In Windows 2000 or XP, how do I troubleshoot authentication problems against the IU.EDU Kerberos realm?

Note: Currently Windows 2000 and XP are the only Windows operating systems that can authenticate against the IU.EDU Kerberos realm. Windows 95, 98, 98SE, Me, and NT cannot authenticate against the IU.EDU Kerberos realm.

If you have trouble authenticating against the IU.EDU Kerberos realm from a Windows 2000 or XP computer that is part of the IU Active Directory, you can use the information below to troubleshoot your problem:

Verify that your computer is part of the IU Active Directory

To authenticate against the IU.EDU Kerberos realm, your computer must be running Windows 2000 or XP and be part of the IU Active Directory (i.e., be in the ads.iu.edu domain). To verify this, follow the appropriate steps below:

Windows XP

1. From the desktop or the Start menu, right-click the My Computer icon and select Properties.
   
   
2. Select the Computer Name tab and click the Change... button.
   
   
3. In the "Member of" box, beneath the "Domain:" selection, you should see "ads.iu.edu".

Windows 2000

1. From the desktop, right-click the My Computer icon and select Properties.
   
   
2. Select the Network Identification tab and click the Properties button.
   
   
3. In the "Member of" box, beneath the "Domain:" selection, you should see "ads.iu.edu".

If you don't see "ads.iu.edu" in the text box beneath "Domain:", your computer is not part of the Active Directory. To add your computer to the Active Directory, see In ADS at IU, how do I add a Windows 2000, XP Professional, or 2003 computer to my organizational unit?

Activate your Network ID within the IU.EDU Kerberos realm

If you haven't already done so, you'll need to set your passphrase using IU's Passphrase Maintenance utility, available at:

If you can't remember whether you've already done this, using this utility again won't hurt anything.

You will need to enter your Network ID username and current passphrase. You can then re-enter your current passphrase and confirm it to continue using it, or you can change your passphrase. If your chosen passphrase (current or new) doesn't adhere to UITS passphrase guidelines, you'll be required to change it. For more information about passphrase guidelines, see Passwords and passphrases.

Verify that your primary DNS suffix is set to "ads.iu.edu"

To check your primary DNS suffix, follow the appropriate steps below:

Windows XP

1. From the Start menu, select Settings, and then Control Panel, or just Control Panel.
   
   
2. If you see a heading that says "Pick a category", look for the link to the left in the window that says Switch to Classic View. If you do not see the heading, simply proceed to the next step.
   
   
3. Double-click the System icon.
   
   
4. In the resulting System Properties dialog box, select the Computer Name tab, and then select the Change button.
   
   
5. In the resulting Computer Name Changes dialog box, click the More... button.
   
   
6. A dialog box titled DNS Suffix and NetBIOS Computer Name will appear. Beneath "Primary DNS suffix of this computer:", verify that it is "ads.iu.edu". If it is not, enter ads.iu.edu . Optionally, you can also check the box beside Change primary DNS suffix when domain membership changes.

Windows 2000

1. From the Start menu, select Settings, then Control Panel. Double-click the System icon.
   
   
2. In the resulting System Properties dialog box, select the Network Identification tab, and then select the Properties button.
   
   
3. In the resulting Identification Changes dialog box, click the More... button.
   
   
4. A dialog box titled DNS Suffix and NetBIOS Computer Name will appear. Beneath "Primary DNS suffix of this computer:", verify that it is "ads.iu.edu". If it is not, enter ads.iu.edu . Optionally, you can also check the box beside Change primary DNS suffix when domain membership changes.

Also see:

• With the Passphrase Maintenance utility, why did I get a "failed (server not available)" message while changing my passphrases?
• What is the difference between my Network ID and my ADS Domain account?
• At IU, in Windows 2000 or XP Professional, how do I configure my computer to connect to IU's Active Directory Services Domain?
• At IU, does UITS support Active Directory clients for operating systems other than Windows 2000 and XP Professional?
• At Indiana University, what is my Active Directory Services (ADS) Domain account?
• Using IU's Passphrase Maintenance utility, which shared central computer account passphrases can I change or reset?
• At IU, why is my ADS Domain account locked?