other drive mappings are passed back down to the client. After the personal settings have loaded, their laptop experience is just as it would be if they were on the main campus LAN – but all their traffic is secured, and over a WAN.

Can it be done? Has it been done? Is there a step I’m missing – or some important brick preventing it?

Blogged with Flock

Tags: openvpn, network, windows, linux, authentication, active directory, PSK, WAN, LAN, mobile, laptop, connection, internet, security, group policy

Technorati Tags: active directory, aircard, client, computer, desktop password, directory domain, Domain, drive mappings, group, group policies, high speed internet, laptop, ldap, Linux, network, network traffic, openvpn, passwords, personal settings, PSK, scripts, security, security policy, technology, University, user, vpn connection, WAN, Windows