Skip to content

Commit fa0b2cd

Browse files
Deland-HanDeland-Han
committed
Merge branch 'ci4468' into ci5170-part
2 parents 2792f7c + c86b4d6 commit fa0b2cd

10 files changed

Lines changed: 333 additions & 91 deletions

‎support/windows-server/active-directory/active-directory-domain-join-troubleshooting-guidance.md‎

Lines changed: 3 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -57,24 +57,7 @@ For more information, see [Error code 0x569: The user has not been granted the r
5757

5858
### Error code 0x534
5959

60-
> No mapping between account names and security IDs was done.
61-
62-
Here's an example from the *netsetup.log* file:
63-
64-
```output
65-
mm/dd/yyyy hh:mm:ss:ms NetpCreateComputerObjectInDs: NetpGetComputerObjectDn failed: 0x534
66-
mm/dd/yyyy hh:mm:ss:ms NetpProvisionComputerAccount: LDAP creation failed: 0x534
67-
mm/dd/yyyy hh:mm:ss:ms ldap_unbind status: 0x0
68-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: Function exits with status of: 0x534
69-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: status of disconnecting from '\\<DC name>': 0x0
70-
mm/dd/yyyy hh:mm:ss:ms NetpDoDomainJoin: status: 0x534
71-
```
72-
73-
The domain join graphical user interface (GUI) can call the `NetJoinDomain` API twice to join a computer to a domain. The first call is made without the "create" flag being specified to locate a pre-created computer account in the target domain. If no account is found, a second `NetJoinDomain` API call may be made with the "create" flag specified.
74-
75-
In another scenario, the 0x534 error code is logged when you attempt to change the password for a machine account. However, the account can't be found on the targeted DC, likely because the account was not created or due to replication latency or a replication failure.
76-
77-
The 0x534 error code is commonly logged as a transient error when domain join searches the target domain. The search determines whether a matching computer account was pre-created or the join operation needs to dynamically create a computer account on the target domain. Check the bit flags in the join options to see if the type of join being performed is relying on a pre-created or newly created computer account.
60+
See [Domain join error 0x534 "No mapping between account names and security IDs was done"](./domain-join-error-0x534-no-mapping-between-account-names-and-security-ids-was-done.md) for troubleshooting guide.
7861

7962
### Error code 0x6BF or 0xC002001C
8063

@@ -100,86 +83,15 @@ Make sure of the following items:
10083

10184
### Error code 0x6D9
10285

103-
> There are no more endpoints available from the endpoint mapper.
104-
105-
Here's an example from the *netsetup.log* file:
106-
107-
```output
108-
mm/dd/yyyy hh:mm:ss:ms NetpGetDnsHostName: Read NV Hostname: <hostname>
109-
mm/dd/yyyy hh:mm:ss:ms NetpGetDnsHostName: PrimaryDnsSuffix defaulted to DNS domain name: <DNS domain>.<TLD>
110-
mm/dd/yyyy hh:mm:ss:ms NetpLsaOpenSecret: status: 0xc0000034
111-
mm/dd/yyyy hh:mm:ss:ms NetpGetLsaPrimaryDomain: status: 0x0
112-
mm/dd/yyyy hh:mm:ss:ms NetpLsaOpenSecret: status: 0xc0000034
113-
mm/dd/yyyy hh:mm:ss:ms NetpManageMachineAccountWithSid: NetUserAdd on \\<hostname>.<domain> for <computername>$ failed: 0x8b0
114-
mm/dd/yyyy hh:mm:ss:ms NetpManageMachineAccountWithSid: status of attempting to set password on \\<DC name>.<domain>.<tld> for <hostname>$: 0x0
115-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomain: status of creating account: 0x0
116-
mm/dd/yyyy hh:mm:ss:ms NetpGetComputerObjectDn: Unable to bind to DS on \\<DC name>.<domain>.<tld>: 0x6d9
117-
mm/dd/yyyy hh:mm:ss:ms NetpSetDnsHostNameAndSpn: NetpGetComputerObjectDn failed: 0x6d9
118-
mm/dd/yyyy hh:mm:ss:ms ldap_unbind status: 0x0
119-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomain: status of setting DnsHostName and SPN: 0x6d9
120-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomain: initiaing a rollback due to earlier errors
121-
mm/dd/yyyy hh:mm:ss:ms NetpGetLsaPrimaryDomain: status: 0x0
122-
mm/dd/yyyy hh:mm:ss:ms NetpManageMachineAccountWithSid: status of disabling account <hostname>$ on \\<DC name>.<domain>.<tld>: 0x0
123-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomain: rollback: status of deleting computer account: 0x0
124-
mm/dd/yyyy hh:mm:ss:ms NetpLsaOpenSecret: status: 0x0
125-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomain: rollback: status of deleting secret: 0x0
126-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomain: status of disconnecting from \\<DC name>.<domain>.<tld>: 0x0
127-
mm/dd/yyyy hh:mm:ss:ms NetpDoDomainJoin: status: 0x6d9
128-
```
129-
130-
Error 0x6D9 is logged when network connectivity is blocked between the joining client and the helper DC. The network connectivity services the domain join operation over port 135 or a port in the ephemeral range between 1025 to 5000 or 49152 to 65535. For more information, see [Service overview and network port requirements for Windows](../networking/service-overview-and-network-port-requirements.md).
131-
132-
To resolve this error, follow these steps:
133-
134-
1. On the joining client, open the *%systemroot%\\debug\\NETSETUP.LOG* file and determine the name of the helper DC selected by the joining client to perform the join operation.
135-
2. Verify that the joining client has network connectivity to the DC over the required ports and protocols used by the applicable operating system (OS) versions. Domain join clients connect a helper DC over TCP port 135 by the dynamically assigned port in the range between 49152 and 65535.
136-
3. Ensure that the OS, software and hardware routers, firewalls, and switches allow connectivity over the required ports and protocols.
86+
See [Domain join error 0x6D9 "There are no more endpoints available from the endpoint mapper"](./domain-join-error-0x6d9-there-are-no-more-endpoints-available-from-the-endpoint-mapper.md) for troubleshooting guide.
13787

13888
### Error code 0xa8b
13989

14090
For more information, see [Error code 0xa8b: An attempt to resolve the DNS name of a DC in the domain being joined has failed](error-0xa8b-resolve-dns-fail.md).
14191

14292
### Error code 0x40
14393

144-
The following error messages occur when you try to join the computer to the domain:
145-
146-
> The specified network name is no longer available
147-
148-
:::image type="content" source="media/active-directory-domain-join-troubleshooting-guidance/domain-join-error-message.png" alt-text="Screenshot of the dialog box showing the error message for error code 0x40.":::
149-
150-
Here's an example from the *netsetup.log* file:
151-
152-
```output
153-
mm/dd/yyyy hh:mm:ss:ms NetpValidateName: checking to see if '<domain_name>' is valid as type 3 name
154-
mm/dd/yyyy hh:mm:ss:ms NetpCheckDomainNameIsValid [ Exists ] for '<domain_name>' returned 0x0
155-
mm/dd/yyyy hh:mm:ss:ms NetpValidateName: name '<domain_name>' is valid for type 3
156-
mm/dd/yyyy hh:mm:ss:ms NetpDsGetDcName: trying to find DC in domain '<domain_name>', flags: 0x40001010
157-
mm/dd/yyyy hh:mm:ss:ms NetpDsGetDcName: failed to find a DC having account 'CLIENT1$': 0x525, last error is 0x0
158-
mm/dd/yyyy hh:mm:ss:ms NetpDsGetDcName: status of verifying DNS A record name resolution for 'DCA.<domain_name>': 0x0
159-
mm/dd/yyyy hh:mm:ss:ms NetpDsGetDcName: found DC '\\<dc_fqdn>' in the specified domain
160-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: NetpDsGetDcName returned: 0x0
161-
mm/dd/yyyy hh:mm:ss:ms NetpDisableIDNEncoding: using FQDN <domain_name> from dcinfo
162-
mm/dd/yyyy hh:mm:ss:ms NetpDisableIDNEncoding: DnsDisableIdnEncoding(UNTILREBOOT) on '<domain_name>' succeeded
163-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: NetpDisableIDNEncoding returned: 0x0
164-
mm/dd/yyyy hh:mm:ss:ms NetUseAdd to \\<dc_fqdn>\IPC$ returned 64
165-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: status of connecting to dc '\\<dc_fqdn>': 0x40
166-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: Function exits with status of: 0x40
167-
mm/dd/yyyy hh:mm:ss:ms NetpResetIDNEncoding: DnsDisableIdnEncoding(RESETALL) on '<domain_name>' returned 0x0
168-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: NetpResetIDNEncoding on '<domain_name>': 0x0
169-
mm/dd/yyyy hh:mm:ss:ms NetpDoDomainJoin: status: 0x40
170-
```
171-
172-
This error is logged when the client computer lacks network connectivity on TCP port 88 between the client machine and the DC. To troubleshoot this issue, you can run the following command to test the connection:
173-
174-
```PowerShell
175-
Test-NetConnection <IP_address_of_the_DC> -Port 88
176-
```
177-
178-
Expected Output:
179-
180-
:::image type="content" source="media/active-directory-domain-join-troubleshooting-guidance/test-netconnection-output-88.png" alt-text="Screenshot that shows the Test-NetConnection command for TCP port 88 output.":::
181-
182-
The output indicates that the Kerberos Port TCP 88 is open between the client and the DC.
94+
See [Domain join error 0x40 "The specified network name is no longer available"](./domain-join-error-0x40-the-specified-network-name-is-no-longer-available.md) for troubleshooting guide.
18395

18496
### Error code 0x54b
18597

‎support/windows-server/active-directory/domain-join-error-0x40-the-specified-network-name-is-no-longer-available.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
---
2+
title: Error 0x40 The Specified Network Name Is No Longer Available
3+
description: Addresses the error The specified network name is no longer available encountered during domain join operations.
4+
ms.date: 03/28/2025
5+
manager: dcscontentpm
6+
audience: itpro
7+
ms.topic: troubleshooting
8+
ms.reviewer: raviks, eriw, dennhu
9+
ms.custom:
10+
- sap:active directory\on-premises active directory domain join
11+
- pcy:WinComm Directory Services
12+
---
13+
# Domain join error 0x40 "The specified network name is no longer available"
14+
15+
This article addresses the error code 0x40 encountered during domain join operations.
16+
17+
## Symptoms
18+
19+
When you try to join a computer to a domain, you receive the following error message:
20+
21+
> The specified network name is no longer available.
22+
23+
When you review the **netsetup.log** file, you find error messages that resemble the following entries:
24+
25+
```output
26+
NetUseAdd to \\dc1.adatum.com\IPC$ returned 64
27+
NetpJoinDomain: status of connecting to dc '\\dc1.adatum.com': 0x40
28+
NetpJoinDomainOnDs: Function exits with status of: 0x40
29+
```
30+
31+
### Error detail
32+
33+
|Hexadecimal error|Decimal error|Symbolic error string|Friendly error|
34+
|---|---|---|---|
35+
|0x40|64|ERROR_NETNAME_DELETED|The specified network name is no longer available.|
36+
37+
## Cause
38+
39+
This issue occurs when either of the following conditions is met:
40+
41+
- A WAN accelerator device responds to acknowledge the TGS request package, but the response does not arrives at the Key Distribution Center (KDC). Generally, IP Time to Live (TTL) frame fields have values of 64 or lower because this is the TTL used by Unix-like devices, and WAN accelerators are generally based on Linux.
42+
- A network device such as a firewall between the client and the DC dropped the KDC response. You can find more details in the concurrent network trace of the DC traffic.
43+
44+
## Troubleshooting
45+
46+
The issue is related to getting Kerberos Tickets for a Server Message Block (SMB) session. Troubleshoot this issue based on the network trace:
47+
48+
1. Use the `net use` command to access the same Universal Naming Convention (UNC) path and reproduce the issue.
49+
2. Collect a network trace of the `net use` command execution.
50+
51+
### Example
52+
53+
Here's an example of a network trace:
54+
55+
```output
56+
1534 CLIENT1 DC1.ADATUM.COM TCP TCP:Flags=......S., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=0, Seq=1299628969, Ack=0, Win=8192 ( ) = 8192 {TCP:267, IPv4:5}
57+
1537 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A..S., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282675, Ack=1299628970, Win=8192 ( Scale factor not supported ) = 8192 {TCP:267, IPv4:5}
58+
1538 CLIENT1 DC1.ADATUM.COM TCP TCP:Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=0, Seq=1299628970, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
59+
1539 CLIENT1 DC1.ADATUM.COM KerberosV5 KerberosV5:TGS Request Realm: ADATUM.COM Sname: cifs/DC1.ADATUM.COM {TCP:267, IPv4:5}
60+
1540 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282676, Ack=1299628970, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
61+
1541 CLIENT1 DC1.ADATUM.COM TCP TCP:[ReTransmit #1539]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=1460, Seq=1299628970 - 1299630430, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
62+
1542 CLIENT1 DC1.ADATUM.COM TCP TCP:[ReTransmit #1539]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=1460, Seq=1299628970 - 1299630430, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
63+
1545 CLIENT1 DC1.ADATUM.COM TCP TCP:[ReTransmit #1539]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=536, Seq=1299628970 - 1299629506, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
64+
1546 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282676, Ack=1299629506, Win=63704 (scale factor 0x0) = 63704 {TCP:267, IPv4:5}
65+
1547 CLIENT1 DC1.ADATUM.COM TCP TCP:[Continuation to #0]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=536, Seq=1299629506 - 1299630042, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
66+
1548 CLIENT1 DC1.ADATUM.COM TCP TCP:[Continuation to #0]Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=536, Seq=1299630042 - 1299630578, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
67+
1549 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282676, Ack=1299630042, Win=63168 (scale factor 0x0) = 63168 {TCP:267, IPv4:5}
68+
1550 CLIENT1 DC1.ADATUM.COM TCP TCP:[Continuation to #0]Flags=...AP..., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=536, Seq=1299630578 - 1299631114, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
69+
1551 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785282676, Ack=1299630738, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
70+
1552 CLIENT1 DC1.ADATUM.COM KerberosV5 KerberosV5: {TCP:267, IPv4:5}
71+
1553 DC1.ADATUM.COM CLIENT1 TCP TCP:[Continuation to #0]Flags=...AP..., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=290, Seq=2785284136 - 2785284426, Ack=1299630738, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
72+
1554 CLIENT1 DC1.ADATUM.COM TCP TCP:Flags=...A...., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=0, Seq=1299632186, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
73+
1555 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284426, Ack=1299631114, Win=63864 (scale factor 0x0) = 63864 {TCP:267, IPv4:5}
74+
1556 CLIENT1 DC1.ADATUM.COM TCP TCP:[Continuation to #1552]Flags=...AP..., SrcPort=59259, DstPort=Kerberos(88), PayloadLen=320, Seq=1299632186 - 1299632506, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
75+
1557 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284426, Ack=1299632186, Win=62792 (scale factor 0x0) = 62792 {TCP:267, IPv4:5}
76+
1558 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284426, Ack=1299632506, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
77+
1559 CLIENT1 DC1.ADATUM.COM TCP TCP:Flags=...A...F, SrcPort=59259, DstPort=Kerberos(88), PayloadLen=0, Seq=1299632506, Ack=2785282676, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
78+
1563 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A...., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284136, Ack=1299632507, Win=64240 (scale factor 0x0) = 64240 {TCP:267, IPv4:5}
79+
1564 DC1.ADATUM.COM CLIENT1 TCP TCP:Flags=...A.R.., SrcPort=Kerberos(88), DstPort=59259, PayloadLen=0, Seq=2785284136, Ack=1299632507, Win=0 (scale factor 0x0) = 0 {TCP:267, IPv4:5}
80+
```
81+
82+
From the trace, you can find the DC doesn't respond to the Ticket Granting Service (TGS) request from the client for the Service Principal Name (SPN) `CIFS/DC1.ADATUM.COM`. It sends back a TCP acknowledgment, which suggests the DC received the TGS request. However, it doesn't reply with a valid TGS response. Finally, the client terminates the TCP connection.

‎support/windows-server/active-directory/domain-join-error-0x534-no-mapping-between-account-names-and-security-ids-was-done.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
title: Error 0x534 No Mapping Between Account Names and Security IDs Was Done
3+
description: Addresses the error No mapping between account names and security IDs was done encountered during domain join operations.
4+
ms.date: 03/28/2025
5+
manager: dcscontentpm
6+
audience: itpro
7+
ms.topic: troubleshooting
8+
ms.reviewer: raviks, eriw, dennhu
9+
ms.custom:
10+
- sap:active directory\on-premises active directory domain join
11+
- pcy:WinComm Directory Services
12+
---
13+
# Domain join error 0x534 "No mapping between account names and security IDs was done"
14+
15+
This article addresses the error code 0x534 encountered during domain join operations.
16+
17+
## Symptoms
18+
19+
When you try to join a computer to a domain, you receive the following error message:
20+
21+
> No mapping between account names and security IDs was done.
22+
23+
When you review the **netsetup.log** file, you find error messages that resemble the following entries:
24+
25+
```output
26+
NetpCreateComputerObjectInDs: NetpGetComputerObjectDn failed: 0x534
27+
NetpProvisionComputerAccount: LDAP creation failed: 0x534
28+
ldap_unbind status: 0x0
29+
NetpJoinDomainOnDs: Function exits with status of: 0x534
30+
NetpJoinDomainOnDs: status of disconnecting from '\\<DC name>': 0x0
31+
NetpDoDomainJoin: status: 0x534
32+
```
33+
34+
### Error detail
35+
36+
|Hexadecimal error|Decimal error|Symbolic error string|
37+
|---|---|---|
38+
|0x534|1332|ERROR_NONE_MAPPED|
39+
40+
## Cause
41+
42+
The domain-join graphical user interface (GUI) or user interface (UI) can call the `NetJoinDomain` API twice to join a computer to a domain. The first call is made without specifying the "create" flag to locate a pre-created computer account in the target domain. If no account is found, a second `NetJoinDomain` API call might be made with the "create" flag specified.
43+
44+
The 0x534 error code or status is commonly logged as a transient error when a domain join searches for the target domain or when the domain join UI is used and certain values are present in the options bit (values of 25, 27, 425, or 427 are common).
45+
46+
In another scenario, this error occurs when you try to change the password for a machine account. However, the account can't be found on the targeted domain controller (DC), likely because the account wasn't created or due to replication latency or a replication failure.
47+
48+
## Resolution
49+
50+
To fix the issue, focus on the bits in the options flag. Check whether the type of join being performed relies on preexisting accounts or requires creating new ones.

0 commit comments

Comments
 (0)