Topic: Dns domain change

[smnirosh]

I am about to dns domain name change if my linux server. How to do it and what would i do before name change. (Like users can login how)

[janet]

smnirosh

Login at the command prompt as admin (same password as root).
Then select Configure this server.
On one of the first few screens enter the new main domain name.
Step through all the screens without changing anything else.
Then save & reboot.
A new self signed certificate will be created.

Please read the Manual as this is all covered there, link at top of Forums.

[smnirosh]

I did as u said. The server works fine.
But an issue with a winsows 7 client.
I changed the domain name of that client without removing from the previous domain. Now it says
"The trust relationship between this workstation and the primary domain failed"

No domain user can logon. 

I changed again the domain name to previous name. But problem remains the same.

I connect that client again to the domain and removed from the domain few times. No good result.
The msg coming everytime when i log in with a domain user.

What can i do with this issue to log this client to the domain.

Please note other computers works fine with domain

[Stefano]

smnirosh..

you posted the same question to NethServer forums..

please, stop it now.

if you're using SME, this is the place

moreover, when you ask for help, you must be verbose.. "changing dns domain" isn't clear.. and as you see, you can have some problems.

tell us:
- which OS are you using?
- what do you mean by "dns domain"
- what are you trying to do/achieve

Thank you

[smnirosh]

Sorry i am stucked in a big problem.

I want to change the servers dns domain name

Dns domain name is as an example sample.it to example.it.

[Stefano]

please, answer ALL the questions that have been posted, thank you

[stephdl]

The problem is windows related not smeserver. I have had this issue recently when I played with w10

Log on with a local user on the W7
Set back to a workgroup instead of a domain
Reboot since it is a mandatory
Then  add your client tobthe domain with the admin sme credentials

[Stefano]

steph, domain like example.it and windows' domain are diofferent concepts..

changing the first one via SME's console won't affect the second as long as SME is the dns server for the clients.
if something is changed (and we don't know anything about how it was before and what OP did), un-joining clients from domain (WINDOWS' domain) and rejoining can be a solution, but likely all user's local profiles will be create as new ones.

moreover, OP is posting quite the same questions here and "there".. that's a bad thing.

[Stefano]

moving into SME9.x section, as it is related to SME core and not to a contrib

[Stefano]

The problem is windows related not smeserver. I have had this issue recently when I played with w10

maybe and likely it is..

but since it seems to be originated by a change in SME settings, it should be filed into bugzilla and investigated.. even if not a bug, it may be an entry in the wiki.

[smnirosh]

Dear stephdl, i followed the suggestion u proposed few times. Though create a new user in the server, but nothing. I just changed the dns domain name. Other clients are working and quite good. But just one client.

My doubt is as i changed the domain name direclty without disconnecting from pervious domain.

What's ur idea

[Stefano]

smnirosh, please (again), answer all question you've been asked (see http://forums.contribs.org/index.php/topic,51983.msg265580.html#msg265580)

[janet]

smnirosh

I think you are getting URL type domain name  eg myseserver.it (called a FQDN) confused with Microsoft trusted DOMAIN (name), which are totally different things with totally seperate functions.
Read on.

I changed the domain name of that client without removing from the previous domain. Now it says
"The trust relationship between this workstation and the primary domain failed"

Well that was a big mistake. You should unjoin workstations from the DOMAIN before you change the DOMAIN name.
But based on my answer in this thread you only changed the FQDN (fully qualified domain name) which is the domain name for Internet related identity & access. That is different to the Microsoft trusted DOMAIN (name).

It sounds to me like you still have a MACHINE account on the SME server for that workstation which you will have to delete.
Please search these forums for the command to do that, maybe someone else can advise the command as I cannot quickly find it.

Once the trust relationship is broken you cannot fix it, you have to delete the MACHINE account & then rejoin the workstation to the trusted DOMAIN.

To change the trusted DOMAIN name (not the main FQDN for web access), you go into server manager Configuration section Workgroup panel, there is a setting for Workgroup & Domain (which also serves as the trusted DOMAIN name if your server is configured to be PDC (primary domain controller) or only as the Workgroup name if your server is not a PDC.
If you change this now (the trusted DOMAIN name), you will prevent all workstations from logging in to the trusted DOMAIN & be in a real big mess.

I think you were lucky as you only changed the web domain name.

What can i do with this issue to log this client to the domain.

You might get lucky, try this.
On the problematic workstation unjoin the workstation from the trusted DOMAIN.
It becomes a member of the Workgroup then.
Then change the Workgroup name on the workstation to something else completely different.
Then restart workstation.
Then join the workstation to the SME server trusted DOMAIN using the current trusted DOMAIN name as shown in server manager, & then restart the workstation. See if you can then log in to the DOMAIN.

If not successful, then I would say you have to delete the machine account for that workstation, from the SME  server.

STOP & THINK before doing anything else. Read up on the topic.

[smnirosh]

My real domain name is machinedv.it. The previous name was maccinadev.it.
This is sme server 9.0. How can i delete machine account from sme server.

[Stefano]

My real domain name is machinedv.it. The previous name was maccinadev.it.

is there any entry into "hostname and addresses" panel pointing to the client?

This is sme server 9.0.

if so, please STOP immediately posting also on other forums (not SME related.. NS is a DIFFERENT distro)

How can i delete machine account from sme server.

please, define "machine account" in this context.. are you referring to a dns entry in "hostname and addresses" or to a windows machine account into /etc/samba/smbpasswd?

[smnirosh]

No host name and ipaddress on server manager web page for this client.

What is ur second question is not clear to me pls.

[Stefano]

windows' machine accounts (the entries that bind clients to windows' trusted domain) are stored into /etc/samba/smbpasswd, in the form of

Code: [Select]

machinename$:5061:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:0EBD3FEBDB972B9D9A164B72F321E341:[W          ]:LCT-52809C7D:

the first time you join a client to the domain such an entry is created

[smnirosh]

Yes there is an entry with the name of my problem client. Im gonna delete this entry and and rejoin to domain. Let u update.

[Stefano]

how are you gonna doing it?

tell us BEFORE you do it

[smnirosh]

Login to sme server and delete the above mentioned line from smbpasswd

[smnirosh]

I mean edit the file manually

[Stefano]

no, this is not the way to act..

changing perspective, since you've to rejoin the client, you'r best bet is to rename the client itself and join it again..

anyway:
google is your friend "delete a machine account from smbpasswd"

something like

Code: [Select]

smbpasswd -xm machinename$

should do the trick, but I din't tested it

before doing anything: do you have a good and working backup of that server?

[smnirosh]

I already tried with changing machine name and mac address. But no good thing happened

[Stefano]

did you try BEFORE un-joining it from domain?
to do so, client must not be joined

moreover, don't poke with mac addresses

[smnirosh]

Login off from domain. But network cable connected to the server

[Stefano]

Login off from domain. But network cable connected to the server

login here makes no sense.. do you mean client not joined?
connected cable is irrelevant

[smnirosh]

Yes of cause

[smnirosh]

May i try with a deleting the machine account using the command u sent abouve.
Thhen do i have to create a machine acount?

[Stefano]

Delete it and try to rejoin
Be sure SME is the dns server for the client

[smnirosh]

Thanks. Do i have to create manually by any command or it created automatically

[Stefano]

The second..

[smnirosh]

No. I cannot login using domain credentials

[Stefano]

Well, was the join successfull?

[smnirosh]

Yes. Joined. But login is not done

[Stefano]

Well, take a look at Windows event viewer

[smnirosh]

it has few events

 i will copy it

[smnirosh]

He failed to authenticate with \\ DESIGN, a Windows domain controller for the domain MACHINEDV, therefore it is possible that access requests are denied. The inability to authenticate may be due to the lack of recognition of another computer on the same network using the same name or the same password for this computer account. If this message appears again, contact your system administrator.

This is a NETLOGON event under Sysstem

[janet]

smnirosh

Back in post 3 of this thread you said:
"I changed the domain name of that client without removing from the previous domain. Now it says
"The trust relationship between this workstation and the primary domain failed""

So that is the source of your problem.
Why you did that I do not know, it was a mistake on your part.
You should ALWAYS unjoin workstations correctly so the machine account on the Domain Controller gets deleted.
Otherwise you are left with orphaned machine accounts that prevent you rejoining the client to the DOMAIN, exactly the problem you are having.

You cannot make or force that client station rejoin the same trusted DOMAIN using the same credentials, the credentials are no longer trusted.

Please see this thread re how to delete the machine account, which while old I think is still valid, ie the second part about deleting a machine account.
http://forums.contribs.org/index.php/topic,12790.msg48162.html#msg48162

Then also follow my earlier instructions (the 13th post in this thread) to rename the worgroup on your client, restart client, & then try to join the SME server DOMAIN again (after having deleted the machine account for that workstation).

In theory that combination should achieve success & worked for me in the past (have not needed to do it for many years now).

If you still have issues then maybe you need to look at Windows 7 tweaks &/or more carefully repeat the process.

[Stefano]

smnirosh, only this part:

--------------------------------------------------------------------------------
 
NOTE: %u when issued inside samba appends the $ to $machineName to create $machineName$. For instance if the computer netbios name is STATION1 then it becomes station1$. NOTE: uppercase netbios names are converted to lowercase.

To remove a machine from a domain once it is added you may follow these command-line steps:

/usr/bin/smbpasswd -x $machineName$
/usr/bin/passwd -d $machineName$
/usr/sbin/userdel $machineName$
/sbin/e-smith/db accounts delete $machineName$

As an example to remove a machine named STATION1 you would enter:

[root@e-smith /root]# /usr/bin/smbpasswd -x station1$
Deleted user station1$.

[root@e-smith /root]# /usr/bin/passwd -d station1$
Changing password for user station1$
Removing password for user station1$
passwd: Success

[root@e-smith /root]# /usr/sbin/userdel station1$

[root@e-smith /root]# /sbin/e-smith/db accounts delete station1$

On the samba side, after you perform the command lines above to remove the machineName, you need to restart samba before you try to rejoin the computer to the domain:

[root@e-smith /root]# /etc/rc.d/init.d/smb restart

On the Windows side, you need to switch to workgroup mode (use a non-existent workgroup name ex. "workgroup1") and reboot your computer. After successfully rebooting in workgroup mode, you then may attempt to rejoin the computer to the domain following the steps below:

[smnirosh]

Dear all,

I did the thing u recommended. Then rejoin the windows to sme server.
But windows pc didnt even accept the admin password of sme server
I then create an machine account using smbpasswd.
Then pc joined to domain
But login problem is still not solved.

[janet]

smnirosh

Have you added the registry tweaks to Windows 7 ?
Read this first
http://wiki.contribs.org/Windows_7_Support

[smnirosh]

Yes those are set long time ago.

[janet]

smnirosh

I then create an machine account using smbpasswd.
Then pc joined to domain
But login problem is still not solved.

You should not need to do that manually (create a machine account), so it seems to me you are working around the problem & not really resolving the real issue here.

I can only suggest to start again making sure you carefully follow all instructions.
Keep a record of exactly what you do & post the details here, with all messages.

[smnirosh]

Ok i will donit one time more as per your advice.

[smnirosh]

Before do it, my boss checked his mail. But he coudn't

We use webregister mail accounts for our office. The same domain name I assigned to the server.

Now all the mail accounts in outlook 2007 are not login. I doubt it is just because the same domain name with domain mail configuration.

No settings confirgured in MAIL section in server-manager web page of the sme server.

do we have any suggestions to resolve this mail problem.

[smnirosh]

Task 'Synchronizing subscribed folders for n.chaminda@machinedv.it.' reported error (0x800CCC0E) : 'Outlook cannot synchronize subscribed folders for n.chaminda@machinedv. Error: Cannot connect to the server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP).'

[Stefano]

smnirosh..

you changed things without knowing all your infrastructure and without asking BEFORE.

I guess that outlook clients are trying to connect externally, but since you've setup your main internal domain like your external one, all *.yourdomain.tld hosts are resolved internally.

I suggest you to revert to the old domain name, fix client auth, then sit down in front of a piece of paper, design a diagram of all you have there, note how it works now and how it is supposed to work, think about how you wish things work, then ask here for support.

[smnirosh]

Ok sir. I will do the thing as u advised. So many probs here. You know my mind is now in the mode of 🙇🏽🙇🏽🙇🏽🙇🏽

[smnirosh]

I am failed for the 2nd time.
I connected this machine to the other server. Nethserver runs on that machine. I cannot logon to that server also. I think the problem in the windows 7 client. Then i connect it back to sme server again. No good result.

I saw some blogs about verbose key. My doubt is we have to reset or delete verbose security files.
What's ur idea

[smnirosh]

Tomorrow i arranged a meeting with my boss. We design our network then. Sometimes we decide to install a sample server. Then we deploy this sample seever to the real server. I will update u all. Thanks

[stephdl]

What's ur idea

Reinstall the W7 client

[smnirosh]

U mean format and re install, repair windows.

[stephdl]

I mean that windows should be reinstalled every three months....I'm kidding or not :p

[Stefano]

I am failed for the 2nd time.
I connected this machine to the other server. Nethserver runs on that machine. I cannot logon to that server also. I think the problem in the windows 7 client. Then i connect it back to sme server again. No good result.

I saw some blogs about verbose key. My doubt is we have to reset or delete verbose security files.
What's ur idea

Are SME  and NS running at the same time in the same lan as DC?
If so, it won't work

Regarding the new server for tests, it must be on another subnet, or you'll have only a big mess

[smnirosh]

No. In different network but same router. Because we have only one static public ip and one router.

I will deploy the sample server by the same way.

[smnirosh]

The nethserver always been shut down. Inswitched on NS because of check the client

[smnirosh]

All of you have any idea to resolve this problem. Still im in the same sme server. Do i have to install another sme server to solve this problem?

[janet]

smnirosh

SME server is not the problem, so do not change SME server.

You are the problem when you make changes that are inappropriate etc.

You need to accept the advice given & carry it out.

You were advised previously to reinstall Windows 7 - meaning format and re install.
Have you done that ?


Regarding your newish Outlook issue, it seems when you changed the FQDN of your server that you caused problems with Outlook, so setting the FQDN back to original is one answer, an alternative answer if you wish to keep the new FQDN is to reconfigure your Outlook clients to communicate with the SME servers new FQDN (server main domain name), which is nothing to do with the trusted DOMAIN name for Microsoft trusted networking.

[smnirosh]

yes you told me to format and install. but there is a problem of format. there is a Creo server running in this window 7 machine.The password for the creo user name registered is forgotten and the email for that user name is no longer available. thus it cannot be reset. The creo support center also unable to assign another username as admin for change our Creo parameters.

But I will do it on a new hard disk tomorrow. Let see what happened. I will give it the same computer name as it was before. Ok?

And lets forget about email issue. Because we use register.it webmail service. Later will decide a solution for that.

Thanks for the information. see you tmrw.

[janet]

smnirosh

I will give it the same computer name as it was before. Ok?

If I were you I would play safe & use a "slightly" different computer name, so that you do not have clashes with the old accounts on the server.

[smnirosh]

Hi friends. I installed winn7 to one hard disk. With a different computer name. It can join and loggin with user name. What can i do now.

The old computers hard drive is still out of the computer and not formatted.

[Stefano]

almost nothing, because all the relevant info (apart of files) are stored into the windows' registry, so I doubt you can do anything with  the disk only

[smnirosh]

What about creo licence, email settings and office business and home lackage with the lost serial😢

[Stefano]

see above, they are likely all stored into the old w7 client registry..

my 2c, don't get me wrong, but it seems to me (reading here and in the other forum)  that you really need to hire a technician to solve your issues.. you apparently changed things without knowing what you were doing and broke almost everything.

[janet]

smnirosh

I installed win7 to one hard disk. With a different computer name. It can join and loggin with user name. What can i do now.

Well that proves that a clean install of Windows 7 does connect to your SME server network OK, & login as a DOMAIN user.
So that also rules out any (serious) problems with SME server.

Clearly your issue is with the original Windows 7 installation.
Possibilities are corrupt files, missing registry entries, inappropriate registry entries, clashes with other installed programs etc (incompatibilities).
You really need to now troubleshoot the old Windows 7 install if you wish to retrieve or save installed software etc.

I think you are on your own to do that, this is a SME server forum, not a Windows troubleshooting forum.

I agree with Stefano that it sounds like you do not know what you are doing, yet you also sound like you are playing at fairly serious networking setups etc, your knowledge & abilities as compared to what you are doing, does confuse me.

Best you engage the services of someone who understands Windows & Windows networking to NT style domains very well & maybe they can return your old Windows setup to more standard settings that work OK with SME server.

What went wrong along the way, I do not know.
I think only you can tell us, but so far you are not really telling what caused all this.
There seems to be very poor administrative record keeping regarding that Windows 7 workstation/server, so the organisation &/or its staff is at fault.

Where is the last known good working backup of the Windows 7 computer ?
What, no backup !