àª×èͶ×ÍÃÐËÇèÒ§â´àÁ¹ Windows NT áÅÐäÁèÊÒÁÒöÊÃéÒ§â´àÁ¹ Active Directory ÁÕ ËÃ×ÍäÁèä´éµÒÁ·Õè¤Ò´äÇé

Step two: Load the LMHOSTS file into the cache

1. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹ¤ÅÔ¡àÃÕ¡ãªé»ÃÐàÀ·:cmdáÅéÇ ¤ÅÔ¡µ¡Å§.
2. ·Õè¾ÃÍÁµì¤ÓÊÑè§ ¾ÔÁ¾ì:NBTSTAT -RáÅéÇ ¡´ ENTER This command loads the LMHOSTS file into the cache.
3. ·Õè¾ÃÍÁµì¤ÓÊÑè§ ¾ÔÁ¾ì:NBTSTAT -cáÅéÇ ¡´ ENTER This command displays the cache. If the file is written correctly, the cache is similar to the following:

   NT4PDCName <03> UNIQUE 1.1.1.1 -1 
   NT4PDCName <00> UNIQUE 1.1.1.1 -1 
   NT4PDCName <20> UNIQUE 1.1.1.1 -1 
   NT4DomainName <1C> GROUP 1.1.1.1 -1 
   NT4DomainName <1B> UNIQUE 1.1.1.1 -1
   W2KPDCName <03> UNIQUE 2.2.2.2 -1 
   W2KPDCName <00> UNIQUE 2.2.2.2 -1 
   W2KPDCName <20> UNIQUE 2.2.2.2 -1 
   W2KDomainName <1C> GROUP 2.2.2.2 -1 
   W2KDomainName <1B> UNIQUE 2.2.2.2 -1

   If the file does not populate the cache correctly, continue with the next step.

Step three: Make sure that the LMHOSTS lookup is enabled on the Windows NT 4.0-based computer

If the file does not populate the cache correctly, make sure that LMHOSTS lookup is enabled on the Windows NT 4.0-based computer. â´ÂãËé·ÓµÒÁ¢Ñ鹵͹µèÍ仹Õé::

1. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹªÕéä»·Õè¡ÒõÑ駤èÒáÅéÇ ¤Åԡἧ¤Çº¤ØÁ.
2. ¤ÅÔ¡Êͧ¤ÃÑé§à¤Ã×Í¢èÒ¤ÅÔ¡¡ÒÃâ¾Ãâ·¤ÍÅá·çº áÅШҡ¹Ñé¹ ¤ÅÔ¡Êͧ¤ÃÑé§TCP/IP Protocol.
3. ¤ÅÔ¡¡ÒÃWINS Addresstab, and then click to select theEnable LMHOSTS Lookup¡Åèͧ¡Òà¤Ã×èͧËÁÒÂ
4. àÃÔèÁµé¹Ãкº¤ÍÁ¾ÔÇàµÍÃìãËÁè
5. Repeat the steps in the "Load the LMHOSTS file into the cache" section.
6. If the file does not populate the cache correctly, make sure that the LMHOSTS file is in theSystemRoot %%\System32\Drivers\Etc folder and that the file is formatted correctly.
   
   For example, the file must be formatted similar to the following example formatting:

   1.1.1.1	 NT4PDCName		 #DOM:NT4DomainName	#PRE
   1.1.1.1	 "NT4DomainName  \0x1b"			#PRE
   2.2.2.2	 W2KPDCName		 #DOM:W2KDomainName	#PRE
   2.2.2.2	 "W2KDomainName  \0x1b"			#PRE
   

   ËÁÒÂà˵Ø:There must be a total of 20 characters and spaces inside the quotations marks (" ") for the Domain name and \0x1b entry.

Step four: Use the Ping command to test connectivity

When the file populates the cache correctly on each server, use the Ping command on each server to test connectivity between the servers. â´ÂãËé·ÓµÒÁ¢Ñ鹵͹µèÍ仹Õé::

1. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹ¤ÅÔ¡àÃÕ¡ãªé»ÃÐàÀ·:cmdáÅéÇ ¤ÅÔ¡µ¡Å§.
2. ·Õè¾ÃÍÁµì¤ÓÊÑè§ ¾ÔÁ¾ì:PingName_Of_Domain_Controller_You_Want_To_Connect_ToáÅéÇ ¡´ ENTER If the Ping command does not work, make sure that the correct IP addresses are listed in the LMHOSTS file.
3. ·Õè¾ÃÍÁµì¤ÓÊÑè§ ¾ÔÁ¾ì:net viewName_Of_Domain_Controller_You_Want_To_Connect_ToáÅéÇ ¡´ ENTER It is expected that you receive the following error message:
   à¡Ô´¢éͼԴ¾ÅÒ´¢Í§Ãкº 5 Access is denied
   ¶éÒ¡ÒÃnet viewcommand returns the following error message or any other related error message, make sure that the correct IP addresses are listed in the LMHOSTS file:
   System error 53 has occurred. The network path was not found

Alternatively, Windows Internet Name Service (WINS) can be configured to enable name resolution functionality without using a LMHOSTS file.For more information about how to use WINS for name resolution, click the following article number to view the article in the Microsoft Knowledge Base:

Method two: View security settings

Typically, the Active Directory side of the trust configuration has security settings that cause connectivity problems. However, the security settings must be inspected on both sides of the trust.

Step one: View security settings on Windows 2000 Server and Windows Server 2003

In Windows 2000 Server and Windows Server 2003, the security settings may be applied or configured by Group Policy, a local policy, or an applied security template.

You must use the correct tools to determine the current values of the security settings to avoid inaccurate readings.

To obtain an accurate reading of the current security settings, use the following methods:

• In Windows 2000 Server, use the Security Configuration and Analysis snap-in.For more information about how to determine the current security policy on a Windows 2000-based computer, click the following article number to view the article in the Microsoft Knowledge Base:
  258595

  (http://support.microsoft.com/kb/258595/ )

  Gpresult äÁèÃкعâºÒ¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑ¢ͧ¤ÍÁ¾ÔÇàµÍÃì resultant
• ã¹ Windows Server 2003 ¡ÒÃãªéà»ç¹¡ÒáÓ˹´¤èÒ¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑÂáÅСÒÃÇÔà¤ÃÒÐËìÊá¹»ÍÔ¹ ËÃ×Í¡ÒÃàÍҪش¢Í§¹âºÒ (RSoP) ÅÊá¹»ÊÓËÃѺ¢éÍÁÙÅà¾ÔèÁàµÔÁà¡ÕèÂǡѺÇÔ¸Õ¡ÒÃãªéÊá¹ç»ÍÔ¹àÍÒµÑ駤èҢͧ¹âºÒ ¤ÅÔ¡ËÁÒÂàÅ¢º·¤ÇÒÁµèÍ仹Õéà¾×èÍ´Ùº·¤ÇÒÁã¹°Ò¹¤ÇÒÁÃÙé¢Í§ Microsoft:
  323276

  (http://support.microsoft.com/kb/323276/ )

  ÇÔ¸Õ¡ÒõԴµÑé§ áÅÐãªé RSoP ã¹ Windows Server 2003

ËÅѧ¨Ò¡·Õè¤Ø³ÃкءÒõÑ駤èһѨ¨ØºÑ¹ä´é ¤Ø³µéͧÃкعâºÒ·Õè¶Ù¡»ÃÐÂØ¡µìãªé¡ÒõÑ駤èÒ µÑÇÍÂèÒ§àªè¹ ¤Ø³µéͧ¡Ó˹´¹âºÒ¡ÅØèÁã¹ Active Directory ËÃ×Í¡ÒõÑ駤èÒÀÒÂã¹·ÕèµÑ駤èÒ¹âºÒ¤ÇÒÁ»ÅÍ´ÀÑÂ

ã¹ Windows Server 2003 ¹âºÒ·Õè¡Ó˹´¤èÒ¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀѨж١ÃÐºØ ´éÇÂà¤Ã×èͧÁ×Í RSoP ÍÂèÒ§äáçµÒÁ ã¹ Windows 2000 ¤Ø³µéͧ´Ù¹âºÒ¡ÅØèÁáÅйâºÒÂÀÒÂã¹à¾×èÍ¡Ó˹´¹âºÒ·Õè»ÃСͺ´éÇ¡ÒõÑ駤èÒ¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑÂ:

• àÁ×è͵éͧ¡Òô١ÒõÑ駤èÒ Group Policy ¤Ø³µéͧà»Ô´ãªé¡Òúѹ·Ö¡¼ÅÅѾ¸ìÊÓËÃѺ¡ÒõÑ駤èҤ͹¿Ô¡ Client Microsoft ¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑ 2000 Windows ã¹ÃÐËÇèÒ§¡ÒûÃÐÁÇżŹâºÒ¡ÅØèÁÊÓËÃѺ¢éÍÁÙÅà¾ÔèÁàµÔÁà¡ÕèÂǡѺÇÔ¸Õ¡ÒÃà»Ô´ãªé§Ò¹¡Òúѹ·Ö¡¼ÅÅѾ¸ìÊÓËÃѺ¡ÒõÑ駤èҤ͹¿Ô¡ Client Microsoft ¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑ 2000 Windows ã¹ÃÐËÇèÒ§¡ÒûÃÐÁÇżŹâºÒ¡ÅØèÁ ¤ÅÔ¡ËÁÒÂàÅ¢º·¤ÇÒÁµèÍ仹Õéà¾×èÍ´Ùº·¤ÇÒÁã¹°Ò¹¤ÇÒÁÃÙé¢Í§ Microsoft:
  245422

  (http://support.microsoft.com/kb/245422/ )

  ÇÔ¸Õ¡ÒÃà»Ô´ãªé§Ò¹¡Òúѹ·Ö¡ÊÓËÃѺä¤ÅàÍç¹µì¡ÒõÑ駤èҤ͹¿Ô¡¤ÇÒÁ»ÅÍ´ÀÑ¡ÒûÃÐÁÇżÅã¹ Windows 2000
• ´ÙºÑ¹·Ö¡¢Í§â»Ãá¡ÃÁ»ÃÐÂØ¡µìã¹µÑÇáÊ´§à˵ءÒóì áÅФé¹ËÒÃËÑÊà˵ءÒóì 1000 áÅÐà˵ءÒóì 1202 ÃËÑÊFor more information about event ID 1000 and event ID 1202, click the following article number to view the article in the Microsoft Knowledge Base:
  319352

  (http://support.microsoft.com/kb/319352/ )

  Event ID 1000 and event ID 1202 are logged to the event log every five minutes in Windows 2000 Server

The following three sections identify the operating system and list the security settings that you must verify for the operating system in the information that you have collected:

Windows 2000:

Make sure that the following settings are configured as shown.

RestrictAnonymous:LM Compatibility:SMB Signing, SMB Encrypting, or both:

Windows Server 2003

Make sure that the following settings are configured as shown.

RestrictAnonymous and RestrictAnonymousSam:ËÁÒÂà˵Ø:â´Â¤èÒàÃÔèÁµé¹ ¤èҢͧ¡ÒáÒÃà¢éÒ¶Ö§¢Í§à¤Ã×Í¢èÒÂ: ͹حҵãËéÁÕ¡ÒÃá»Å SID/ª×èÍ ·ÕèäÁèÃкت×èÍsetting is DISABLED in Windows Server 2008.ÊÓËÃѺ¢éÍÁÙÅà¾ÔèÁàµÔÁ ãËé¤ÅÔ¡ËÁÒÂàÅ¢º·¤ÇÒÁµèÍ仹Õé à¾×èÍ´Ùº·¤ÇÒÁã¹°Ò¹¤ÇÒÁÃÙé¢Í§ Microsoft::

LM Compatibility:SMB Signing, SMB Encrypting, or both:After the settings are configured correctly, you must restart your computer. The security settings are not enforced until the computer is restarted.

After the computer restarts, wait 10 minutes to make sure that all security policies are applied and the effective settings are configured. We recommend that you wait 10 minutes because Active Directory policy updates occur every 5 minutes on a domain controller, and the update may change the security setting values. After 10 minutes, use Security Configuration and Analysis or another tool to examine the security settings in Windows 2000 and Windows Server 2003.

Windows NT 4.0

ÊÔè§ÊӤѭ¹ÕéÊèǹ ÇÔ¸Õ ËÃ×ͧҹ»ÃСͺ´éÇ¢Ñ鹵͹·ÕèºÍ¡ÇÔ¸Õ¡ÒÃá¡éä¢ÃÕ¨ÔÊ·ÃÕ ÍÂèÒ§äáçµÒÁ »Ñ­ËÒÃéÒÂáçÍÒ¨à¡Ô´¢Öé¹ËÒ¡¤Ø³»ÃѺà»ÅÕè¹ÃÕ¨ÔÊ·ÃÕäÁè¶Ù¡µéͧ ´Ñ§¹Ñé¹ â»Ã´µÃǨÊͺãËéá¹èã¨ÇèҤسä´é·ÓµÒÁ¢Ñ鹵͹àËÅèÒ¹ÕéÍÂèÒ§ÃÐÁÑ´ÃÐÇѧ ÊÓËÃѺ¡Òûéͧ¡Ñ¹à¾ÔèÁàµÔÁ ãËéÊÓÃͧÃÕ¨ÔÊ·ÃÕ¡è͹·Ó¡ÒûÃѺà»ÅÕè¹ à¾×èÍ·Õè¤Ø³¨ÐÊÒÁÒö¤×¹¤èÒÃÕ¨ÔÊ·ÃÕä´éËÒ¡ÁջѭËÒà¡Ô´¢Öé¹ ÊÓËÃѺ¢éÍÁÙÅà¾ÔèÁàµÔÁà¡ÕèÂǡѺÇÔ¸Õ¡ÒÃÊÓÃͧ¢éÍÁÙÅáÅФ׹¤èÒÃÕ¨ÔÊ·ÃÕ â»Ã´¤ÅÔ¡·ÕèËÁÒÂàÅ¢º·¤ÇÒÁµèÍ仹Õé à¾×èÍ´Ùº·¤ÇÒÁã¹°Ò¹¤ÇÒÁÃÙé¢Í§ Microsoft::In Windows NT 4.0, the current security settings must be verified by using the Regedt32 tool to view the registry. â´ÂãËé·ÓµÒÁ¢Ñ鹵͹µèÍ仹Õé::

1. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹ¤ÅÔ¡àÃÕ¡ãªé»ÃÐàÀ·:regedt32áÅéÇ ¤ÅÔ¡µ¡Å§.
2. Expand the following registry subkeys, and then view the value that is assigned to the RestrictAnonymous entry:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rdr\Parameters
3. Expand the following registry subkeys, and then view the value that is assigned to the LM Compatibility entry:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\LMCompatibilityLevel
4. Expand the following registry subkeys, and then view the value that is assigned to the EnableSecuritySignature (server) entry:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rdr\Parameters\EnableSecuritySignature
5. Expand the following registry subkeys, and then view the value that is assigned to the RequireSecuritySignature (server) entry:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rdr\Parameters\RequireSecuritySignature
6. Expand the following registry subkeys, and then view the value that is assigned to the RequireSignOrSeal entry:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
7. Expand the following registry subkeys, and then view the value that is assigned to the SealSecureChannel entry:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
8. ¢ÂÒ¤ÕÂìÂèÍ¢ͧÃÕ¨ÔÊ·ÃÕµèÍ仹Õé áÅд٤èÒ·Õè¶Ù¡¡Ó˹´ãËé¡ÑºÃÒ¡Òà SignSecureChannel áÅéÇ:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
9. ¢ÂÒ¤ÕÂìÂèÍ¢ͧÃÕ¨ÔÊ·ÃÕµèÍ仹Õé áÅд٤èÒ·Õè¶Ù¡¡Ó˹´ãËé¡ÑºÃÒ¡Òà RequireStrongKey áÅéÇ:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

ÇÔ¸Õ¡ÒÃÊÒÁ: µÃǨÊͺÊÔ·¸Ô¢Í§¼Ùéãªé

àÁ×è͵éͧ¡ÒõÃǨÊͺÊÔ·¸Ôì¢Í§¼Ùéãªéº¹¤ÍÁ¾ÔÇàµÍÃì·Õèãªé Windows 2000 ´Óà¹Ô¹¡ÒôѧµèÍ仹Õé:

1. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹªÕéä»·Õèâ»Ãá¡ÃÁªÕéä»·Õèà¤Ã×èͧÁ×Í¡ÒôÙáÅÃкºáÅéÇ ¤ÅÔ¡¹âºÒ¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑ·éͧ¶Ôè¹.
2. ¢ÂÒ¹âºÒ·éͧ¶Ôè¹áÅéÇ ¤ÅÔ¡¡ÒáÓ˹´ÊÔ·¸Ôì¢Í§¼Ùéãªé.
3. 㹺ҹ˹éÒµèÒ§'¢ÇÒ' ¤ÅÔ¡Êͧ¤ÃÑ駡ÒÃà¢éÒ¶Ö§¤ÍÁ¾ÔÇàµÍÃìà¤Ã×èͧ¹Õé¨Ò¡à¤Ã×Í¢èÒÂ.
4. ¤ÅÔ¡à¾×èÍàÅ×Í¡¹Ñ鹡ÒõÑ駤èÒ¹âºÒ·éͧ¶Ô蹡Åèͧ¡Òà¤Ã×èͧËÁÒ·ÕèÍÂÙè¶Ñ´¨Ò¡¹Ñé¹Everyone¨Ñ´¡ÅØèÁ㹡ÒáÓ˹´ãËé¡ÑºÃÒ¡Òà áÅШҡ¹Ñé¹ ¤ÅÔ¡µ¡Å§.
5. ¤ÅÔ¡Êͧ¤ÃÑ駻¯Ôàʸ¡ÒÃà¢éÒ¶Ö§¤ÍÁ¾ÔÇàµÍÃìà¤Ã×èͧ¹Õé¨Ò¡à¤Ã×Í¢èÒÂ.
6. µÃǨÊͺÇèÒ äÁèÁÕ¡ÅØèÁËÅѡ㹡ÒáÓ˹´ãËé¡ÑºÃÒ¡Òà áÅШҡ¹Ñé¹ ¤ÅÔ¡µ¡Å§. µÑÇÍÂèÒ§àªè¹ µÃǨÊͺãËéá¹èã¨ÇèÒ·Ø¡¤¹ ¼Ùé ãªé·ÕèÁÕ¡ÒÃÃѺÃͧ¤ÇÒÁ¶Ù¡µéͧ áÅÐ ¡ÅØèÁÍ×è¹ äÁèáÊ´§
7. ¤ÅÔ¡µ¡Å§áÅéÇ ÍÍ¡¨Ò¡¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑ·éͧ¶Ôè¹¹âºÒÂ

àÁ×è͵éͧ¡ÒõÃǨÊͺÊÔ·¸Ôì¢Í§¼Ùéãªéº¹¤ÍÁ¾ÔÇàµÍÃì·Õèãªé Windows Server 2003 ´Óà¹Ô¹¡ÒôѧµèÍ仹Õé:

1. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹªÕéä»·Õèà¤Ã×èͧÁ×Í¡ÒôÙáÅÃкºáÅéÇ ¤ÅÔ¡µÑǤǺ¤ØÁâ´àÁ¹¹âºÒ¤ÇÒÁ»ÅÍ´ÀÑÂ.
2. ¢ÂÒ¹âºÒ·éͧ¶Ôè¹áÅéÇ ¤ÅÔ¡¡ÒáÓ˹´ÊÔ·¸Ôì¢Í§¼Ùéãªé.
3. 㹺ҹ˹éÒµèÒ§'¢ÇÒ' ¤ÅÔ¡Êͧ¤ÃÑ駡ÒÃà¢éÒ¶Ö§¤ÍÁ¾ÔÇàµÍÃìà¤Ã×èͧ¹Õé¨Ò¡à¤Ã×Í¢èÒÂ.
4. Make sure that the Everyone group is in theAccess this computer from the networkÃÒ¡Òà If the Everyone group is not listed, follow these steps:
   1. ¤ÅÔ¡à¾ÔèÁ¼ÙéãªéËÃ×Í¡ÅØèÁ.
   2. 㹡ÒÃUser and group names¡Åèͧ ª¹Ô´EveryoneáÅéÇ ¤ÅÔ¡µ¡Å§.
5. ¤ÅÔ¡Êͧ¤ÃÑé§Deny access to this computer from the network.
6. Verify that there are no principle groups in theDeny access to this computer from the networklist, and then clickµ¡Å§. For example, make sure that Everyone, Authenticated Users, and other groups, are not listed.
7. ¤ÅÔ¡µ¡Å§, and then close the Domain Controller Security Policy.

To verify the required user rights on a Windows NT Server 4.0-based computer, follow these steps:

1. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹªÕéä»·Õèâ»Ãá¡ÃÁªÕéä»·Õèà¤Ã×èͧÁ×Í¡ÒôÙáÅÃкºáÅéÇ ¤ÅÔ¡µÑǨѴ¡ÒüÙéãªéÊÓËÃѺâ´àÁ¹.
2. 㹡ÒùâºÒÂàÁ¹Ù ¤ÅÔ¡User Rights.
3. 㹡ÒÃRightÃÒ¡Òà ¤ÅÔ¡Access this computer from the network.
4. 㹡ÒÃGrant tobox, make sure that the Everyone group is added. If the Everyone group is not added, follow these steps:
   1. ¤ÅÔ¡add.
   2. 㹡Òê×èÍÃÒ¡Òà ¤ÅÔ¡Everyone¤ÅÔ¡addáÅéÇ ¤ÅÔ¡µ¡Å§.
5. ¤ÅÔ¡µ¡Å§, and then quit User Manager.

Method four: Verify group membership

If a trust is set up between the domains, but you cannot add principle user groups from one domain to the other because the dialog box does not locate the other domain objects, the "Pre-Windows 2000 compatible access" group may not have the correct membership.

On the Windows 2000-based domain controllers and the Windows Server 2003-based domain controllers, make sure that the required group memberships are configured.

To do this on the Windows 2000-based domain controllers, follow these steps:

1. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹªÕéä»·Õèâ»Ãá¡ÃÁªÕéä»·Õèà¤Ã×èͧÁ×Í¡ÒôÙáÅÃкºáÅéÇ ¤ÅÔ¡¼Ùéãªé¢Í§ä´àá·ÍÃÕ·Õèãªé§Ò¹ÍÂÙèáÅФÍÁ¾ÔÇàµÍÃì.
2. ¤ÅÔ¡Built ináÅéÇ ¤ÅÔ¡Êͧ¤ÃÑé§Pre-Windows 2000 compatible access group.
3. ¤ÅÔ¡¡ÒÃÊÁÒªÔ¡tab, and then make sure that the Everyone group is in theÊÁÒªÔ¡ÃÒ¡ÒÃ
4. If the Everyone group is not in theÊÁÒªÔ¡ÃÒ¡Òà ·ÓµÒÁ¢Ñ鹵͹àËÅèÒ¹Õé:
   1. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹ¤ÅÔ¡àÃÕ¡ãªé»ÃÐàÀ·:cmdáÅéÇ ¤ÅÔ¡µ¡Å§.
   2. ·Õè¾ÃÍÁµì¤ÓÊÑè§ ¾ÔÁ¾ì:net localgroup "Pre-Windows 2000 Compatible Access" everyone /addáÅéÇ ¡´ ENTER

To make sure that the required group memberships are configured on the Windows Server 2003-based domain controllers, you must know if the "Network access: Let Everyone permissions apply to anonymous users" policy setting is disabled. If you do not know, use the Group Policy Object Editor to determine the state of the "Network access: Let Everyone permissions apply to anonymous users" policy setting. â´ÂãËé·ÓµÒÁ¢Ñ鹵͹µèÍ仹Õé::

1. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹ¤ÅÔ¡àÃÕ¡ãªé»ÃÐàÀ·:gpedit.mscáÅéÇ ¤ÅÔ¡µ¡Å§.
2. Expand the following folders:
   ¹âºÒ¤ÍÁ¾ÔÇàµÍÃì੾ÒзÕè
   ¡ÒáÓ˹´¤èÒ¤ÍÁ¾ÔÇàµÍÃì
   ¡ÒõÑ駤èÒ windows
   ¡ÒõÑ駤èÒ¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑÂ
   ¹âºÒ·éͧ¶Ôè¹
3. ¤ÅÔ¡µÑÇàÅ×Í¡¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑÂáÅéÇ ¤ÅÔ¡Network access: Let Everyone permissions apply to anonymous users㹺ҹ˹éÒµèÒ§´éÒ¹¢ÇÒ
4. Note if the value in theSecurity Settingcolumn is·Õè»Ô´ãªé§Ò¹ËÃ×Í·Õèà»Ô´ãªé§Ò¹.

To make sure that the required group memberships are configured on the Windows Server 2003-based domain controllers, follow these steps:

1. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹªÕéä»·Õèâ»Ãá¡ÃÁªÕéä»·Õèà¤Ã×èͧÁ×Í¡ÒôÙáÅÃкºáÅéÇ ¤ÅÔ¡¼Ùéãªé¢Í§ä´àá·ÍÃÕ·Õèãªé§Ò¹ÍÂÙèáÅФÍÁ¾ÔÇàµÍÃì.
2. ¤ÅÔ¡Built ináÅéÇ ¤ÅÔ¡Êͧ¤ÃÑé§Pre-Windows 2000 compatible access group.
3. ¤ÅÔ¡¡ÒÃÊÁÒªÔ¡á·çº
4. ¶éÒ¡ÒÃNetwork access: Let Everyone permissions apply to anonymous userspolicy setting is disabled, make sure that the Everyone, Anonymous Logon group is in theÊÁÒªÔ¡ÃÒ¡Òà If the "Network access: Let Everyone permissions apply to anonymous users" policy setting is enabled, make sure that the Everyone group is in theÊÁÒªÔ¡ÃÒ¡ÒÃ
5. If the Everyone group is not in theÊÁÒªÔ¡ÃÒ¡Òà ·ÓµÒÁ¢Ñ鹵͹àËÅèÒ¹Õé:
   1. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹ¤ÅÔ¡àÃÕ¡ãªé»ÃÐàÀ·:cmdáÅéÇ ¤ÅÔ¡µ¡Å§.
   2. ·Õè¾ÃÍÁµì¤ÓÊÑè§ ¾ÔÁ¾ì:net localgroup "Pre-Windows 2000 Compatible Access" everyone /addáÅéÇ ¡´ ENTER

Method five: Verify connectivity through network devices, such as firewalls, switches, or routers

If you have received error messages that are similar to the following error message and you have verified that the LMHOST files are correct, the issue may be caused by a firewall, router or switch that has blocked ports between the domain controllers:To troubleshoot network devices, use PortQry Command Line Port Scanner version 2.0 to test the ports between your domain controllers.For more information about PortQry version 2, click the following article number to view the article in the Microsoft Knowledge Base:ÊÓËÃѺ¢éÍÁÙÅà¾ÔèÁàµÔÁà¡ÕèÂǡѺÇÔ¸Õ¾ÍÃìµ·Õèµéͧ¶Ù¡¡Ó˹´¤èÒ ¤ÅÔ¡ËÁÒÂàÅ¢º·¤ÇÒÁµèÍ仹Õéà¾×èÍ´Ùº·¤ÇÒÁã¹°Ò¹¤ÇÒÁÃÙé¢Í§ Microsoft:

ÇÔ¸Õ¡Òà six: ÃǺÃÇÁ¢éÍÁÙÅà¾ÔèÁàµÔÁà¾×èͪèÇÂá¡é䢻ѭËÒ

¶éÒÇÔ¸Õ¡Òáè͹˹éÒ¹ÕéäÁèÊÒÁÒöªèǤسá¡é»Ñ­ËÒ¹Õé à¡çºÃǺÃÇÁ¢éÍÁÙÅà¾ÔèÁàµÔÁµèÍ仹Õéà¾×èͪèǤسá¡éä¢ÊÒà˵آͧ»Ñ­ËÒ:

• ¡ÒÃà»Ô´ãªé§Ò¹ netlogon ¨Ðà¢éÒÊÙèÃкºã¹µÑǤǺ¤ØÁâ´àÁ¹·Ñé§ÊͧÊÓËÃѺ¢éÍÁÙÅà¾ÔèÁàµÔÁà¡ÕèÂǡѺÇÔ¸Õ¡ÒÃà¢éÒÊÙèÃкº netlogon ¨ÐàÊÃç¨ÊÁºÙóìáÅéÇ ¤ÅÔ¡ËÁÒÂàÅ¢º·¤ÇÒÁµèÍ仹Õéà¾×èÍ´Ùº·¤ÇÒÁã¹°Ò¹¤ÇÒÁÃÙé¢Í§ Microsoft:
  109626

  (http://support.microsoft.com/kb/109626/ )

  ¡ÒÃà»Ô´ãªé§Ò¹¡Òúѹ·Ö¡¡ÒõÃǨá¡é¨Ø´º¡¾ÃèͧÊÓËÃѺºÃÔ¡ÒáÒÃà¢éÒÊÙèÃкºÊØ·¸Ô
• ¨ÑºÀÒ¾¡ÒÃÊ׺¤é¹¡ÅѺº¹µÑǤǺ¤ØÁâ´àÁ¹·Ñé§ã¹àÇÅÒà´ÕÂǡѹ·Õèà¡Ô´»Ñ­ËÒÊÓËÃѺ¢éÍÁÙÅà¾ÔèÁàµÔÁà¡ÕèÂǡѺÇÔ¸Õ¡ÒèѺÀÒ¾¡ÒÃÃѺÊ觢éÍÁÙÅà¤Ã×Í¢èÒ ¤ÅÔ¡ËÁÒÂàÅ¢º·¤ÇÒÁµèÍ仹Õéà¾×èÍ´Ùº·¤ÇÒÁã¹°Ò¹¤ÇÒÁÃÙé¢Í§ Microsoft:
  812953

  (http://support.microsoft.com/kb/812953/ )

  ÇÔ¸Õ¡ÒÃãªé¡ÒõÃǨÊͺà¤Ã×Í¢èÒÂà¾×èͨѺÀÒ¾¡ÒÃÃѺÊ觢éÍÁÙÅà¤Ã×Í¢èÒÂ