Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have recently aquired a small (30 user) domain structure, that was setup HORRIBLY. The previous IT Manager didn't know anything about best practices or the proper way of setting up DNS. Hell he hardly knew what DNS was!

Without going on a soapbox, I have come across an issue where various functions requiring domain access (Intranet site, Exchange, etc.) are at random times giving users a login prompt, and their accounts are not being authenticated. Even though the username and password are correct.

The only way to rectify the situation is to disable their account in AD and then re-enable it. After that it works fine.

Is this caused by something that I'm not doing correctly? Misconfiguration? Fluke?

share|improve this question
Hmm. All/any users or specific ones? Anything in the logs? I'd expect to see a big mess in security or system logs of the DC(s). – Kara Marfia Jul 21 '09 at 16:30
up vote 1 down vote accepted

Any chance the users are getting locked out? Do you have the domain set to lock out after so many missed attempts? Perhaps you have a virus or rogue machine on the network authenticating as other users and locking out their accounts.

share|improve this answer
I do have lock out set, however the users are not locked out when they are reporting an issue. – WedTM Jul 21 '09 at 19:45

Your event logs are trying to tell you what's going on. My gut says "name resolution problem" and that the enable/disable behaviour is just a red herring.

Try and get the "Default Domain Policy" and "Default Domain Controllers Policy" returned to stock settings after you document them. (Have a look at the DCGPOFIX utility.)

Look for other GPOs at the root of the domain or at the "Domain Controllers" OUs and investigate what they're doing. Disable them if they're not needed (but don't delete them until you're sure).

Verify that all the server and client computers have good DNS servers specified.

Did I mention looking at the event logs on the server computers where the authentication problems are happening and the domain controller(s)?

I disagree with "mh" on this one. You can probably get to the bottom of what's going on pretty quickly.

share|improve this answer
Agreed. I would absolutely try to fix it before you junk it. There are 100 things that you'll need to do and may not occur to you right away in setting up a new domain. (Redo all file perms, disjoin and rejoin all workstations, reset all passwords, transfer mailboxes, etc.) – Carl C Aug 18 '09 at 22:57

For that size of org it may actually be more cost and time effective to rip it up and start again. My instinct is that there are probably a lot more things wrong with it than just this credentials problem, any one of which could come back to bite you in the ass years down the line. Given the number of users you have, resolving them in your AD/DNS/Exchange/etc config could consume a lot more time than a simple rebuild done right would. And you'll come out of it with a known and rational setup rather than a patched up mess.

share|improve this answer
If AD was strictly for login credentials, I might agree with you, but they have it tied to some Web services and Exchange. – MDMarra Aug 19 '09 at 0:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.