Logon Authentication, Active Directory Replication, and Domain Joins Do Not Complete Successfully

You may experience one or more of the following administrative issues on your network:

• Logon authentication does not complete successfully.
• Active Directory replication does not complete successfully.
• An operation to join a domain does not complete successfully.

This issue occurs because Kerberos ticket requests by Microsoft Windows 2000 clients may experience fragmentation on a wide area network (WAN) or on a dial-up network, and this causes Kerberos-authenticated operations (such as logon authentication, Active Directory replication, and domain joins) to fail. Network fragmentation also prevents Kerberos Distribution tickets from receiving Kerberos ticket request that are sent by clients.

The Windows Kerberos Authentication package is the default in Windows 2000 and in Microsoft Windows XP. The Kerberos Authentication package coexists with challenge/response (NTLM) authentication, and it is used in instances where both a client and a server can negotiate Kerberos.

To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 4.

For additional information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the article number below to view the article in the Microsoft Knowledge Base: