Вопросы по серверной части Windows Server 2003 - [36] :: В помощь системному администратору

Имеется один домен, один лес, один сайт.
3 контроллера домена, один Citrix Metaframe Presentation Server. на DC серверах недавно стала появляться ошибка:
Источник: AutoEnrollment
Код (ID) 13
Автоматическая подача заявки на сертификат Локальная система: не удалось подать заявку на один сертификат Контроллер домена (0x80070005). Отказано в доступе.
DC сервера:
POSTGATE (все роли, PDC)
DISTANT
DONOR

компьютер лицензирования CTXSW (Citrix сервер).

NETDIAG с него:
F:\Program Files\Support Tools>netdiag

.......................................

Computer Name: CTXSW
DNS Host Name: ctxsw.ДОМЕН.ru
System info : Microsoft Windows Server 2003 (Build 3790)
Processor : x86 Family 15 Model 4 Stepping 1, GenuineIntel
List of installed hotfixes :
KB833407
KB890046
KB893756
KB896358
KB896422
KB896424
KB896428
KB898715
KB899587
KB899588
KB899589
KB899591
KB900725
KB901017
KB901214
KB902400
KB904706
KB905414
KB905915
KB908519
KB908531
KB910437
KB911280
KB911562
KB911567
KB911927
KB912919
KB913446
KB914388
KB914389
KB917344
KB917422
KB917537
KB917734
KB917953
KB918439
KB920213
KB920214
KB920670
KB920683
KB920685
KB921398
KB921883
KB922582
KB922616
KB922760
KB922819
KB923191
KB923414
KB923980
KB924191
KB924496
KB925486
Q147222

Netcard queries test . . . . . . . : Passed
GetStats failed for '¦Ё ьющ ярЁрыыхы№эvщ яюЁЄ'. [ERROR_NOT_SUPPORTED]
[WARNING] The net card '¦шэшяюЁЄ WAN (PPTP)' may not be working because it h
as not received any packets.
[WARNING] The net card '¦шэшяюЁЄ WAN (PPPoE)' may not be working because it
has not received any packets.
[WARNING] The net card '¦шэшяюЁЄ WAN (IP)' may not be working because it has
not received any packets.
[WARNING] The net card '¦шэшяюЁЄ WAN (TхЄхтющ ьюэшЄюЁ)' may not be working b
ecause it has not received any packets.
GetStats failed for '¦шэшяюЁЄ WAN (L2TP)'. [ERROR_NOT_SUPPORTED]

Per interface results:

Adapter : ¦юфъы¦ўхэшх яю ыюъры№эющ ёхЄш

Netcard queries test . . . : Passed

Host Name. . . . . . . . . : ctxsw
IP Address . . . . . . . . : 192.168.2.7
Subnet Mask. . . . . . . . : 255.255.255.0
Default Gateway. . . . . . : 192.168.2.4
Primary WINS Server. . . . : 192.168.2.2
Secondary WINS Server. . . : 192.168.2.9
Dns Servers. . . . . . . . : 192.168.2.2
192.168.2.12

IpConfig results . . . . . : Failed
Pinging the Secondary WINS server 192.168.2.9 - not reachable

AutoConfiguration results. . . . . . : Passed

Default gateway test . . . : Failed
No gateway reachable for this adapter.

NetBT name test. . . . . . : Passed
[WARNING] At least one of the <00> 'WorkStation Service', <03> 'Messenge
r Service', <20> 'WINS' names is missing.

WINS service test. . . . . : Passed

Global results:

Domain membership test . . . . . . : Passed

NetBT transports test. . . . . . . : Passed
List of NetBt transports currently configured:
NetBT_Tcpip_{2ADB11FB-478A-465A-BE3B-C7383E54CD87}
1 NetBt transport currently configured.

Autonet address test . . . . . . . : Passed

IP loopback ping test. . . . . . . : Passed

Default gateway test . . . . . . . : Failed

[FATAL] NO GATEWAYS ARE REACHABLE.
You have no connectivity to other network segments.
If you configured the IP protocol manually then
you need to add at least one valid gateway.

NetBT name test. . . . . . . . . . : Passed
[WARNING] You don't have a single interface with the <00> 'WorkStation Servi
ce', <03> 'Messenger Service', <20> 'WINS' names defined.

Winsock test . . . . . . . . . . . : Passed

DNS test . . . . . . . . . . . . . : Passed

Redir and Browser test . . . . . . : Passed
List of NetBt transports currently bound to the Redir
NetBT_Tcpip_{2ADB11FB-478A-465A-BE3B-C7383E54CD87}
The redir is bound to 1 NetBt transport.

List of NetBt transports currently bound to the browser
NetBT_Tcpip_{2ADB11FB-478A-465A-BE3B-C7383E54CD87}
The browser is bound to 1 NetBt transport.

DC discovery test. . . . . . . . . : Passed

DC list test . . . . . . . . . . . : Passed

Trust relationship test. . . . . . : Passed
Secure channel for domain 'ДОМЕН' is to '\\postgate.ДОМЕН.ru'.
Cannot test secure channel for domain 'ДОМЕН' to DC 'distant'. [ERROR_NO_L
OGON_SERVERS]
Cannot test secure channel for domain 'ДОМЕН' to DC 'donor'. [ERROR_NO_LOG
ON_SERVERS]

Kerberos test. . . . . . . . . . . : Passed

LDAP test. . . . . . . . . . . . . : Passed

Bindings test. . . . . . . . . . . : Passed

WAN configuration test . . . . . . : Skipped
No active remote access connections.

Modem diagnostics test . . . . . . : Passed

IP Security test . . . . . . . . . : Skipped

Note: run "netsh ipsec dynamic show /?" for more detailed information

The command completed successfully
**************************************
NETDIAG c POSTGATE
C:\Documents and Settings\novich>netdiag

.......................................

Computer Name: POSTGATE
DNS Host Name: postgate.ДОМЕН.ru
System info : Microsoft Windows Server 2003 R2 (Build 3790)
Processor : x86 Family 15 Model 4 Stepping 1, GenuineIntel
List of installed hotfixes :
KB924667-v2
KB925902
KB927891
KB929123
KB930178
KB931784
KB931836
KB932168
KB933566-IE7
KB935839
KB935840
KB935966
Q147222

Netcard queries test . . . . . . . : Passed
GetStats failed for '╧Ё ьющ ярЁрыыхы№э√щ яюЁЄ'. [ERROR_NOT_SUPPORTED]
[WARNING] The net card '╠шэшяюЁЄ WAN (PPTP)' may not be working because it h
as not received any packets.
[WARNING] The net card '╠шэшяюЁЄ WAN (PPPoE)' may not be working because it
has not received any packets.
[WARNING] The net card '╠шэшяюЁЄ WAN (IP)' may not be working because it has
not received any packets.
GetStats failed for '╠шэшяюЁЄ WAN (L2TP)'. [ERROR_NOT_SUPPORTED]

Per interface results:

Adapter : ╧юфъы■ўхэшх яю ыюъры№эющ ёхЄш 2

Netcard queries test . . . : Passed

Host Name. . . . . . . . . : postgate
IP Address . . . . . . . . : 192.168.2.2
Subnet Mask. . . . . . . . : 255.255.255.0
Default Gateway. . . . . . : 192.168.2.4
Primary WINS Server. . . . : 192.168.2.2
Dns Servers. . . . . . . . : 127.0.0.1
192.168.2.12

AutoConfiguration results. . . . . . : Passed

Default gateway test . . . : Failed
No gateway reachable for this adapter.

NetBT name test. . . . . . : Passed
[WARNING] At least one of the <00> 'WorkStation Service', <03> 'Messenge
r Service', <20> 'WINS' names is missing.

WINS service test. . . . . : Passed

Global results:

Domain membership test . . . . . . : Passed

NetBT transports test. . . . . . . : Passed
List of NetBt transports currently configured:
NetBT_Tcpip_{B6E2AEBF-0938-4721-B8B9-8B8E1A51B581}
1 NetBt transport currently configured.

Autonet address test . . . . . . . : Passed

IP loopback ping test. . . . . . . : Passed

Default gateway test . . . . . . . : Failed

[FATAL] NO GATEWAYS ARE REACHABLE.
You have no connectivity to other network segments.
If you configured the IP protocol manually then
you need to add at least one valid gateway.

NetBT name test. . . . . . . . . . : Passed
[WARNING] You don't have a single interface with the <00> 'WorkStation Servi
ce', <03> 'Messenger Service', <20> 'WINS' names defined.

Winsock test . . . . . . . . . . . : Passed

DNS test . . . . . . . . . . . . . : Passed
PASS - All the DNS entries for DC are registered on DNS server '127.0.0.1' a
nd other DCs also have some of the names registered.
PASS - All the DNS entries for DC are registered on DNS server '192.168.2.12
' and other DCs also have some of the names registered.

Redir and Browser test . . . . . . : Passed
List of NetBt transports currently bound to the Redir
NetBT_Tcpip_{B6E2AEBF-0938-4721-B8B9-8B8E1A51B581}
The redir is bound to 1 NetBt transport.

List of NetBt transports currently bound to the browser
NetBT_Tcpip_{B6E2AEBF-0938-4721-B8B9-8B8E1A51B581}
The browser is bound to 1 NetBt transport.

DC discovery test. . . . . . . . . : Passed

DC list test . . . . . . . . . . . : Passed

Trust relationship test. . . . . . : Skipped

Kerberos test. . . . . . . . . . . : Passed

LDAP test. . . . . . . . . . . . . : Passed

Bindings test. . . . . . . . . . . : Passed

WAN configuration test . . . . . . : Skipped
No active remote access connections.

Modem diagnostics test . . . . . . : Passed

IP Security test . . . . . . . . . : Skipped

Note: run "netsh ipsec dynamic show /?" for more detailed information

The command completed successfully
***************************************
dcdiag с POSTGATE

C:\Documents and Settings\novich>dcdiag

Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\POSTGATE
Starting test: Connectivity
......................... POSTGATE passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\POSTGATE
Starting test: Replications
......................... POSTGATE passed test Replications
Starting test: NCSecDesc
......................... POSTGATE passed test NCSecDesc
Starting test: NetLogons
......................... POSTGATE passed test NetLogons
Starting test: Advertising
......................... POSTGATE passed test Advertising
Starting test: KnowsOfRoleHolders
......................... POSTGATE passed test KnowsOfRoleHolders
Starting test: RidManager
......................... POSTGATE passed test RidManager
Starting test: MachineAccount
......................... POSTGATE passed test MachineAccount
Starting test: Services
......................... POSTGATE passed test Services
Starting test: ObjectsReplicated
......................... POSTGATE passed test ObjectsReplicated
Starting test: frssysvol
......................... POSTGATE passed test frssysvol
Starting test: frsevent
......................... POSTGATE passed test frsevent
Starting test: kccevent
......................... POSTGATE passed test kccevent
Starting test: systemlog
......................... POSTGATE passed test systemlog
Starting test: VerifyReferences
......................... POSTGATE passed test VerifyReferences

Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValidation

Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom

Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation

Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom

Running partition tests on : swgroup
Starting test: CrossRefValidation
......................... swgroup passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... swgroup passed test CheckSDRefDom

Running enterprise tests on : swgroup.ru
Starting test: Intersite
......................... swgroup.ru passed test Intersite
Starting test: FsmoCheck
......................... swgroup.ru passed test FsmoCheck
****************************************************
С двух других DC (DONOR и DISTANT) картина одинаковая.

Предпринятые действия:
Рекомендации с
Eventlog (ERROR 13) помогите разобраться ....
на POSTGATE изменены пермишны на
%system drive%\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys
из ACL убраны "все". оставлены Administrator и System. (на DONOR и DISTANT то же самое)
_________________________________________________
рекомендации с
http://support.microsoft.com/kb/903220
группа DomainControllers добавлена в локальную группу CERTSVC_DCOM_ACCESS на CTXSW.
_________________________________________________
перезагружены DISTANT и POSTGATE.
_________________________________________________
на DISTANT и POSTGATE запущены службы учета лицезий. тип запуска Авто. Были в состоянии Отключено.
_________________________________________________

на CTXSW в консоли:

F:\Documents and Settings\novich>certutil -setreg setupstatus -setup_dcom_security_updated_flag
SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\SetupStatus:

Старое значение:
SetupStatus REG_DWORD = 2003 (8195)
SETUP_SERVER_FLAG -- 1
SETUP_CLIENT_FLAG -- 2
SETUP_DCOM_SECURITY_UPDATED_FLAG -- 2000 (8192)

Новое значение:
SetupStatus REG_DWORD = 3
SETUP_SERVER_FLAG -- 1
SETUP_CLIENT_FLAG -- 2
CertUtil: -setreg - команда успешно выполнена.
Чтобы изменения вступили в силу, может потребоваться перезапуск службы CertSvc.

F:\Documents and Settings\novich>net stop certsvc
Служба "Службы сертификации" останавливается.
Служба "Службы сертификации" успешно остановлена.

F:\Documents and Settings\novich>net start certsvc

Служба "Службы сертификации" успешно запущена.
________________________________________________
ПРОБЛЕМА НЕ РЕШЕНА. НА ВСЕХ DC ПРИ ЗАПУСКЕ certutil -pulse ПОЯВЛЯЕТСЯ ВЫШЕУПОМЯНУТАЯ ОШИБКА.

Модерирует : lynx, Crash_Master, dg, emx, ShriEkeR
Версия для печати • Подписаться • Добавить в закладки
Страницы: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59