Scenario
Introduced a 2008 DC to a windows 2003 Domain, Then HP TRIM threw up errors.
Errors wasnt consistent and sometimes TRIM on a Windows 7 machine will work where it never worked before and some users on XP Pro will work and some wont.
Spent alot of time reading and scratching my head and chasing something that wasnt seemed like the cuase but wasnt
I have checked DNS, SPN and logged the Trim server for kerberosv5. Current work around at the moment was to turn the 2008 DC off. Once it is off, then TRIM was working fine again.
Check DCOM settings for TRIM and other SSO impersonation accounts that rely on kerberos.From my understanding Vista, Windows7 and
Althouh I can not have AD DC server off for too long and we still need to move along the upgrade path and switch it on before it tombstone.
Possible solution is
support.microsoft.com/kb/961302/en-au
and
social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/ecf15eb9-26cf-483b-b1e3-1b1c7e4901e8/
Only found this by accident, when I was searching a way to reset the kerberos tickets.
Update - My company finally made the move to HP TRIM 7 - problem went away with the upgrade. Only way I could get the old Trim6.1 to work as to disable kerberos on the 2008 DC from issuing tickets.
No comments:
Post a Comment