Q. A Windows Server 2003 computer cannot join a domain after you upgrade it to SP1 (Service Pack 1)?

When you attempt to join your Windows Server 2003 SP1 computer to a domain, the %SystemRoot%DebugNetSetup.LOG file contains entries like:

12/11 14:23:06 NetpDoDomainJoin12/11 14:23:06 NetpMachineValidToJoin: 'NewServer'12/11 14:23:06 NetpGetLsaPrimaryDomain: status: 0x012/11 14:23:06 NetpMachineValidToJoin: status: 0x012/11 14:23:06 NetpJoinDomain12/11 14:23:06 Machine: NewServer12/11 14:23:06 Domain: JSIINC.com12/11 14:23:06 MachineAccountOU: (NULL)12/11 14:23:06 Account: JSIINCadministrator12/11 14:23:06 Options: 0x2512/11 14:23:06 OS Version: 5.212/11 14:23:06 Build number: 379012/11 14:23:06 ServicePack: Service Pack 1, v.243812/11 14:23:06 NetpValidateName: checking to see if JSIINC.com is valid as type 3 name12/11 14:23:06 NetpValidateName: JSIINC.com is not a valid NetBIOS domain name: 0x7b12/11 14:23:06 NetpCheckDomainNameIsValid [ Exists ] for JSIINC.com returned 0x012/11 14:23:06 NetpValidateName: name JSIINC.com is valid for type 312/11 14:23:06 NetpDsGetDcName: trying to find DC in domain JSIINC.com, flags: 0x102012/11 14:23:06 NetpDsGetDcName: found DC \PDC.JSIINC.com in the specified domain11/02 11:07:38 NetUseAdd to \PDC.JSIINC.comIPC$ returned 5911/02 11:07:38 NetpJoinDomain: status of connecting to dc \PDC.JSIINC.com: 0x3b11/02 11:07:38 NetpDoDomainJoin: status: 0x3b

You may also notice that there are no icons for network connections in My Network Places or in Network Connections, and you receive an Access denied error message when you attempt to start the RPC (Remote Procedure Call) service.

This behavior occurs if the Impersonate a client after authentication policy is defined for a GPO (Group Policy Object) that is linked to the domain.

To workaround this problem:

1. Open a CMD.EXE window on the Windows Server 2003 SP1 computer that cannot join the domain.

2. Type CACLS %SystemRoot%System32Svchost.exe /E /G "NETWORK SERVICE":F and press Enter.