Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got an RODC in our local site and a PDC in our co-location facility. I run SET on any of the computers in our local site and they all say LOGONSERVER='PDC'. They should all be authenticating to the local RODC but they don't seem to want to.

I looked at the logs of the RODC and I get a few spaced out errors coming from NETLOGON:

The session setup from the computer COMPUTERNAME failed to authenticate. The following error occurred: Access is denied.

A search for that error led me here but none of the solutions seem to be of any help (or maybe I'm not using the solutions correctly?)

Has anyone remedied this error before? Can someone point me in the correct direction?

share|improve this question
Have you modified the password replication policy on the RODC in AD Users & Computers? – Clint Nov 29 '10 at 23:53
See under "Why does %logonserver% have the name of a domain controller in my hub site rather than the RODC in my site?" – iPath Aug 4 '15 at 0:08
up vote 3 down vote accepted

Just like users, you have to add computer objects to the policy allowing the RODC to authenticate them (link). The easiest way is to create a group of those computer objects and add them to the policy with Allow. Also keep in mind that Site configuration can affect which DC a station will contact.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.