Win2000 with very slow logon times

[Vette]

I recently set up a Windows 2000 Server DC and 4 Win 2000 workstations (all new) running them through a linksys 16 port hub and a Dlink VPN firewall and everything went well setting up the DC, workstations, and firewall except for the workstations logon times which are very inconsistant. Sometimes it may take up to 20 minutes for a station to logon and sometimes it may only take about 30 seconds. I checked the logs and it kept referring to some of the errors found in MS article 316239 about "SVR records cannot be registered on a DNS server". I followed the resolution about the forward lookup zone and when I attempt to make the change to allow dynamic updates, I get a DNS error that says "the data on the primary zone failed to set...access was denied. I've tried setting all the workstations (8 total) and server in the domain to static ip's on both the server and the VPN. Once the stations are logged on, they access the network and internet fine and fast, it just takes them forever to logon. I cannot find any MS KB articles about the primary zone error message. I've flushed DNS, ran ipconfig release / renew on all computers, etc, tried using the VPN as the DNS server and nothing seems to help. Ideas??? Suggestions???

[Gollo]

you using roaming profiles? Some of those can get pretty big and I've seen it take a long time to logon. Aside from that I think you were on the right track with the dns. Sadly I have very VERY little knowledge of 2kserver

[FatalException0E]

you using roaming profiles? Some of those can get pretty big and I've seen it take a long time to logon. Aside from that I think you were on the right track with the dns. Sadly I have very VERY little knowledge of 2kserver

Right, like when people have 5 GB of mp3s on their desktop.......

Are the logon times consistant in any way at all? (one WS always takes forever, one is always quick, one user always takes forever, one is always quick)

[confus-ed]

Mmm I have no 'do this & it'll fix it' type answer either, & you've probably looked at this Windows 2000 server documentation, Troubleshoot DNS clients but maybe you haven't ..

[Vette]

Yes, I have checked the Win 2000 Server documentation, but it does not answer the problem that is preventing me from making the changes to allow dynamic updates where I'm getting the error about "data in the primary zone failed to set" " access was denied". I am using roaming profiles on all workstations, but these are new installations on half of the WS's. There is no consistancy on any of the logon times. Sometimes it's vary fast on one WS and the WS on the same room my still be waiting 15 minutes later and vice versa. One trick I have discovered was while a WS is booting is to unplug the cat5 cable for a second or two then plug it back in. That seems to speed thing up considerably, but it also is not a fix and sometimes it fails to "see" the server. The screens that it hangs the longest on is preparing network settings and applying personal settings. The server boots up with no hang-ups what so ever. I've also tried to change the switch over to a hub. If I enter the IP address that I have assigned to each WS from the server, they boot up fast (less than a minute) but it kills thier internet access because the server is behind thier firewall. The firewall has 8 ports and I have tried plugging directly into it, with the same slow inconsistant results. If this keeps up, I may start heavily!!!

[[email protected]]

I had the same issue on a domain server with long wait for logon to the domain by any workstations. The way to fix it is to put the SERVER address into the primary DNS address and the regular DNS into the secondary DNS. Nothing else seems to matter, but the Primary DNS needs to have the SERVER address in there. This works for w2k workstations XP and 2k3 systems.

[NooNoo]

That implies the workstations cannot easily find the dhcp server. In the network properties for the ws you should as grant has outlined give the dns server address, the gateway address, wins address.

[confus-ed]

I had the same issue on a domain server with long wait for logon to the domain by any workstations. The way to fix it is to put the SERVER address into the primary DNS address and the regular DNS into the secondary DNS. Nothing else seems to matter, but the Primary DNS needs to have the SERVER address in there. This works for w2k workstations XP and 2k3 systems.

& also Noo's comments apply ..

Isn't that how its meant to be ? In a domain your primary DNS server is the internet effectively (all that tree stuff) & if that falls over you get no internet, but if you shove your ISPs DNS or your backup controller in as second it has somewhere else to resolve from ?

I'm a bit lost with this as to whats deing described as 'regular DNS' .. it's making me, wait for it ... confus-ed !

[[email protected]]

this is all getting way to confusing. Check the Firewall, and the Server. Are they both supplying DHCP addressing? Only one can do this. Point the Primary DNS to the server, or the firewall- which ever you have set up for supplying DHCP addressing. Ths second DNS address needs to be from your isp. That should fix the long login problem. Do a ipconfig /all to check to see where the addressing is set to check it.

[Vette]

I had the same issue on a domain server with long wait for logon to the domain by any workstations. The way to fix it is to put the SERVER address into the primary DNS address and the regular DNS into the secondary DNS. Nothing else seems to matter, but the Primary DNS needs to have the SERVER address in there. This works for w2k workstations XP and 2k3 systems.

[email protected] you hit it square on the head. Your suggestion got things up and going MUCH faster. I still have some minor problems to sort out, but I'm getting there. Like you said I changed the WS's to get DNS from the VPN firewall as a secondary and the gateway as the primary. I left the WS's getting a static IP address from the server, but removed that static setting from the workstations. They have a server assigned IP from their ISP and if I left in on the stations, it killed their internet. I still have one that is still taking a while to boot ( it hangs on loading your personal settings) so I am going to set up a new user on the server and the WS and see it it boots any better. If it does, I'll transfer her stuff to the new user folder. I guess the WS's couldn't see the forrest because of the trees in the domain or something like that???

Thanks for the help everyone that put in thier $.02 worth
and here's to ya

[confus-ed]

. I guess the WS's couldn't see the forrest because of the trees in the domain or something like that???..

Hell yes, I can relate to anyone who can't see the wood for the trees ! & especially with the dumb container objects Billy Boy picked with his concepts, not helpful at all .. understanding what's supposed to happen in the first place sure helps - it took me a fair old while to get my head around all them trees & forrests too

[gazzak]

[email protected] you hit it square on the head. Your suggestion got things up and going MUCH faster. I still have some minor problems to sort out, but I'm getting there. Like you said I changed the WS's to get DNS from the VPN firewall as a secondary and the gateway as the primary. I left the WS's getting a static IP address from the server, but removed that static setting from the workstations. They have a server assigned IP from their ISP and if I left in on the stations, it killed their internet. I still have one that is still taking a while to boot ( it hangs on loading your personal settings) so I am going to set up a new user on the server and the WS and see it it boots any better. If it does, I'll transfer her stuff to the new user folder. I guess the WS's couldn't see the forrest because of the trees in the domain or something like that???

Thanks for the help everyone that put in thier $.02 worth
and here's to ya

It's always good for people to post back results, especially good ones!!

[dddwarp]

Here is how I found to set-up Windows 2000 domain. First, remember that Win2000 domain relies on DNS so DNS is very important. When you installed AD, you were asked for the DNS server you wanted to use or the option to install DNS on the first Domain contoller. I have found that installing DNS services on the DC is the easiest method. Even if you have another DNS server (I have 2), it is easier to have a DC be your DNS server. You can always have forwarders to other DNS servers. Then you have the workstations point to the DC as their primary DNS. If you point the workstations to your ISP DNS, it may take a long time to logon. The reason is that the workstation needs to be able to find AD resources with DNS. Also, DNS on DC will add the workstation to the DNS records dynamically with DDNS. Then the entire domain will be able to find that workstation. You do not need your ISP DNS, when you install DNS on Win2000, it has the internet roots already so it can go to the internet. If you want a secondary DNS for the workstations, you can put your ISP but remember it will hard for workstations to find domain resources.