You may receive an "Access denied" error message when you try to join a client computer to a Microsoft Windows Small Business Server 2003 domain by using the ConnectComputer Wizard (908372)


The information in this article applies to:

  • Microsoft Windows Small Business Server 2003, Standard Edition
  • Microsoft Windows Small Business Server 2003, Premium Edition
  • Microsoft Small Business Server 2000
Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry

SYMPTOMS

You try to join a client computer to a Microsoft Windows Small Business Server 2003 domain by using the ConnectComputer Wizard. The client computer is running is running Microsoft Windows 2000 or Microsoft Windows XP Professional Edition. When you run the ConnectComputer Wizard, you may receive the following error message on the client computer:
Access denied
Additionally, the following message may be logged in the SBSNetSetup.log file:
FinishNetworkingSetup() -- NetJoinDomain() failed [5], returning
FinishNetworkingSetup() failed -- hr == [-2147467259]
Note This problem does not occur on client computers that have never joined a domain.

CAUSE

This problem occurs if the client computer was previously joined to a domain that had policies that disabled SMB signing.

RESOLUTION

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk. To resolve this problem, follow these steps on the client computer:
  1. Click Start, click Run, type regedt32, and then click OK.
  2. In Registry Editor, locate and then click the following registry subkey:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa.

    Make sure that the Restrictanonymoussam registry entry is set to a value of 0x1.
  3. Locate and then click the following registry subkey:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters

    Make sure that the Enablesecuritysignature registry entry is set to a value of 1. Make sure that the Requiresecuritysignature registry entry is set to a value of 0.
  4. Locate and then click the following registry subkey:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworksation\parameters

    Make sure that the Enablesecuritysignature registry entry is set to a value of 1. Make sure that the Requiresecuritysignature registry entry is set to a value of 0.
  5. Restart the client computer.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Modification Type:MajorLast Reviewed:11/16/2005
Keywords:kbtshoot kbprb KB908372
©2004 Microsoft Corporation. All rights reserved.