Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a Windows VM, while installing a service which needs to run under a domain account, my Domain Controller refuses to authenticate the domain account I use.

After I remove this VM from the domain, then re-add it again, the Domain Controller starts recognizing the domain account under which I am installing my service.

This usually happens when I rollback my VM to some previous check-point, although I am sure on the date of that check-point my VM was a member of the domain.

Question Why does the authentication fail after rolling back, until I have removed and re-added the VM to the AD domain?

share|improve this question
Can you add some additional info? Not sure what the question is. – Dave M Nov 8 '11 at 21:45
I'm a little lost at "disconnect VM from my domain controller" do you mean disconnect the VM from the network? Is the VM also the domain controller? – SpacemanSpiff Nov 9 '11 at 5:59
Dave and Spaceman sorry, my question was not clear but Graeme done good job to make it very clear. Thanks guys. – Surjit Samra Nov 9 '11 at 21:02
up vote 3 down vote accepted

When a Windows machine joins an AD domain, a computer account is created in AD. Similar to a user account, this account has a password, although its managed by the computer, so you wouldn't normally even be aware of it, unless you had knowledge of the inner workings of AD.

What happens in your case is something like this:

  1. You take a snapshot of your VM on day 1. At this time, lets assume the computer account's password is "pw1".
  2. On day 10, the time comes for your computer to set a new password for its AD computer account. Let's say the password is now "pw2".
  3. On day 12, you roll back to the snapshot you took on day 1. Your VM now thinks its computer account password is "pw1". The DC/s think it's password is "pw2" and suddenly nothing works any more.

To get to answering your actual question, when you remove the VM from AD and then re-add it, you effectively bring the VM and the DC back in sync, the computer account password is now the same on both sides, so everything works again.

share|improve this answer
Thanks Graeme, that explains a lot – Surjit Samra Nov 9 '11 at 16:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.