You may receive an “Access denied” error message when you try to join a client computer to a Microsoft Windows Small Business Server 2003 domain by using the ConnectComputer Wizard

Article translations Article translations
Article ID: 908372 - View products that this article applies to.
Important This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows registry
Expand all | Collapse all

SYMPTOMS

You try to join a client computer to a Microsoft Windows Small Business Server 2003 domain by using the ConnectComputer Wizard. The client computer is running is running Microsoft Windows 2000 or Microsoft Windows XP Professional Edition. When you run the ConnectComputer Wizard, you may receive the following error message on the client computer:
Access denied
Additionally, the following message may be logged in the SBSNetSetup.log file:

FinishNetworkingSetup() -- NetJoinDomain() failed [5], returning
FinishNetworkingSetup() failed -- hr == [-2147467259]
Note This problem does not occur on client computers that have never joined a domain.

CAUSE

This problem occurs if the client computer was previously joined to a domain that had policies that disabled SMB signing.

RESOLUTION

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To resolve this problem, follow these steps on the client computer:
  1. Click Start, click Run, type regedt32, and then click OK.
  2. In Registry Editor, locate and then click the following registry subkey:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
    Make sure that the Restrictanonymoussam registry entry is set to a value of 0x1.
  3. Locate and then click the following registry subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
    Make sure that the Enablesecuritysignature registry entry is set to a value of 1. Make sure that the Requiresecuritysignature registry entry is set to a value of 0.
  4. Locate and then click the following registry subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
    Make sure that the Enablesecuritysignature registry entry is set to a value of 1. Make sure that the Requiresecuritysignature registry entry is set to a value of 0.
  5. Restart the client computer.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Properties

Article ID: 908372 - Last Review: December 3, 2007 - Revision: 1.3
APPLIES TO
  • Microsoft Windows Small Business Server 2003 Standard Edition
  • Microsoft Windows Small Business Server 2003 Premium Edition
  • Microsoft Small Business Server 2000 Standard Edition
Keywords: 
kbtshoot kbprb KB908372

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com