Common Issues

The Help and Support Center troubleshooting section for Active Directory can lead you down the most direct path to the Promised Land of problem resolution. If you're an independent spirit, however, you may want to try to troubleshoot problems without any aid from the Help system. Luckily for you, the most common problems, which result from a failed or misbehaved Active Directory, are relatively easy to diagnose.

Communication interruption

The most common Active Directory problem is a communication interruption. Simply put, a communication interruption is anything that prevents clear and complete packet transactions between two hosts . These interruptions can result from something as simple as a broken network cable or an offline computer. More complex problems, such as a router with a corrupt routing table or a DNS server with wrongly defined entries, can also cause interruptions. When the problem is physical, you may need to replace the cables or reboot the system to restore functionality. When the problem is more complex, you need to investigate troubleshooting options specific to the ailing service.

If you suspect that a communication interruption is occurring, you can use common networking tools to help you obtain more specific information. For example, if your network uses the Transmission Control Protocol/Internet Protocol (TCP/IP), you can use tools designed for troubleshooting this protocol. The two most useful tools for this protocol are PING and TRACERT. (See Chapter 14 for more information on PING and TRACERT.) PING informs you whether packets can traverse the network between your system and any other host. TRACERT informs you of each router jump between you and another host and whether transmission is not possible past a specific route point.

If the results of both PING and TRACERT show that packets may not even be leaving your computer, use > IPCONFIG /ALL to verify that the TCP/IP protocol is properly installed and that its settings (IP address, subnet mask, default gateway, and so on) are correct. If any settings are incorrect, change them through the Local Area Connection interface (Start Control Panel Network Connections Local Area Connection) and reboot.

Group Policy problems

Another common problem arises from Group policies that either restrict access too much or contradict or overlap each other, which causes inconsistencies in the way the system functions. You'll need to examine the Group policies for each domain, user , group, and organizational unit to determine where the problem lies.

Domain controller communication

If Windows NT 4.0 backup domain controllers (BDCs) and Windows Server 2003 domain controllers are unable to communicate, you've probably enabled native mode for the domain. Active Directory in Windows Server 2003 can operate in four modes: Windows 2000 mixed, Windows 2000 native, Windows .NET, and Windows .NET interim.

Windows 2000 mixed mode is the default mode that allows both Windows Server 2003 domain controllers and Windows NT 4.0 Servers installed as BDCs to act as domain controllers interactively. Windows 2000 native mode prevents Windows NT 4.0 Servers from participating in domain controlling.

The big problem with the mode setting is that after it's set to native mode, it can't be reversed without a complete system reinstallation. Therefore, administrators should switch domains over to native mode only after they are absolutely sure that Windows NT 4 BDCs are no longer required.

The mode setting is made using the Active Directory Domains and Trusts tool (Start Administrative Tools Active Directory Domains and Trusts). Select the domain you want to switch over, right-click, and choose Raise Domain Functional Level. Then, in the Raise Domain Functional Level dialog box, choose a functional level (mode) from the Select an Available Domain Functional Level list.

If the combination of automated housecleaning, the instructions found in the Help and Support Center, and your own troubleshooting efforts fail to resolve your Active Directory problem, there's only one solution left - restoration from backup.