Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i have been experiancing repeated problems with Trust relationships between workstations and the PDC in my domain.

i will try to describe my enviroment as best as possible

i have 2 Windows Core servers that are Hyper-V hosts: WS2008C-01, WS2008C-02.

WS2008C-01 (2008 R2 Std)
- SQL App Server (2008 R2 Ent)

WS2008C-02(2008 R2 Ent)
- PDC (2008 R2 Std)
- ADC (2008 R2 Std)
- APP Server (2003 R2)

above is the Virtual Machine positions.

the PDC is a 2008 R2 Std VM, as is the ADC, and they are all part of the New Domain.

There are 2 physical Servers (DCs) left in the source domain that was migrated from about 2 months ago. the migration was performed with SID filtering Disabled. the trust is still in place between the two, and the machines in the source domain are all disabled as are the users.

All clients are now in the New Domain.

we are getting issues across the clients such as the following:

Log Name: System

Source: Microsoft-Windows-Security-Kerberos

Date: 27/10/2010 14:18:35
Event ID: 4
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: WS2008-01.plumbworldnetwork.co.uk
Description:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server w7-21$. The target name used was cifs/WXP-10.plumbworldnetwork.co.uk. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server. This error can also happen when the target service is using a different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the service on the server and the KDC are both updated to use the current password. If the server name is not fully qualified, and the target domain (PLUMBWORLDNETWORK.CO.UK) is different from the client domain (PLUMBWORLDNETWORK.CO.UK), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

Log Name: System
Source: srv
Date: 27/10/2010 12:37:06
Event ID: 2012
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: WS2008-01.plumbworldnetwork.co.uk
Description:
While transmitting or receiving data, the server encountered a network error. Occassional errors are expected, but large amounts of these indicate a possible error in your network configuration. The error status code is contained within the returned data (formatted as Words) and may point you towards the problem.
\Device\LanmanServer

Log Name: System
Source: Microsoft-Windows-Kerberos-Key-Distribution-Center
Date: 26/10/2010 14:10:06
Event ID: 29
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: WS2008-01.plumbworldnetwork.co.uk
Description:
The Key Distribution Center (KDC) cannot find a suitable certificate to use for smart card logons, or the KDC certificate could not be verified. Smart card logon may not function correctly if this problem is not resolved. To correct this problem, either verify the existing KDC certificate using certutil.exe or enroll for a new KDC certificate.


and im getting errors such as the follwoing on the clients:

Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5719
Date: 27/10/2010
Time: 11:34:53
User: N/A
Computer: PLUMBWH2
Description:
This computer was not able to set up a secure session with a domain controller in domain PLUMBNET due to the following:
There are currently no logon servers available to service the logon request.
This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator.

ADDITIONAL INFO
If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain.

on doing a netdom command to the trouble workstation you get things like this returned.

netdom verify accounts1 /Domain:plumbnet
The secure channel from ACCOUNTS1 to PLUMBNET is invalid.

The RPC server is unavailable. The RPC server is unavailable.

The command failed to complete successfully.
netdom verify W7-09 /Domain:plumbnet
The secure channel from W7-09 to PLUMBNET is invalid.

There are currently no logon servers available to service the logon re There are currently no logon servers available to service the logon re

The command failed to complete successfully.

a netdom reset does fix the problem, but it doesnt seem to fix the issue forever.

i do not have a CA setup for the new domain, should i?

DCDaig passes all tests also.

i have checked DNS for dups and old entries, nothing stands out. i have checked that the network interfaces on the Core Servers are all operational, and doing large and long ping tests show no drops on the interfaces...

im a bit stuck!

please help!

share|improve this question
    
I'm reading about Event ID 4 and seeing if that can help resolve things from there. I've looked up this code since i'm not familiar with the details of the event and found this: technet.microsoft.com/en-us/library/cc733987(WS.10).aspx Do these machines have matching records in the original domain? –  Nick O'Neil Oct 27 '10 at 16:26
1  
There is no PDC/ADC/BDC anymore, those acronyms died with NT4 –  pauska Oct 27 '10 at 16:35
    
Hi Nick, they do have matching records as they where migrated, but they are disabled.. do you suggest deleting these accounts altogether? –  user58451 Oct 28 '10 at 9:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.