2

On a Windows VM, while installing a service which needs to run under a domain account, my Domain Controller refuses to authenticate the domain account I use.

After I remove this VM from the domain, then re-add it again, the Domain Controller starts recognizing the domain account under which I am installing my service.

This usually happens when I rollback my VM to some previous check-point, although I am sure on the date of that check-point my VM was a member of the domain.

Question Why does the authentication fail after rolling back, until I have removed and re-added the VM to the AD domain?

3
  • 1
    Can you add some additional info? Not sure what the question is.
    – Dave M
    Nov 8, 2011 at 21:45
  • 1
    I'm a little lost at "disconnect VM from my domain controller" do you mean disconnect the VM from the network? Is the VM also the domain controller? Nov 9, 2011 at 5:59
  • Dave and Spaceman sorry, my question was not clear but Graeme done good job to make it very clear. Thanks guys. Nov 9, 2011 at 21:02

1 Answer 1

3

When a Windows machine joins an AD domain, a computer account is created in AD. Similar to a user account, this account has a password, although its managed by the computer, so you wouldn't normally even be aware of it, unless you had knowledge of the inner workings of AD.

What happens in your case is something like this:

  1. You take a snapshot of your VM on day 1. At this time, lets assume the computer account's password is "pw1".
  2. On day 10, the time comes for your computer to set a new password for its AD computer account. Let's say the password is now "pw2".
  3. On day 12, you roll back to the snapshot you took on day 1. Your VM now thinks its computer account password is "pw1". The DC/s think it's password is "pw2" and suddenly nothing works any more.

To get to answering your actual question, when you remove the VM from AD and then re-add it, you effectively bring the VM and the DC back in sync, the computer account password is now the same on both sides, so everything works again.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .