Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One specific member server - call it SQLProd - is experiencing failures pulling down the computer account GPOs. All authentication, etc is functioning perfectly. Domain controllers and server are both is 2008 R2.

I am receiving event ID 1030 from the GroupPolicy with an error code of 8341 with a DCname of pdc.mydomain.org. I was also receiving LDAP bind errors 1006 with an error code of 82 "Local Error".

I ran dcdiag and repadmin to verify the health of my domain. All showed well other than the RODC settings. My DNS is in perfect working order and the network settings on the SQL box look good.

Windows IP Configuration

Host Name . . . . . . . . . . . . : SQLProd
Primary Dns Suffix  . . . . . . . : mydomain.org
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : mydomain.org

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
Physical Address. . . . . . . . . : 00-0C-29-ED-CC-3B
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.100.20(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.100.1
DNS Servers . . . . . . . . . . . : 192.168.100.80
                                    192.168.100.81
NetBIOS over Tcpip. . . . . . . . : Enabled

About the time these errors started occurring (within about 48 hours prior) the DNS entry on this box had disappeared. I recreated it with an ipconfig /registerdns. Within 48 hours of that time I demoted our last 2003 domain controller. At about this time the NTP on SQLProd cut over from the 2003 (formerly the PDC emulator) to the new PDC emulator.

Where should I be looking to debug this problem? I assume one of the debug logs would provide some insight but I'm not sure which to enable or where to look.

EDIT: The issue started about 23 days after the pwdLastSetAttribute and we have the default 30 day machine lifetime in place. The lastLogonTimestamp whenChanged attributes have very similar values and are set within a day of when we started having problems.

GPresult and the RSOP snapin do not provide any additional info. Both provide absolutely no output for the computer section.

EDIT: Stranger and stranger.. The error just disappeared on its own with no intervention on my part after occurring regularly for the last 9 days. Hopefully it stays that way.

EDIT: Things were fine for about four hours but now have returned to their previous behavior. Any suggestions would be much appreciated. I also tried nltest /dsgetdc: which indicates there are no communication problems.

EDIT: On some additional searching I came across this site which indicated similar problems. I just restarted the KDC services on both DCs and the issue appears gone for the moment.

share|improve this question
    
Check the pwdLastSet attribute on the computer object, and see if it's within the maximum lifetime for computer account passwords that's set in your policies? –  Shane Madden Dec 9 '11 at 16:23

2 Answers 2

up vote 1 down vote accepted

I have had no further problems since restarting the key distribution services. My virtual DC had been rebooted several times since the problem occurred but the physical box had not.

share|improve this answer
    
after restarting KDC services event 1006 with error code 82 is gone. Thankyou –  Arturas Rimonis Sep 27 '12 at 9:41

ON SQLProd, go to the command line and run "gpresult /r". This will output the RSOP for all group policies being applied to the computer along with any that are failing. Check to see if the computer policies are attempting to be applied and if they are failing or succeeding. Also check to see if the listings for domain, domain type and computer supplying the group policy match what should exist. This will allow you to narrow down the problem to the computer or to the scope of the GP, etc.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.