1

I'm having this issue with two Server 2008 R2 domain member servers built as VMWare guests. The DCs built at the same time do not have this issue.

When I try to ping 127.0.0.1 (or "localhost") when logged on with a domain (admin) account, I get an error saying "Unable to contact IP driver. General failure." However, if I'm logged on as the local Administrator account, it works fine.

I've tried resetting the TCP/IP stack with netsh int ip reset and rebooting. Makes no difference.

However, pinging the default gateway, its own IP and other hosts are just fine as the domain user.

Any pointers?

LeeM
  • 1,388
  • 9
  • 14

1 Answers1

0

Did you clone the effected virtual machines from an existing image or from each other? I'm inclined to think that if you did, they might have duplicate SIDs since it only effects Domain Accounts and not Local Accounts (I'm assuming you have tested with multiple accounts of both types to make sure it is not tied to those accounts specifically).

Give PsGetSID a try:

psgetsid \\Server01
psgetsid \\Server02



If you read Mark Russinovich’s Blog post The Machine SID Duplication Myth (and Why Sysprep Matters) you can get an idea of Microsoft's justification for depreciating NewSID. It basically boils down to a combination of a lack of confidence in the idea that duplicate SIDs actually cause the problems that people think they do and lack of confidence that a tool like NewSID actually changes all of the locations where the SID of the computer is hidden. That being said, Michael Murgolo's Sysprep, Machine SIDs and Other Myths tentatively agrees with Mark's post but adds a dash of caution, saying there are a number of problems that turned out to be caused by duplicate SIDs (or more appropriately by not SysPrep-ing your servers as part of your cloning or deployment process).

TL;DR: Always SysPrep your servers (or workstations) as part of your deployment process.

  • I was heading down this path myself as I thought about it overnight - definitely something to think of if there is a difference in local accounts and domain accounts. So, yes, checked today with PSGetSid - all these servers had identical SIDs. The annoying thing is having to run Sysprep to change them - I don't know why MS killed off NewSid. Once the server came back and was rejoined to the domain, localhost ping was fine with domain and non-domain accounts. – LeeM Jan 10 '14 at 10:58
  • @Trix - See my update. –  Jan 10 '14 at 18:39
  • Yes, I understand that the duplicate SIDs is more a "symptom" of Sysprep not having been run rather than the actual issue. (I wish that MS supplied actual info of what Sysprep does to the network stack). Alas, the servers were built and supplied by someone else. – LeeM Jan 20 '14 at 08:21