I did a P2V of my Windows 2003 Domain Controller. I'm trying to add a Windows Server 2012 VM (Computer name: SQL-SERVER) as a member of the domain but I can't.

I can ping to both VMs. I can do a nslookup from 2012 to 2003 but the I can't the way around.

Also, I can't create an object in Active Directory Users and Computers in Windows 2003.

I'm running everything in an isolated environment out of the production network.

This is the error from the domain controller (Windows 2003):

Event Type: Error Event Source: NETLOGON Event Category: None Event ID: 5723 Date: 12/4/2014 Time: 10:21:14 AM User: N/A Computer: DNFILESERVER Description: The session setup from computer 'SQL-SERVER' failed because the security database does not contain a trust account 'SQL-SERVER$' referenced by the specified computer.

If this is the first occurrence of this event for the specified computer and account, this may be a transient issue that doesn't require any action at this time. Otherwise, the following steps may be taken to resolve this problem:

If 'SQL-SERVER$' is a legitimate machine account for the computer 'SQL-SERVER', then 'SQL-SERVER' should be rejoined to the domain.

If 'SQL-SERVER$' is a legitimate interdomain trust account, then the trust should be recreated.

Otherwise, assuming that 'SQL-SERVER$' is not a legitimate account, the following action should be taken on 'SQL-SERVER':

If 'SQL-SERVER' is a Domain Controller, then the trust associated with 'SQL-SERVER$' should be deleted.

If 'SQL-SERVER' is not a Domain Controller, it should be disjoined from the domain.

  • 3
    You should never clone domain controllers pre-2012r2. It causes all sorts of problems that you'll spend hours tracking down. Build a new domain controller from scratch and allow replication to do its job. – Nathan C Dec 4 '14 at 16:10
  • When jou did a live virtualization you may run in big problems. In single DC environments I virtualized some DCs (offline or beeing shutdown) and had no problems with them. @NathanC: Was that just luck? – marsh-wiggle Dec 4 '14 at 16:48
  • You got big risk of USN rollback, please see kb.vmware.com/selfservice/microsites/… as an example for the possible symptom – yagmoth555 Dec 4 '14 at 16:57

Thanks for the suggestions.

I was able to fix the problem. Basically what I did was to clean the metadata with ntdsutil and seized the roles on the Windows 2003 DC.

clean metadata: http://community.spiceworks.com/how_to/show/616-remove-a-failed-domain-controller-from-a-windows-2003-domain

seize roles: http://community.spiceworks.com/how_to/show/2393-make-secondary-domain-controller-the-primary-when-primary-fails

I don't understand why. I have 2 DC, the cloned VM is the primary DC and has all the roles. I hope someone can explain this.

After that, I was able to join SQL-SERVER (Windows 2012 R2) as member server of the domain. My local computer was also able to authenticate to the cloned Domain Controller


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.