"Picker cannot open because it cannot determine whether <Network Name Resource> is joined to a domain" error message

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
To troubleshoot this problem, perform each of the following troubleshooting steps. After you complete each step, see if you can delegate permissions. If you still cannot delegate permissions, continue to the next step.

Step 1: Confirm the TCP/IP NetBIOS Settings

1. Verify that Netbios over TCP is selected in the Advanced TCP settings on the Windows 2000-based computer.
2. Verify that the TCP/IP NetBIOS Helper (LmHosts) service is enabled and started on the domain controllers and on all member servers.
   

Step 2: Confirm That There Are No Access Restrictions to the Registry

• Verify that 'System\CurrentControlSet\Control\ProductOptions' is listed in the
  Machine value:
  
  1. Start Registry Editor.
  2. Locate and then click the following registry key:
     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedPaths
     
     
  3. Confirm the following settings:
     Value: Machine
     
     Type: REG_MULTI_SZ - Multi string
     
     Default Data:
     System\CurrentControlSet\Control\ProductOptions
     
     System\CurrentControlSet\Control\Print\Printers
     
     System\CurrentControlSet\Control\Server Applications
     
     System\CurrentControlSet\Services\Eventlog
     
     Software\Microsoft\Windows NT\CurrentVersion
     
     
  The valid range for the
  Machine value is a valid path to a location in the registry. The purpose of the
  Machine value is to allow computer access to listed locations in the registry, provided that no explicit access restriction exists for that location.
• Verify that the winreg registry key has Read permissions for the System account:
  
  1. Start Registry Editor.
  2. Locate and then click the following registry key:
     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg
     
     
     
     
  3. In the Edit menu, click
     Permissions, and then make sure that the System account has Read permissions for key.
  If the winreg registry key does not have the correct permissions, you can export the registry key from a server that works to the server you are trying to access.
  
  For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
  314837 How to manage remote access to the registry
  
  

Step 3: Confirm that Anonymous Connections Can Perform Enumeration Functions

Confirm the following registry settings on the member servers that you are trying to access: The purpose of the registry value is to configure local system policy to determine whether authentication is required to perform common enumeration functions. You can configure the account name list to require authentication. This authentication requirement is an optional feature.


When the RestrictAnonymous value is set to 1, anonymous connections that are generated from the Graphical User Interface (GUI) tools for security management receive an "access denied" error message when these connections try to obtain the list of account names.


For additional information about the "RestrictAnonymous" registry value, click the following article number to view the article in the Microsoft Knowledge Base:

178640 Could not find domain controller when establishing a trust

Step 4: Confirm SMB Signing Settings

You may receive the error message that is described in the "Symptoms" section of this article if SMB Signing is turned on and if it is required. To confirm that SMB Signing is not turned on and that it is not required:

1. Start Registry Editor.
2. Locate and then click the following registry key:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters
   
   
   This key contains the following values:
   Value Name: EnableSecuritySignature
   
   Data Type: REG_DWORD
   
   Data: 0 (disable), 1 (enable)
   
   Value Name: RequireSecuritySignature
   
   Type: REG_DWORD
   
   Value: 0 (disable), 1 (enable)
   
   Default: 0
3. Set the EnableSecuritySignature value and the
   RequireSecuritySignaturevalue to 0 (zero).

For additional information about this registry key, click the following article number to view the article in the Microsoft Knowledge Base:

161372 How to enable SMB signing in Windows NT

Step 5: Confirm that the domain controller is reachable

If you cannot view or make permission changes on a Distributed File System (DFS) share, verify that you can reach the domain controller by testing name resolution. If your DNS server returns a list of IP addresses for domain controllers, your computer pings the first IP address to check connectivity. After a successful ping reply, the client tries to connect to the domain controller by using the SMB protocol. If this step fails, you receive the "Object Picker" error message.