Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 3 domain controlers 2x 2008 1x 2003 server

When i use the nltest /server:dcN.domain.local /sc_verify:domain.local i get: on the 2 of them OK status on one of them i get I_NetLogonControl failed: Status = 1355 0x54b ERROR_NO_SUCH_DOMAIN

i did some tests and when i moved the role "Domain Role Owner" from the server i had the error to another DC the error moved also

is there any connection with the Domain role owner role? and the 1355 error? ////

To be more clear about:

  1. dc1 server FMSO role "domain owner role" testing nltest /sc_verify:domain.local error: I_NetLogonControl failed: Status = 1355 0x54b ERROR_NO_SUCH_DOMAIN

  2. dc2 server no FMSO role testing nltest /sc_verify:domain.local success

now i move fmso domain owner rule to server DC2

  1. dc1 server FMSO none testing nltest /sc_verify:domain.local sucess

  2. dc2 server FMSO role "domain owner role" testing nltest /sc_verify:domain.local error: I_NetLogonControl failed: Status = 1355 0x54b ERROR_NO_SUCH_DOMAIN

share|improve this question
    
OK if someone will have the same Q i will reply to myself "nltest /sc_verify:domain.com" is not a reliable test to check the current secure channel status because it reports the last known state. If the SC is broken you'll get replication errors and access denied in ie. dcdiag logs. If replication is good, then the SC is good. Verify with ie. "repadmin /replsum" –  Elgreco08 Nov 26 '10 at 10:09

2 Answers 2

It is strange that the error moved with the Domain Role Owner. I checked with a domain with a 2008 and a 2003 DC and got the error on the one not holding the role and the error stayed there after transferring the role to this server.

share|improve this answer
up vote 1 down vote accepted

"nltest /sc_verify:domain.com" is not a reliable test to check the current secure channel status because it reports the last known state.

If the SC is broken you'll get replication errors and access denied in ie. dcdiag logs.

If replication is good, then the SC is good. Verify with ie. "repadmin /replsum"

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.