Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Every once in a while, I get a client PC that won't be able to log into the domain. This morning it was telling us that the trust relationship between the pc and the domain failed. I checked the event logs on the primary domain controller and I see this for 2 PCs (the one that had the problem and one that can log in today).

The session setup from the computer failed to authenticate. The name(s) of the account(s) referenced in the security database is . The following error occurred: Access is denied.

I know how to fix this, by rejoining the PC to the domain... But why does this happen and how can I prevent it so I don't have to keep rejoining PCs to the domain?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Computers joined to a domain manage their membership by use of a shared secret. Basically, all computers on the domain have their very own account password, just like all your user accounts.

The difference is that the computers maintain this themselves, without any involvement from you and without you ever seeing what that password is. The machine periodically goes through a password change where a new password is generated and updated on both the computer and the AD computer account object.

What you're seeing is a situation where the password stored on the domain and the password the computer believes is valid, are not the same. This could happen for a multitude of reasons but the most common ones are:

  • Restoring a computer from backup, and restoring an invalid password along with it
  • Reverting a computer VM to a snapshot which was taken before the latest password update
  • Reverting a domain controller vm to a snapshot or restoring a DC from a backup without using recovery mode, and causing a USN Rollback scenario (don't do this!)
  • Replication errors on the domain leaving a domain controller with outdated password information.

So to fix it, watch for issues similar to the above. Any cases where either the domain or the workstation could be ending up with a stale or corrupted account password will bring you this issue.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.