You Cannot Browse the Drives of or Map a Drive to a Domain Controller from Any Client Computer (826902)

RESOLUTION

To determine if this issue is caused by a name resolution problem, first verify that the domain controller records appear correctly in Windows Internet Name Service (WINS) and Domain Name System (DNS). If the records are correct in WINS and DNS, use the Active Directory Service Interfaces (ADSI) Edit utility to edit the userAccountControl attribute value. (The ADSI Edit utility is located in the Support Tools folder on the Windows 2000 CD-ROM.) To edit the value, follow these steps.

Warning If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client, and you incorrectly modify the attributes of Active Directory objects, you can cause serious problems. These problems may require you to reinstall Microsoft Windows 2000 Server, Microsoft Windows Server 2003, Microsoft Exchange 2000 Server, Microsoft Exchange Server 2003, or both Windows and Exchange. Microsoft cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk.

1. Click Start, point to Programs, point to Windows 2000 Support Tools, point to Tools, and then click ADSI Edit.
2. Expand Domain NC, expand DC=Domain Components, and then expand OU=Domain Controllers.
3. Right-click the domain controller that you cannot browse the drives of or map a drive to, and then click Properties.
4. In the Select which properties to view box, click Both.
5. In the Select a property to view box, click userAccountControl.
6. In the Edit Attribute box, type 532480, click Set, click Apply, and then click OK.
7. Quit ADSI Edit.
8. Use the Netdom.exe utility to reset the security channel between the domain controller and one of its replication partners. (Netdom.exe is located in the Support Tools folder on the Windows 2000 CD-ROM.) To reset the security channel, follow these steps on the domain controller that you cannot browse or map a network drive to:
   1. Set the Startup type of the Kerberos Key Distribution Center service to Manual, and then stop the service. (Because you are trying to reset the password for a Windows domain controller, you must complete this procedure before you go to step 8b.) To do so, follow these steps:
      1. Click Start, point to Programs, point to Administrative Tools, and then click Services.
      2. In the right pane, right-click Kerberos Key Distribution Center, and then click Properties.
      3. In the Startup type box, click Manual.
      4. Click Stop, and then click OK.
   2. At a command prompt, type the following command, where Replication_Partner_Server_Name is the fully qualified DNS or NetBIOS name of a domain controller in the same domain as the local computer, and domainname\administrator_id is the NetBIOS domain name and administrator ID respectively:

      netdom resetpwd /server:Replication_Partner_Server_Name /userd:domainname\administrator_id /passwordd:*

      Adding the asterisk (*) value to the /passwordd: parameter specifies that you will be prompted for the password.
9. Restart the domain controller, and wait several minutes for replication to occur.
   
   Note After you restart the domain controller, you can restart the Kerberos Key Distribution Center service and then reset its Startup type to Automatic.