Event ID 517 — Active Directory Integration
Applies To: Windows Server 2008
.jpg)
Windows Deployment Services depends on Active Directory Domain Services for various functions. The Pre-Boot Execution Environment (PXE) provider creates machine accounts and service control points (SCPs) in Active Directory. An SCP is a child object under a Windows Deployment Services server account object, and it is used to store configuration data for the server. For example, an SCP can mark the server as a Windows Deployment Services server so that other Windows Deployment Services servers can find it.
Event Details
| Product: | Windows Operating System |
| ID: | 517 |
| Source: | BINLSVC |
| Version: | 6.0 |
| Symbolic Name: | E_BINL_DSLOOKUP_GC_CONNECT_FAILED |
| Message: | An error occurred in the Active Directory Connection Manager while contacting a Global Catalog server. Please ensure that an active Global Catalog server is available on the network. Error Information: %1 |
Resolve
Ensure that the PXE provider can contact Active Directory Domain Services
The Windows Deployment Services PXE provider must be able to contact Active Directory Domain Services, because the PXE provider provides client boot services over the network. Do the following in the specified order until your issue is resolved:
- Ensure that the domain controller is reachable.
- Ensure that the Windows Deployment Services server has network connectivity.
- Ensure that the machine account has sufficient permissions.
- Ensure that the registry data is correct.
Ensure that the domain controller is reachable
If you can ping the domain controller by IP address, this is not the problem. If you cannot ping it by IP address, confirm that:
- The domain controller computer is turned on.
- Active Directory Domain Service is running and has network connectivity.
If the domain controller is reachable, perform the procedures in the following section to confirm that the server has network connectivity.
Ensure that the Windows Deployment Services server has network connectivity
Note: The following procedures include steps for using the ping command to perform troubleshooting. Therefore, before performing these steps, determine whether the firewall settings or Internet Protocol security (IPsec) settings on your network allow Internet Control Message Protocol (ICMP) traffic. ICMP is the TCP/IP protocol that is used by the ping command.
To perform these procedures, you must either be a member of the local Administrators group or have been delegated the appropriate authority.
To determine whether there is a network connectivity problem:
- On the Windows Deployment Services server, open the Command Prompt window.
- At the command prompt, run ping <server FQDN>, where <server FQDN> is the fully qualified domain name (FQDN) of the domain controller (for example, server1.contoso.com).
- Run ping <IP Address>, where <IP Address> is the IP address of the domain controller.
- Note the following:
- If you can successfully ping the domain controller by IP address, but not by FQDN, this indicates a possible issue with DNS host name resolution.
- If you cannot successfully ping the domain controller by IP address, this indicates a possible issue with network connectivity, the firewall configuration, or the IPsec configuration.
If necessary, you can perform the following additional steps to help identify the root cause of the problem:
- Ping other computers on the network to determine the extent of the connectivity issue.
- If you can ping other servers but not the domain controller, try to ping the domain controller from another computer. If you cannot ping the domain controller from any computer, first ensure that the domain controller is running. If the domain controller is running, check its network settings.
- Check the TCP/IP settings on the local computer by performing the following steps:
- Open the Command Prompt window, run the ipconfig /all command**,** and then verify that the output is correct.
- Run ping localhost to verify that TCP/IP is installed and correctly configured on the local computer. If this command is unsuccessful, this may indicate a corrupt TCP/IP stack or a problem with your network adapter.
- Run ping <local IP address>.** **If you can ping the localhost address but not the local address, there may be an issue with the routing table or with the network adapter driver.
- Run ping <DNS server IP address>. If there is more than one DNS server on your network, you should ping each of them in turn. If you cannot ping the DNS servers, this indicates a potential problem with the DNS servers, or a network problem between the computer and the DNS servers.
- If the domain controller is on a different subnet, try to ping the default gateway. If you cannot ping the default gateway, this might indicate a problem with the network adapter, the router or gateway device, the cabling, or other connectivity hardware.
- In Device Manager, check the status of the network adapter. (To open Device Manager, click Start, click Run, type devmgmt.msc, and then click OK. )
- Check the network connectivity indicator lights on the computer and at the hub or router. Check the network cabling.
- Check the firewall settings by using the Windows Firewall with Advanced Security snap-in.
- Check the IPsec settings by using the IP Security Policy Management snap-in.
If the server has network connectivity, use the procedure in the following section to ensure that the machine account has the required permissions.
Ensure that the machine account has sufficient permissions
To fix this, on the server that contains Active Directory Domain Services, grant the machine account for the Windows Deployment Services server the necessary permissions so that it can read its service control point (SCP).
To perform this procedure, you must either be a member of the local Domain Admins group or have been delegated the appropriate authority.
To grant permissions to the SCP object:
- Open the Active Directory Users and Computers MMC Snap-in.
- Click View, and then click Advanced Features (if it is not already enabled).
- Access the properties of the computer account for the Windows Deployment Services server.
- On the Remote Install tab, click Advanced Settings.
- On the Security tab, click Add.
- Select the user, and then click Full Control on this object.
If the SCP object has the correct permissions, use the instructions in the following section to ensure that the registry data is correct.
Ensure that the registry data is correct
The registry data may be corrupt. To determine whether it is corrupt, run the WDSUTIL /get-server /server:<server name> command in the Command Prompt window. If this command fails or if the output is corrupted, you will need to reinitialize the server. To do this, run wdsutil /uninitialize-server at the command prompt, and then run wdsutil /initialize-server /reminst:<path to RemoteInstall folder>.
Verify
To perform this procedure, you must either be a member of the local Domain Admins group or have been delegated the appropriate authority.
To ensure that there is a service control point (SCP) in Active Directory:
- Open Active Directory Users and Computers. (Click Start, click Administrative Tools, and click Active Directory Users and Computers)
- Browse to the computer account for the Windows Deployment Services server.
- Right-click the server, and then click Properties.
- Ensure that there is a Remote Install tab with the introductory sentence "You can manage this remote installation server." The presence of this tab indicates that there is an SCP for this object.