Microsoft KB Archive/832222

= You cannot connect to a remote Windows Server 2003 domain controller by using the Active Directory Users and Computers snap-in =

Article ID: 832222

Article Last Modified on 10/30/2006

-

APPLIES TO


 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)

-





Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



SYMPTOMS
When you use the Active Directory Users and Computers snap-in to connect to a remote Microsoft Windows Server 2003 domain controller, the operation may not be successful. Specifically, this issue may occur when you follow these steps:
 * 1) You right-click Active Directory Users and Computers .
 * 2) You click Connect to Domain Controller.



CAUSE
This issue may occur if incorrect permissions are set on the  subkey that is located in the following registry key on the domain controller:

For example, this issue may occur if the Local Service account does not have at least Read permissions to the  subkey.



RESOLUTION
To resolve this issue, make sure that the  subkey in the following registry key on the domain controller is configured with the correct permissions:

The following table lists the minimum permissions that must be set on the  subkey on the domain controller if you want to connect to that domain controller from another computer by using the Active Directory Users and Computers snap-in:

Group or User Account        Permissions

Administrators group         Full Control, Read Backup Operators group       Read Enterprise Admins group      Read Local Service account        Read

To assign or to verify permissions that are set on the  subkey on the domain controller, follow these steps.

Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.  Click Start, and then click Run. In the Open box, type regedit, and then click OK. Right-click the following registry subkey, and then click Permissions:

 

 Click each account that is displayed in the Group or user names list, and then verify that the appropriate permissions are configured for that account in the Permissions for  list.

If you have to add a group or a user account and assign permissions to that account, follow these steps:  Click Add.</li> In the Enter the object names to select box, type the group or the user account that you want to add, click Check Names, and then click OK.</li> In the Permissions for  list, click to select the Allow check box that is next to the permission setting that you want to assign.</li></ol> </li> Click OK.</li></ol>

Keywords: kbprb KB832222

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.